[torsoboy]

My mom just got finished with a bad divorce (and marriage) and is now being followed, harrassed, etc. by her ex and a group of his friends. The one thing that bothers her the most is that they seem to be able to see (or read) what she is doing on her computer. She might write an email to a family member one night, and the next morning she will have an email from her ex saying "I know you wrote to person Y last night and told them about [fill in the blank]". She also visits geneology sites and a couple of dating sites, and at least once a day she gets an email from her ex saying "so I see you were looking up xx on the geneology site", or he will email the people that she is talking to on the dating sites and tell them how horrible a person she is. Etc. He has also gone into all of her online accounts and changed her passwords on her even though she has changed them all multiple times since they were last living together. This has been going on for a couple of months now and she is getting *really* tired of it.

So... do any of you know of a way to determine if a keylogging (or screen capturing) piece of software is on the computer? She has run virus scanners on it and has found nothing... what's the next thing to do in a situation like this? (The police are already involved in some of the stuff, but they say that can't do anything about the online crap.)

[design219]

Mac, PC? New, old? System?

[turtle777]

Dude, WTF ?

Fresh install of OS, no matter what system.

And secondly, keep a copy of all those emails and go to a lawyer.

-t

[Mr Kino]

buy her a new computer, and donate that one to a teenager that loves myspace. heh, that will throw off the ex immensely. and, you get to play with a brand new computer, spend more time with mom, and all will be merry in your world. and the ex.... well he will be wondering wtf....

[turtle777]

Oh, btw, it doesn't sound like a keylogger, it sounds like VNC / GoToMyPC thinggy.

-t

[torsoboy]

older computer, PC, wasn't around when they were still together. a fresh install is deffinitely an option, but hopefully not the first one.

She has a lawyer (and talks to him pretty much every day), but he doesn't know how to stop it from happening either. :/ He knows how to pile on the charges, but not how to clean her computer.

[turtle777]

Originally Posted by torsoboy 

older computer, PC, wasn't around when they were still together. a fresh install is deffinitely an option, but hopefully not the first one.

She has a lawyer (and talks to him pretty much every day), but he doesn't know how to stop it from happening either. :/ He knows how to pile on the charges, but not how to clean her computer.

Ok, so here is some things to consider:

1) Fresh install will definitely help, but an old PC might not be able to run the latest (most secure) version of Windows, so it might still be vulnerable.

2) A Mac would definitely be the better option. Get a Mac mini refurb from Apple, they are dirt cheap and should be able to do all your mom needs to do.

3) Make sure that dude doesn't have PHYSICAL access to the computer.

4) For the love of Pete, get her a new email account and new passwords. Link that new email account to all other online accounts, so dude can't just reset the passwords and have it sent to the old email account.

-t

[torsoboy]

The guy doesn't have physical access to it and whe has a new email address setup, but can't access it yet on her own machine because she believes that by doing so it will be compromised as well.


Thanks for the quick replies guys. I have downloaded a few anti-keylogger apps and am headed over right now to put them on her computer.

[C.A.T.S. CEO]

Originally Posted by torsoboy 

The guy doesn't have physical access to it and whe has a new email address setup, but can't access it yet on her own machine because she believes that by doing so it will be compromised as well.


Thanks for the quick replies guys. I have downloaded a few anti-keylogger apps and am headed over right now to put them on her computer.

Is there anyway you can block the VNC port(s)?

[Cold Warrior]

Put a router between the PC and the Internet. Enable the router's logging feature. Log all incoming and outgoing traffic. You'll be able to see the IP address and ports of the keylogger or VNC client. The lawyer can then use the IP address to subpoena the ISP and confirm that it's the ex doing the harrassment.

[besson3c]

Yeah, if you can't isolate the software being run, block the requests at the network level like CATS and Cold Warrior have suggested.

[turtle777]

Originally Posted by besson3c 

Yeah, if you can't isolate the software being run, block the requests at the network level like CATS and Cold Warrior have suggested.

