Internet usage tracking software.

[Poppa_Meth]

I have a guy here where I work that is obsesively accessing porn sites. I've blocked the majority of his activities with Trend Micro's web filters. However I can see where he is still saving a few things on the HDD. I'd like to know if there is a decent program that can monitor the browsers to see what websites are being visited. Something that outputs to a simple log file would be fine. Free is preferable but not a complete necessity.

[ROF]

Have you considered firing him?

[Poppa_Meth]

I'm not the boss. He's a friend of the boss's. Until I can show him what sites the guy has been accessing I doubt he'll believe me. He's actually only worked here a few months and been worthless since day one. I hate situations like that. If it weren't from Acronis I'd have spend a few days getting the spyware infection he caused cleaned up.

[jimmalenko]

I *think* you can configure your firewall logs to dump page listings either using the HTTP protocol and/or using port 80. At the very least it would give you the IP of the web servers accessed, which you could block on the router.

[Poppa_Meth]

Software or hardware firewall? I'm running Sunbelt/Kerio and a Linksys WRT54GS

[CrayonEater]

There are tons of keyloggers available.

You can set up a caching proxy and simply monitor what pages he visits.

You can set up Snort or even Ethereal to monitor every DNS request coming from his machine.

The latter two are probably the easiest and cheapest, but will require some kind of connection like a simple passive tap (or even a true hub will work, if you can afford running at half-duplex.)

[jameshgross]

I think a simple word in the ear of your IT security person should bring an end to avtivity like this.
If it is child porn then you all could be in trouble: Him for DNloading it, You for knowing and not reorting it to the police, The supervisor for protecting him.
No company will tolerate this kind of activity.
Go over the bosses head.

[Abbadon]

Hi,

I don't know if you are in the United States, and I am not a lawyer, so I could be wrong here. You should be careful of what you do and how you do, installing monitoring sofware to spy an employee could backfire on you and the company you work for. The guy could decide to sue or just accuses you of unethical conduct.

Has he signed a document where he is aware of forbidden activities in the work place? is there clearly policies regarding of what is permitted or not?, does he has a gun?, has he been postal?

[CrayonEater]

Employers have a right to monitor their employees. You may be at a greater risk of liability if you don't monitor for inapproprate use in some cases, and child porn is one of them.

It's been awhile since I used any kind of Linksys product, but I remember their logging was generally very good. Doesn't WRT54GS log all DNS requests?

[jameshgross]

I work in this area for a large U.S. company. I can assure you that U.S. companies are not required to notify their employees of monitoring activites. A simple popup screen during logon can inform the user that non bussiness use is forbidden. The company I work for monitors all e-mail and web activity. Supervisors recieve a monthly usage report for each employee.
I know of no company that does not use some form of monitoring. This may be an out sourced activity to a security company ie the mojnitoring system is not on site. U.S. companies never discuss their computer security. Those caught violating company computer usage simply dont come to work again.
I advise anyone with knowledge of company usage violations to tell someone.
Sooner or later the person will get caught.

[Poppa_Meth]

I'll check into some of these options.
For all purposed I AM IT. We are a small company of 4 employees. The boss is the boss and that's that. I'm thinking of just running the guy over with the forklift and calling it an accident.

[mats.hogberg]

The question is: Why is it a problem to you?

/Mats

[lantern]

With the Linksys WRT54GS, you can:

The Administration Tab - Log
The Router can keep logs of all traffic for your Internet connection. To disable the Log function, keep the default setting, Disable. To monitor traffic between the network and the Internet, select Enable. When you wish to view the logs, click Incoming Log or Outgoing Log, depending on which you wish to view. Change these settings as described here and click the Save Settings button to apply your changes or Cancel Changes to cancel your changes.

This is from the user guide here

[jameshgross]

Although the forklift scenario may work for warehouse workers it hard to justify forklift tracks in the office rug.
A better idea is to simply block the sites at the firewall. I doubt if he will complain.

[Poppa_Meth]

It's a problem for me because he get some spyware and virus infections through the protections (probably disabling scanners and firewalls to get what he wants) and I have to clean up the mess. I just got back into work today so I'll check out the router settings.

Thanks again.

[ROF]

A computer problem for one is a computer problem for all in the workplace.

[Prot]

If you monitor him, you have to monitor everyone. Do you run XP Pro at work? XP Pro offers more security.

[CrayonEater]

You can filter spyware using a firewall or IDS.

See www.geocities.com/yosponge/updates.html

A simple Linux or OpenBSD box placed inline should do the trick. There are some firewall rulesets at that site that aren't listed on the webpage which are used for automatic updates to firewall and IDS products not listed, and there are a few personal firewalls for Windows that implement these filters as well, some with autoupdates. These can both prevent and contain spyware.

If this guy is D/Ling spyware, is his browser getting hijacked? Why not disable/remove Internet Explorer and disable Java in whatever other browsers you use? That'll take care of pretty much all spyware except dialers and such that he actually downloads and executes manually. Javacoolsoftware.com has some immunization and memory-resident spyware-blocking tools as well. Probably will work fine alongside your existing tools.

Unless you can get your boss to take action, you may unfortunately be relegated to containment and mitigation rather than prevention of this problem.

[ROF]

Personally, friendships aside I think if you can logically explain the time you must spend cleaning the systems from this guys "pass time" activity at work I am sure you can make him/her understand this friend of his/hers is reducing productivity in the workplace. If your boss is not receptive to this you must ask yourself, do I really want to work at such a place?

[Poppa_Meth]

I'll get something worked out with them. I've been running SpyBot Ad-aware Plus, Spyware Blaster and Trend Micro PC-cillan on all computers here. Only one has XP Pro. The problem is an mentioned, he is indeed actually downloading and trying to install software, something representing itself as a video codec he needs for some of the video he's trying to watch.

[CrayonEater]

Here something worth considering. Try finding the codec or whatever that keeps reappearing and install it yourself, noting what files install and where. (Alternatively, find out what files are being deleted in disinfection). Delete them, create dummy files with the exact same name in the exact same locations, and mark them Read-Only as well as System, in order to prevent them from reinstalling. Ancient trick, but an ancient trick that's still highly effective even today.

[Poppa_Meth]

Not a bad idea. I actually already have a list of the files from Kasperky's online scan.

[kisrum]

also, if another employee, especially a woman, sees some porn on his screen, she could accuse the company of operating a hostile environment and make things very uncomfortable for you and your boss.

[Poppa_Meth]

Good thing we have no women workers.
We just have the boss, his son, me and the new guy who is causing all the issues. I'm gonna give him a good brow beating today. I'll explain to him that I can monitor everything he does and turn it in to the boss at any time. He's gullible as hell so hopefully a little scare will stop his activities.