1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Microsoft Word killing monitoring software

Discussion in 'Business Applications' started by dadwith6, Oct 31, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. dadwith6

    dadwith6 Thread Starter

    Joined:
    Oct 31, 2011
    Messages:
    4
    Hi, will try to explain and make this short as possible with pertinent information.

    My sons desktop computer:....windows xp....p4.... about 4 years old...seems to work fine.

    He is 16 and is goofing off on chat sites during school time for online home school..not getting school work done so it needs to stop...I have given him numerous opportunities to trust him (that he is doing school when time for school and not playing) and now he needs me to lovingly force him to do right. I installed a keylogger program (refog...free version) and it did its job (still operating properly) for six months. I know I can do the browser security and block sites on explorer but that is tedious and they use a special school browser that seems to allow way too much. Next step is to not allow that browser but I still want to find out what he is doing to stop these programs now?

    Now he has somehow downloaded a program ? or figured something out accidentally ? talking to friends?? that closes monitoring programs. When looking at the keystrokes he did before it shut down and program that was open the last entry is Microsoft Word (2007 version) and typing one letter. Usually it is him typing 'h' but I have seen 'f' 'g' 'x' or 'ff' 'gg' so do not think it is important (but could be wrong) which letter or letters he types when Word opens I just know that a few seconds later all monitoring software stops. I can tell from the program activity log this seems to be the last thing done before programs shut off. I also have just downloaded/installed win-spy monitoring software on the computer (full version). It was also working ok and I can even watch his screen remotely ... it is hard to tell with the lag exactly what is going on but I can see Microsoft Word being opened and then win-spy, and refog keylogger both shut down. So since both monitoring programs shut down I do not think it is trouble from either program. What is weird in the program activity log is that when the computer starts up it will show 'run' for processes of win-spy and refog and all the normal windows programs but after the Word program is open it does not show activity for 'close' of those programs but they do indeed close. If any program is normally closed like at shut down the program activity log usually records the event of 'close'.

    So I wanted to find out if anyone has run across this or may have an idea of what could possibly be happening with Microsoft Word or maybe a combination of Word and a program that opens at the same time and executes the close of monitoring programs? The activity log does not register any other program or keystroke happening......just Word opening....then nothing.....not any particular Word document either....just a blank 'Document 1'??

    I know there is the possibility that he could just be opening task manager and killing (end process) the correct processes for these programs but the activity log will normally register if task manager was opened and of course it did not. Also there are quite a few processes that have to be ended and this seems to be simultaneously without the record of the end process happening.

    I know I could just yell at him and make him tell me what is happening but I would like to see if I can troubleshoot and just find out myself. I have tried key combination's and opening word and doing task manager process ending but so far everything I have tried is still registered on keylogger activity log and they are not killed like when he has done it without being registered as other keystrokes or tasks or anything else happening. The monitoring programs seem to be working fine still and no issues....just don't do their job when they get killed instantly. I know anti-monitoring programs are available that let you know if you are being monitored and then let you stop them/close ports/end processes......but this seems pretty advanced and I am shocked that he has found it and I cannot....and this win-spy pro 9.7 says it is very good and stealth and can not be ended....?....maybe just marketing hype cause I know I can see the processes in task manager and I thought they were not suppose to be listed there to be stealth....I don't believe he is using task manager because he would have to 'know' all six? (that I think I noticed that were added when I installed win-spy) processes and be able to end them quickly.... I can walk in 20 seconds later from seeing live remote (10 second lag) get frozen and he is on a regular school page. ""Possible this is it, but not likely""

    I know all you young ones that like to disobey parents are laughing now. I would like some help even from the smart young ones. I am knowledgeable with the computer and know my son is smart but he cannot write code or does not have any experience that would help explain how this advanced anti-monitoring software ended up on the computer. (he could not have purchased it either) He is up on this one, makes me think he found this on accident but don't know right now. At least for the last 60 days the activity log has not registered any downloads/installs and this just started happening this last month. I am fairly certain he does not know the passwords either. Extremely unlikely for the new win-spy. The live remote does not show anything else going on....no password boxes popping up. He has done this trick 10 times in the last month (last 2 days in a row) since I started paying closer attention this week and I have reviewed his computer once. I am going to look more at his computer tomorrow and look into win-spy options since I just got it a few days ago but I need some expert advice.