Easy if it's not going over port 80.

If it's port 80, it's gonna get more complicated, as you would need to know the exact IP of the end server. If that server switches IPs, it gets tougher.

But at any rate, a darn fresh OS will take care of it one way or the other.

-t

[besson3c]

Originally Posted by turtle777 

Easy if it's not going over port 80.

If it's port 80, it's gonna get more complicated, as you would need to know the exact IP of the end server. If that server switches IPs, it gets tougher.

But at any rate, a darn fresh OS will take care of it one way or the other.

-t

VNC doesn't run over port 80.

You don't need to know what ports the software is running over to block network requests this way. You simply block everything *but* the traffic you need to permit.

If the exploit is phoning home, this will be a little harder to isolate (and it probably isn't doing this), but if some other machine is contacting the PC, simply block all incoming requests. Unless she is running a server, she shouldn't need to accept any incoming requests, only outgoing ones.

[awaspaas]

...and don't use the default password on the router!

[Cold Warrior]

Also, install ZoneAlarm and enable its logging feature. It'll record all the traffic, incoming and outgoing. It may provide an alternative to a router.

[turtle777]

Originally Posted by besson3c 

VNC doesn't run over port 80.

I never said it did.

But even worse, GoToMy PC works over port 80. If this app uses a similar zero config functionality, it'll be hard to detect.

Originally Posted by besson3c 

You don't need to know what ports the software is running over to block network requests this way. You simply block everything *but* the traffic you need to permit.

Assuming there is a server listening on that PC. I doubt it.

Originally Posted by besson3c 

If the exploit is phoning home, this will be a little harder to isolate (and it probably isn't doing this),

This is EXACTLY what I was talking about.

Originally Posted by besson3c 

but if some other machine is contacting the PC, simply block all incoming requests. Unless she is running a server, she shouldn't need to accept any incoming requests, only outgoing ones.

I would think it's not so easy if it's a zero-config app that uses technology like hamachi.

-t

[shinji]

If it's installed as a rootkit, your antivirus software isn't going to find it- you'd need something like rootkit revealer or blacklight.

You could try posting on a windows security forum like wilders security but you probably should just reformat.

[besson3c]

Originally Posted by turtle777 

I never said it did.

But even worse, GoToMy PC works over port 80. If this app uses a similar zero config functionality, it'll be hard to detect.


Assuming there is a server listening on that PC. I doubt it.


This is EXACTLY what I was talking about.


I would think it's not so easy if it's a zero-config app that uses technology like hamachi.

-t

I see what you had in mind... It is always interesting to learn about how people implement these sorts of exploits, but at the time my thinking was that it would be better to put the PC on dyndns or something and contact it rather than having it phone home using a hard coded IP or dynamic hostname. Reason being, if the victim were to track down this information about the remote PC, the attacker would be in up to their ears in legal trouble. If I were doing this, I wouldn't leave a trace like this (of course, a trace is left coming in the other direction, but at least the attacker can attack from whatever machine they wanted).

Of course, this guy could be a complete dumbass which is entirely possible.

[turtle777]

I'm not sure, but something like hamachi might be very hard to track down, since it's creating its own VPN. How would you later find out what real IP was involved ?

-t

[mitchell_pgh]

Also, keep the the computer turned off when not being used.

- Keep turned off when not in use
- Reinstall the OS
- Run all the updates
- Purchase and install a router (changing the password and updating the firmware)
- Purchase some virus software
- Use anti-logging software

I would also recommend that your mother get a restraining order put on the ex.

[besson3c]

Originally Posted by turtle777 

I'm not sure, but something like hamachi might be very hard to track down, since it's creating its own VPN. How would you later find out what real IP was involved ?

-t

If the server were running on the victim's PC, I'm sure it would keep logs of incoming connections, no?

