Hidden files regarding passwords for Web applications

[sweetsun1970]

Hey all,

I have run many virus scans and searched typical file extensions for
SpyWare, and there is not a hardware keylogger on my computer; however,

my boyfriend has accessed my web-based email accounts. The passwords
are impossible to crack - trust me. Are there hidden files in Windows
which act like a keylogger? I never click remember passwords, and I
don't have any of the autocomplete features turned on. It's like he
has been able to access a file that Word would use to remember what has

been entered so you can press undo.


Surely, if you can have Windows remember your password, there must be a

file that writes to the password remember file. So, where is this
file, and does it remember keystrokes (even asterisks) after shutdown?

Also, if there is such a file, how is he reading it?


Please help!!

 

[Wesley Vogel]

HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider
If there are any passwords here, you cannot tell what they are because they
are encrypted.

If your boyfriend logged onto your machine in your account all he would need
is one of these programs.

Protected Storage PassView v1.60
http://www.nirsoft.net/utils/pspv.html

RockXP 2.0
http://www.majorgeeks.com/download4138.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[sweetsun1970]

I have actually used the PSPV software and got nothing.

I think he has somehow found an encrypted file and read it. Is this
possible, how did he do it?

 

[zero]

Hey all,

I have run many virus scans and searched typical file extensions for
SpyWare, and there is not a hardware keylogger on my computer; however,
my boyfriend has accessed my web-based email accounts.

The passwords are impossible to crack - trust me.

Are there hidden files in Windows
which act like a keylogger? I never click remember passwords, and I
don't have any of the autocomplete features turned on. It's like he
has been able to access a file that Word would use to remember what has
been entered so you can press undo.

Surely, if you can have Windows remember your password, there must be a
file that writes to the password remember file. So, where is this
file, and does it remember keystrokes (even asterisks) after shutdown?

Also, if there is such a file, how is he reading it?

You're looking at the magicians left hand while all the action is
happening in his right hand, IMHO.

Just like a good magician has you believing and seeing what he/she
wants you to.
He has just floored you with an illusion of being the most computer
savvy person you now know.
OK then, .....Boyfriend snoops thru your things (purse, drawers,
desk, day planner, etc.) while you're asleep, passed out, in the john,
parking the car, answering the phone, etc.

He found your secrets.

This new found knowledge is useless, unless you do something with
it.

He's so excited in wanting to show you he's superior, while your
vulnerable and need him in your life, bla,bla,bla ,,,,he can't keep it
a secret any longer. (you must be smarter/more edumacated then him?)

It's kind of a insecure-funny the more I think about it.

It's funny if he's a good honest guy and came clean to you right
after he "proved his point".
Along with telling you how you walked away from your day planner
(whatever) open and with a full view of your passwords for all to be
seen.

HOWEVER … if this is not the case, you're inadvertently pursuing a
relationship with a sad little man. (LOL! I sound like the next guy
in line to be your boyfriend!)

Just change your passwords to something simple for a day and see if
he gets it right the first time. If he's stumped, you know he snooped
your papers. If he gets it in a few minutes (maybe with you not
watching the screen) then he's hacked your PC. Either way, both
actions are very assholish.

If he has hacked/snooped into all of your personal info… after
throwing him out and changing the locks, I would change all bank
account numbers (close them=reopen with new passwords) credit card #'s
, etc.
Some people don't like what little power they have taken away from
them.

Sorry for the "all doom" reply, buts that's how I see it. Good luck


-zero

 

[Guest]

I have had a problem with someone another user with admin rights downloading
porn to drive d i guess to burn a cd. Morph D: came up how do I get to this
to find out what was done? Also, could this person have downloaded some sort
of program to protect his privacy on line and I not know about it? How to
find this out. History, is there a way to check activity on the computer for
all user accounts if I am the main admin?
Thanks

 

[sweetsun1970]

I'm not helpless. I'm savvy enough to know he's not running a
keylogger, hasn't highjacked my admin status and saved functions, and
isn't outside running some packet sniffer. The ****er has found the
file where key strokes are stored until they are "written" to file.
Think about it, if you are typing and hit backspace, you are not
erasing from the screen - you are erasing from the a file that is
controlling the display. That means the keys are logged somewhere.
Where does Microsoft store this, and how do you read it??

 

[Wesley Vogel]

He probably got the password off the sticky-note under the left hand drawer.

Do a Search on your machine for *.psw

..psw = WinXP Backup Password File

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Daniel Crichton]

Hey all,

I have run many virus scans and searched typical file extensions for
SpyWare, and there is not a hardware keylogger on my computer; however,

my boyfriend has accessed my web-based email accounts. The passwords
are impossible to crack - trust me. Are there hidden files in Windows

The first problem you have is that you assume passwords are impossible to
crack. There is no such thing as impossible in the world of security.
Complex passwords merely increase the processing and time required to
discover them.

The most likely scenario is that he has watched you enter a password at some
point, or you've written it somewhere and forgotten. It's also possible that
he's found a cached file in your TIF that contains your password, in which
case you can blame that on a poorly written web-based mail website as there
should never be a reason for the password to be returned in the contents of
a page.

Dan