Computer Help forum

Resolved Question

Help: Need proof/evidence of suspected spyware/keylogger

by ToastedSpider / July 4, 2011 9:19 AM PDT

Hi all,

New to this forum, hoping we can find help for a close friend.

She's in the middle of a vicious divorce, and the soon-to-be ex got into her home to "fix" her computer (WinXP). She's not very computer savvy. The ex is scary, brags he can break into her house anytime he wants. He's gotten in and started selling her personal possessions as well as the kids'. (Jewelry, bikes, toys). He's also shown some threatening obsessive behavior - actually pretty scary.

Since he messed with her machine, her screen blinks a lot, runs very slow, and she found that he's been monitoring her email, even though she changed passwords.

The suspicion is that he installed keyloggers and/or other spyware, as he's talked about info that he was never told (multiple times), stuff that was only present on her computer.

What we're wondering:
1. Is there a way to prove that keyloggers and/or other spyware is installed, but without wiping it out automatically?
2. If the spyware is discovered, is it possible to discover where the info is being sent (i.e. an IP address). This is needed to help build a police case.
3. Any recommendations for apps that can help trap this info

Thanks in advance for any help!!!

ToastedSpider has chosen the best answer to their question. View answer
Discussion is locked
You are posting a reply to: Help: Need proof/evidence of suspected spyware/keylogger
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Help: Need proof/evidence of suspected spyware/keylogger
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

All Answers

Best Answer chosen by ToastedSpider

Collapse -
What I would do

What I would do, is not touch the computer at all, but have the drive taken out, give it to her lawyer to then take and give to a professional who can write up some report that can be used during the proceedings.

I would also suggest she get a restraining order based on what's been said. Put up some surveillance cameras, and if she can catch the guy breaking into the house, then she can go to the cops who will put him in jail. A restraining order is really only going to do so much obviously, but it's about all our legal system affords.

This isn't the sort of situation where you want to play detective yourself. Get the drive to a professional retained by her lawyer so that they understand that they are collecting evidence for a legal proceeding. Try and do it any other way, and it's all but guaranteed that his lawyer will get the judge to exclude it from the proceedings. And if her lawyer doesn't have any idea how to do this, then it might be time to find another lawyer.

Also, if you suspect that the husband is monitoring emails, do not email her about this. Have her come over to your place, explain what needs to be done in person only after she arrives, then go back and grab the entire computer if you don't know how to remove a HDD. Just take the whole thing to her lawyer's office, and then her lawyer can arrange to have someone inspect it for the purposes of the divorce proceedings. And while you're there, you can have her lawyer file a petition for a restraining order if that hasn't been done already. You can swear out an affidavit if you were ever personally a witness to any of the things you described.

Just let me stress this one more time. DO NOT ATTEMPT ANY KIND OF FORENSICS YOURSELF! Take the computer directly to her lawyer, do not pass go, do not collect $200, do not make any unnecessary stops between the time you collect the computer and the time you drop it off with her lawyer.

Collapse -
Help: Need proof/evidence of suspected spyware/keylogger
by ToastedSpider / July 4, 2011 5:10 PM PDT
In reply to: What I would do

Jimmy - I added a reply some hours ago, but it appears that it didn't get posted.

Thank you so much for the time you took and for the well-thought-out response. All your points make perfect sense, especially with the legal aspects of this situation.

One thing we don't want is to tip off the ex, once the suspect machine has gone offline. If there is spyware on there, he'll notice the source has been cut, so we'll need to come up with a story that can be leaked to him.

I have zero experience with keyloggers/spyware - is there a way to determine where the info was being sent (assuming that the computer has really been compromised here)?

Again - thank you for your time - extremely appreciated

Collapse -
That probably won't be possible

That probably won't be possible. I can't say as I'm an expert on divorce law, but I'm assuming the same basic rules of discovery apply as any other legal proceeding, so his lawyer(s) will inevitably get a copy of anything found on that computer. You could claim that it crashed and she took it in for repairs, but that will only buy a limited amount of time. If anything her lawyer can use is found on the computer, then his lawyers will get a copy of the report. Contrary to what you see on TV, there aren't moments in real trials where one side pulls some surprise bit of evidence that wins the case in their favor. In a real courtroom, if one side or the other pulls a stunt like that the opposing side will object immediately, and the judge will have little choice but to exclude it. The judge will also likely take a very dim view of any such antics, and make life very difficult for that side.

When you take the computer to her lawyer's office, discuss these concerns before leaving the computer there. Your friend is probably paying a couple hundred dollars an hour anyway, she may as well get her money's worth.

If you try and feed some false story back to the husband, his legal team well could use that as evidence against her. Your intentions are good, but they probably will backfire in a big way in this situation. And remember, this guy is basically committing an unauthorized wiretap, which is a felony, so if he's as unbalanced as you make him sound, he very well could trip up and reveal something very useful if he discovers the fact that the computer is missing. If she gets a restraining order, and can then obtain evidence that the guy broke into the house, then the cops would be able to get involved and start asking the guy why he was breaking into the house, etc. At the very least, they'd have him on violating a restraining order and breaking and entering, which would probably be more than enough to keep him in jail for a long time. Make sure the cops are aware of the restraining order if she does get one. Don't rely on it filtering through the various layers of bureaucracy, because it will probably go into a file somewhere and no one will ever look at it unless she calls 911 because the guy is breaking into her house.

But if it hasn't already been done, it would probably be a good idea to send the kids to stay with a relative if the guy's as unbalanced as he sounds. Whichever relative is the furthest away geographically. The more of an effort it is for the guy to get to them, the better.

Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions

Does BMW or Volvo do it best?

Pint-size luxury and funky style

Shopping for a new car this weekend? See how the BMW X2 stacks up against the Volvo XC40 in our side-by-side comparison.