[turtle777]

Originally Posted by besson3c 

If the server were running on the victim's PC, I'm sure it would keep logs of incoming connections, no?

No, that's not how hamachi works. It's a virtual VPN, with a centralized server.

-t

[besson3c]

Originally Posted by turtle777 

No, that's not how hamachi works. It's a virtual VPN, with a centralized server.

-t

Where is the centralized server located? Are connections tunneled through it?

[turtle777]

https://secure.logmein.com/products/...pn.asp?lang=en

-t

[besson3c]

Originally Posted by turtle777 

https://secure.logmein.com/products/...pn.asp?lang=en

-t

Thanks tortoise.

[SpencerLavery]

What happened to good old fashioned kicking his ass? If you ain't up to the task I'm sure you can find/pay somebody who is. I fully advocate violence against scumbags like you're describing. With an increasingly failing justice system sometimes it's the only way to get actual justice. I know many cops who would advise the same thing.

[macroy]

I'd assume that computer has been owned. My suggestion is to rebuild it. Even if its with the older OS. It at least will remove whatever the ex installed on there.

While logging and firewalling may be nice from a forensics stand point, I don't think that's the avenue you want to go. At this point, its pretty much just a guessing game what's on there. So, it really is much easier to just rebuild the box. If it were me, there is no way I'd take a chance by just trying to guess whats on there and try to block it... it can be any number of items mentioned so far, multiple items, or something not discussed yet.

If she has a large amount of data on there, get yourself a copy of ghost, and make a backup so she can go back and retrieve said data.

And I'd keep all correspondence received so far (ghosting the machine will provide a rough archive). While the lawyer isn't going to help her with her machine, I'd think all those e-mails would be pretty useful for legal actions... wouldn't it - i.e retraining order?

[Big Mac]

Hey torso, have you checked the server side of her email provider for any rules that may forward mail to one of the guy's accounts? The simplest explanation usually is, you know. . . .

[turtle777]

Originally Posted by Big Mac 

Hey torso, have you checked the server side of her email provider for any rules that may forward mail to one of the guy's accounts? The simplest explanation usually is, you know. . . .

That would not explain how he knew what websites she was visiting...

-t

[shinji]

It would if they were sites you have to register for like dating and genealogy sites.

Really though you (the op) shouldn't be in the middle of an issue between your mom and your dad or stepdad or whoever this is.

[turtle777]

Originally Posted by shinji 

It would if they were sites you have to register for like dating and genealogy sites.

Well, but that's NOT what OP described.

Originally Posted by torsoboy 

She also visits geneology sites and a couple of dating sites, and at least once a day she gets an email from her ex saying "so I see you were looking up xx on the geneology site"...

Does nobody bother to read the OP anymore ?

-t

[irunat2am]

Originally Posted by shinji 

Really though you (the op) shouldn't be in the middle of an issue between your mom and your dad or stepdad or whoever this is.

Definition of bad son = Not even trying to help your mom when she's being harassed and from the sounds of it, stalked. You are probably a bad son.

[shinji]

Originally Posted by turtle777

Does nobody bother to read the OP anymore ?

Obviously I read the OP if I mentioned genealogy and dating sites. Those are sites you have to register for.

Originally Posted by irunat2am

Definition of bad son = Not even trying to help your mom when she's being harassed and from the sounds of it, stalked. You are probably a bad son.

Kids shouldn't be in the middle of a divorce and picking sides. You are probably a bad parent.

[irunat2am]

Originally Posted by shinji 

Kids shouldn't be in the middle of a divorce and picking sides. You are probably a bad parent.

I'm not a parent. Why would you make a comment like that to him when he's just coming on here on his own trying to find a solution to a problem.

How is trying to figure out if there is a keylogger/virus/yada yada program on him moms computer getting into the middle of a divorce? He isn't. He's trying to fix his moms computer so she can go about her day.

Thanks for playing.

[turtle777]

Originally Posted by shinji 

Obviously I read the OP if I mentioned genealogy and dating sites. Those are sites you have to register for.

