[es] - Istorija pristupa USB flešova na Windows 7

KengurBGD
Beograd

Član broj: 139457
Poruke: 33
95.180.16.*

ICQ: 494173947

+9 Profil

Istorija pristupa USB flešova na Windows 7

^{09.02.2013. u 01:28 - pre 148 meseci}

Pozdrav,

pre neki dan pitao me je prijatelj da li nekako u windows-u može da se vidi kada je priključivan (datum i vreme) neki USB stick na njega.
Razlog zašto mu ovo treba je zato što sumnja da mu je jedan kolega na poslu krišom prebacio neke fajlove sa kompjutera van radnog vremena dok nikog nije bilo u kancelariji.

Prva ideja mi je pala da nešto takvo bi trebalo da ima u windows event log, a opcija 3rd party software ne dolaze u obzir s obzirom da se radnja već desila.

Malo istražujući došao sam do sledećih zaključka (hvala ES korisniku bureX na savetima preko chat-a za ovo :) )

Windows 7 prilikom svakog priključivanja USB-a beleži njegovo priključivanje u system log (windows logs/System).

Level:Information
Date and Time: datum
Source: Service Control Manager
Event ID: 7036
Task Category: None

Ukoliko pretražimo sistemski log sa "The Portable Device Enumerator Service service entered the running state." Dobićemo vreme i datum pristupa (portable devices) od istaliranja sistema.

---------------------------------
Informacije koje sam dodatno pronašao na netu:

Citat:

If you really want to get your hands dirty, open RegEdit and look for the following entries:

Description: List of Installed USB devices, both connected and unconnected Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB Why you care: It can be useful to know what USB devices have be connected to a box, and even the vendor and serial number of the device in some cases. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. Think how useful it can be to help tie something a user physical possesses to a box.

Description: List of installed USB storage devices Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR Why you care: Much like the installed USB devices entry, but just for USB storage. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. CleanAfterMe scrubs HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB but not USBSTOR when I tested last.

Zanimljivi linkovi vezani za ovu temu:

Windows XP kako videti i izbrisati logove vezane za korišćenje USB-a

Windows XP,Vista, 7 kako videti i izbrisati logove vezane za korišćenje USB-a

Wiki Forensics USB_History_Viewing

-------------------------------------------------------

Ako još neko ima neki dobar savet kako videti koji USB stikovi su priključivani na kompjuter (windows) i vreme priključivana molim neka kaže.

Takođe jel ste imali potrebu nekad da vadite ovakvu istoriju USB korišćenja?

kristi1

Član broj: 151211
Poruke: 2012
*.dynamic.isp.telekom.rs.

Sajt: www.mycity.rs/Ambulanta

+88 Profil

Re: Istorija pristupa USB flešova na Windows 7

^{09.02.2013. u 10:02 - pre 148 meseci}

Za ubuduce neka instalira ovaj program
http://amf.mycity.rs/mcshield/downloads.html

Prvo imace zasticen sistem od strane zarazenih USB ili memoriskih kartica.
Evo kako izgleda jedna akcija, sve je automatizovano.

Code:
>>> MCShield ::Anti-Malware Tool:: v 2.4.3.18 / DB: 2013.2.2.1 <<<

2/8/2013 10:39:32 PM > Drive F: - scan started (DJORDJE ~982 MB, FAT32 flash drive )...

>>> F:\autorun.inf > Suspicious > Renamed.

---> Note: traces of file replicators have been found!

---> Executing generic S&D routine...

>>> F:\rad.exe - Malware > Deleted. (13.02.08. 22.39 rad.exe.360317; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\TL-WN321G_v4_100611.exe - Malware > Deleted. (13.02.08. 22.39 TL-WN321G_v4_100611.exe.502891; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\diplomski.exe - Malware > Deleted. (13.02.08. 22.39 diplomski.exe.250005; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\projektna dokumentacija.exe - Malware > Deleted. (13.02.08. 22.39 projektna dokumentacija.exe.612591; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\(2003) Ten Pieces To Save the World.exe - Malware > Deleted. (13.02.08. 22.39 (2003) Ten Pieces To Save the World.exe.750266; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\(2003) East meets east.exe - Malware > Deleted. (13.02.08. 22.39 (2003) East meets east.exe.540106; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\kroke 7 trip.exe - Malware > Deleted. (13.02.08. 22.39 kroke 7 trip.exe.774516; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\adrenilando.exe - Malware > Deleted. (13.02.08. 22.39 adrenilando.exe.824948; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\Mv2 player.exe - Malware > Deleted. (13.02.08. 22.39 Mv2 player.exe.461203; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\Win2K_XP_X64_Vista.exe - Malware > Deleted. (13.02.08. 22.39 Win2K_XP_X64_Vista.exe.421944; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\TL-WN321G_100324.exe - Malware > Deleted. (13.02.08. 22.39 TL-WN321G_100324.exe.143650; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\Via_4in1433v.exe - Malware > Deleted. (13.02.08. 22.39 Via_4in1433v.exe.672807; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\WinXP.exe - Malware > Deleted. (13.02.08. 22.39 WinXP.exe.163568; MD5: 56dec30ef90d4b0439349bb23dc32b51)

>>> F:\VIA_HyperionPro_V524A.exe - Malware > Deleted. (13.02.08. 22.39 VIA_HyperionPro_V524A.exe.495543; MD5: 56dec30ef90d4b0439349bb23dc32b51)

> Resetting attributes: F:\rad < Successful.

> Resetting attributes: F:\TL-WN321G_v4_100611 < Successful.

> Resetting attributes: F:\diplomski < Successful.

> Resetting attributes: F:\projektna dokumentacija < Successful.

> Resetting attributes: F:\(2003) Ten Pieces To Save the World < Successful.

> Resetting attributes: F:\(2003) East meets east < Successful.

> Resetting attributes: F:\kroke 7 trip < Successful.

> Resetting attributes: F:\adrenilando < Successful.

> Resetting attributes: F:\Mv2 player < Successful.

> Resetting attributes: F:\Win2K_XP_X64_Vista < Successful.

> Resetting attributes: F:\TL-WN321G_100324 < Successful.

> Resetting attributes: F:\Via_4in1433v < Successful.

> Resetting attributes: F:\WinXP < Successful.

> Resetting attributes: F:\VIA_HyperionPro_V524A < Successful.

=> Malicious files   : 14/14 deleted.
=> Suspicious files  : 1/1 renamed.
=> Hidden folders    : 14/14 unhidden.

____________________________________________

::::: Scan duration: 25s :::::::::::::::::::
____________________________________________

Logovi se cuvaju tako da moze u svakom trenutku da zna ko je i kad prikljucivao USB.
Ako je zarazen bice ociscen, ako nije sve jedno je zabelezen datum i vreme skeniranja.

Kao sto vidis fleska je bila puna kao oko i sve je ocisceno i vraceni su atribudi na difolt za 25 sec.