Obviously READING != UNDERSTANDING

-t

[turtle777]

Originally Posted by shinji 

Really though you (the op) shouldn't be in the middle of an issue between your mom and your dad or stepdad or whoever this is.

Originally Posted by shinji 

Kids shouldn't be in the middle of a divorce and picking sides. You are probably a bad parent.

Dude, WTF

Sometimes, one side is just plain WRONG and farked up, and you gotta take sides. In this case, there is no reason to stay neutral if dad is a creepy asshole.

-t

[shinji]

Originally Posted by irunat2am

Thanks for playing.

YouTube - Broadcast Yourself.

After seeing this, I wish I could say the same to you.

Originally Posted by turtle777

Obviously READING != UNDERSTANDING

You build a profile in genealogy sites. You log in with someone's account and you can see it...that's how you can see who someone is looking up. Dating sites are the same way. I really don't see why this is such a big issue to you, it's something that should be checked.

Originally Posted by turtle777

Sometimes, one side is just plain WRONG and farked up, and you gotta take sides. In this case, there is no reason to stay neutral if dad is a creepy asshole.

You don't have to take sides, I was just saying he shouldn't have to even be in this position. It wasn't an insult in any way.

You are just trying to stick your diagnosis that this is VNC/GotoMyPc when if that were the case the antivirus/antitrojan stuff would've caught it so you're getting pissy when someone questions that. If it's bo2k or something installed a rootkit, he isn't going to find it- he should just reformat.

I'm amazed you two got so worked up over this...

[turtle777]

Originally Posted by shinji 

You build a profile in genealogy sites. You log in with someone's account and you can see it...that's how you can see who someone is looking up. Dating sites are the same way. I really don't see why this is such a big issue to you, it's something that should be checked.

Ok, I give you that this is an option.

I still think that some remote screen sharing is more likely. But I'm not getting worked up, I just pointed out that reading one's email and keyloggers could not be the only option, and IMO, the less likely.

-t

[irunat2am]

Thanks for advertising my song! Thanks for being really psycho and randomly looking me up on youtube, too . . . . Such a good fan!

Torso..I think I found your stalker guy. MacNN forums under shinji. Let us know how the computer thing works out if you find a fix. Good luck, homeslice

EDIT: After thinking about it for a minute..it's actually really really creepy that you just tried to find me outside of here because I disagree with you. Please go see a therapist.

[shinji]

You're welcome. It will be the only publicity you ever get, and don't you ever try to make a driveby comment that someone is "probably a bad son" again.

[irunat2am]

Originally Posted by shinji 

You're welcome. It will be the only publicity you ever get, and don't you ever try to make a driveby comment that someone is "probably a bad son" again.

Put it up for my friends, so I'll be able to live with that. Seems like a I hit a button somewhere - Sorry for making you think about your comment telling him he shouldn't help a parent in need, basically.

I was just saying he shouldn't have to even be in this position. It wasn't an insult in any way.

Way better wording.

[shinji]

Apology accepted. You did hit a button somewhere, and I probably should step away from this thread

Good luck torsoboy.

[torsoboy]

Thanks for posting everyone. When I went over last night she was gone and her office was locked, so I wasn't able to do anything for her last night, but I will be going over again tonight to tell her some of the options you guys have been suggestions.

She has had a restraining order against him for about 9 months, but that doesn't stop him from doing anything. He has been in jail five or six times in the last nine months for violating the restraining order, but he doesn't learn much from that. Basically he sees it as his mission in life to ruin her life (he has pretty much said that exact thing).

To let you know what type of guy he is... he has a bunch of other people all harrassing her also; they spam her email every day with all sorts of foul things and call her every name in the book. He has people watching her house and following her wherever she goes (she gets calls and emails saying things like, "so what were you doing at place X last night", or "I see your right front tire is a little low on air", etc.). He has gone onto the same dating and geneology sites that she visits and has created about 10 fake profiles with each one slandering her horribly (she has contacted the site admins and has had the profiles removed multiple times, but when they're taken off he just creates new ones). He has called her satalite company pretending to be the owener of the account and ordered multiple XXX movies, and then has called up the company that she has foster boys from and told them to check her satalite bill because she has inappropriate movies being shown in her home. One time when he got out of jail the first thing he did was call her friends and tell them that he had convinced the others in jail at the time that she was a horrible person and that the others in jail now had all of their addresses and were going to be "paying them a visit". He has been arrested multiple times for sitting in his truck waiting in front of the school one of my younger brothers goes to school at (he has threatend to make him "disappear" in the past). He has been ordered out of the state of Utah because he has caused so much trouble in the area, but he continues to come back. Etc.

So basically just about as much of a loser and a creep as you can imagine.

He is up to his neck in legal problems right now, but the problem that is causing her the most stress right now is the computer thing. She has learned to deal with most of the other things as just a part of life for the current time, but the computer thing is the one that most directly affects her day to day stuff. She has an AOL email address and has contacted them to see if they could track down who is sending the email, but they said that they couldn't do it. She has changed email addresses a few times, but each time she does it he somehow knows what her new email address is.

So, like some of you have suggested, formatting might be the best thing to do at this point just so we're not just guessing at how he is doing it.

[Big Mac]

It sounds like this guy's got some psycho in him. He's really got a posse doing his bidding as well? Does your mother have anyone who can stay close to her location to help her defend herself emotionally, if not physically? And does she own a firearm that she's comfortable with?

[ghporter]

Get the lawyer involved, and get him to get a broader restraining order. This sounds very much like "stalking" as defined by several states, so another order that prevents him from contacting her in any way and even through third parties (other than his attorney to her attorney) is in order here. The lawyer should also push to have the harasser held in jail until the harassment stops permanently. This is not a game, and he needs to see that. I nice little contempt citation and a few weeks behind bars might just get his attention.

And a new computer with a new kind of Internet service is indeed appropriate, along with a router. She should also have the phone company, the cable company, the power company, the gas company, and the water company ALL come out and review the house for problems. At the same time, the accounts for all these services should be changed to HER name exclusively (if they aren't already). A new phone number, both land line and cell is an absolute must. The cost of all of these things WILL go into the settlement. From my point of view, this guy is asking for a raking over the coals.

[irunat2am]

Originally Posted by ghporter 

And a new computer with a new kind of Internet service is indeed appropriate, along with a router. She should also have the phone company, the cable company, the power company, the gas company, and the water company ALL come out and review the house for problems. At the same time, the accounts for all these services should be changed to HER name exclusively (if they aren't already). A new phone number, both land line and cell is an absolute must. The cost of all of these things WILL go into the settlement. From my point of view, this guy is asking for a raking over the coals.

All GREAT advice. Also, is it a city or county police department that is involved? A lot of times, larger departments (some city, more county) have at least a couple people to work on online/internet related cases. This guy sounds like he could easily take this to the next level and become violent to her or others around her. When criminals are punished (jail) and keep doing the same exact thing like they don't even care, they really have the 'inner retard' (for lack of a better description) to take it to the next level, due to not fearing the consequences.

To be honest, if you're dealing with just city, you should walk straight into the county sheriff's office and speak with a deputy. Find out who or what agency can help you out with the internet part.

A lot of times departments are more than willing to send a patrol unit out your way a couple extra times throughout a shift just to pass by and check on things. This sounds serious enough to warrant it. He obviously has major issues.

[irunat2am]

Also, save A N Y T H I N G (papers, e-mails, phone messages, etc.) that has to do with him threatening harm/violence/death. That completely bumps it up to a new level in the court and on charges. It sounds like this guy needs to go away for a long time so you guys can live a normal life. Document everything as well. Calls, times her accounts are messed with, etc. The more info you can bring to your court and lawyer to show he's a threat, the better off you're case will be.

[torsoboy]

Originally Posted by ghporter 

I nice little contempt citation and a few weeks behind bars might just get his attention.

And a new computer with a new kind of Internet service is indeed appropriate, along with a router. She should also have the phone company, the cable company, the power company, the gas company, and the water company ALL come out and review the house for problems. At the same time, the accounts for all these services should be changed to HER name exclusively (if they aren't already). A new phone number, both land line and cell is an absolute must. The cost of all of these things WILL go into the settlement. From my point of view, this guy is asking for a raking over the coals.

The guy was found in contempt of court a month and a half ago on 6(!) accounts and was ordered into jail for 6 months (30 days each). Then his lawyer found some loophole a few weeks later and got him out in just 30 days. The morning after he was released my mom was getting the emails, etc. all over again. His lawyer is just as much a creep as he is, but he is doing annoyingly good at keeping him out of jail as much as possible.

The accounts have all been put in her name only, and she has a guy coming in a day or so to check out her phones to make sure nothing funky is going on with them.

Originally Posted by Big Mac 

It sounds like this guy's got some psycho in him. He's really got a posse doing his bidding as well? Does your mother have anyone who can stay close to her location to help her defend herself emotionally, if not physically? And does she own a firearm that she's comfortable with?

He is bi-polar and doesn't take his medication. I have no idea if he really does have a whole posse doing his bidding, but he has at least one or two other people that are. Most of her kids (incuding myself) live within 5 minutes of where she is, so we can get over there pretty quickly if we need to. In the past we did have to come over quite a bit because the guy would come over in the middle of the night and pound on the doors. The police arrested him a few times for doing it, and I guess his lawyer has convinced him that it isn't the best way to handle things.

Originally Posted by irunat2am 

All GREAT advice. Also, is it a city or county police department that is involved? A lot of times, larger departments (some city, more county) have at least a couple people to work on online/internet related cases. This guy sounds like he could easily take this to the next level and become violent to her or others around her. When criminals are punished (jail) and keep doing the same exact thing like they don't even care, they really have the 'inner retard' (for lack of a better description) to take it to the next level, due to not fearing the consequences.

To be honest, if you're dealing with just city, you should walk straight into the county sheriff's office and speak with a deputy. Find out who or what agency can help you out with the internet part.

A lot of times departments are more than willing to send a patrol unit out your way a couple extra times throughout a shift just to pass by and check on things. This sounds serious enough to warrant it. He obviously has major issues.

There are actually three cities, and the county involved right now. The police used to drive by quite a bit to make sure things were okay, but he has changed to doing everything via internet and phone now. The police here don't know what to do about the internet stuff so we have just barely started looking into other agencies that can help out a bit more.

Originally Posted by irunat2am 

Also, save A N Y T H I N G (papers, e-mails, phone messages, etc.) that has to do with him threatening harm/violence/death. That completely bumps it up to a new level in the court and on charges. It sounds like this guy needs to go away for a long time so you guys can live a normal life. Document everything as well. Calls, times her accounts are messed with, etc. The more info you can bring to your court and lawyer to show he's a threat, the better off you're case will be.

My mom is really good at saving everything she gets from him. She has a filing cabinet full of it. One of the hardest parts about it is that because he uses multiple accounts and doesn't have his real name associated with them it is hard to prove that it is really him. It is very very obvious that it is him, but difficult to prove with just emails from free/anonymouse email accounts.

[0157988944]

Provoke him and then shoot him in self defense. It seems like that's all that will stop this guy.

[irunat2am]

Originally Posted by adamfishercox 

Provoke him and then shoot him in self defense. It seems like that's all that will stop this guy.

Did you know that if somebody breaks into your house, and even comes at you, if you shoot them while they are turned away towards the door or towards a window it's not self defense? That's the Sunday Factoid of the Day...