    Everything is happening within windows and I don't see any malware or antivirus or any linux program that would allow him to go to the chat sites out of windows. Like I said he is using the school browser which I cannot edit for allowed/disallowed sites. I will be talking to school tech to help correct that also.

    Thanks in advance for ANY help......and helping me keep kids with good character.
     
  2. md2lgyk

    md2lgyk

    Joined:
    Jul 3, 2003
    Messages:
    1,068
    Does he have a particular account he uses to log in? If not, create one for him, and limit the account's permissions. At work, the average user cannot install anything or alter any system settings.
     
  3. dadwith6

    dadwith6 Thread Starter

    Joined:
    Oct 31, 2011
    Messages:
    4
    Yes he does have a particular account that I must log into for him to be on the computer. This morning I watched the live remote again and with the lag it is difficult to see exactly what happens.

    He opened Microsoft Word.....a blank "Document 1" opened up......then the window for shutdown and restart of windows popped up.....I never seen this pop up before.

    Now it makes me think he has another account.....which I did 'not' think he could create without admin privileges......it appears identical including same programs and icons on the desktop.

    I know from Friday that I could go back into the room when he was gone and reactivate both keylogger and winspy so everything is still there.

    I am almost positive that he does not know the admin password and could not create another account but I could be mistaken.
    I will be checking tonight.

    Are there programs that will copy your desktop and all programs right away and allow you to log on another user without having admin privileges? I guess there must be. This would be a exact copy except the monitoring software would be inactive......but I can reactivate so it is there...hmm

    I am not sure this is it but it does seem one possibility........I did not think he could switch users so fast so I did not consider it......maybe a companion program when he opens Microsoft Word???? To switch users why would Word need to be opened???
    Still do not think this is it because he would not know the passwords.

    Any other ideas are welcome PLEASE
     
  4. Rockn

    Rockn

    Joined:
    Jul 29, 2001
    Messages:
    21,334
    Maybe there is a macro being fired off with an alt+ key combination that is stopping the service.
     
  5. md2lgyk

    md2lgyk

    Joined:
    Jul 3, 2003
    Messages:
    1,068
    I don't think anybody but the Admin account can create other accounts (though I may be wrong). And you need to revisit the permissions on his account. Rockn may be correct that there's a macro involved here, but I can't imagine a macro that could download and install software.

    You didn't ask for this advice, but having raised five kids and knowing a bit about our local home-school community (my wife teaches art to them), I'm going to give it to you for free. I hope you are not offended.

    You are the adult here. Such a lack of respect should not be tolerated. Lay down the law: another infraction and he's in public school. He's obviously not taking his education (or you) seriously.
     
  6. dadwith6

    dadwith6 Thread Starter

    Joined:
    Oct 31, 2011
    Messages:
    4
    Thanks I will be revisiting the permissions tonight and seeing if the possibility of another account is there...don't think so but will see.

    If a macro is involved then the keylogger is not registering it....I have tried to recreate it this weekend with no success...the logger always shows the combination's and programs open.

    I am not offended by the advice and I am with you on this. He has done the smaller infractions and has had most of his freedom taken away. I would not use 'public school' as an ultimatum since it is so bad now. I have laid down the law and given the consequences and followed through. He is just now at the point of the 'one more speech' and the 'BIG ultimatum'. I did not feel it was necessary yet but of course it is now. Before it was if he did not get good grades he could not be on the home school basketball team (which would hurt him) but he is getting good grades.....B's......we know he can do so much better if he would not be goofing off during school time so the big ultimatum is here.

    We have not had an issue with our older kids he just is more stubborn and pushes the limit. He is getting it.....he just THINKS he is getting away with things and can't get caught.....he is caught and does not know it....and he is only getting away with it to a certain extent......once I figure exactly what is happening he will know he has no choice but to do his best in school.

    We do not tolerate the lack of respect and he will learn to take school more seriously. Yes we thought he would have learned by now but he is 'different'. Some of these kids only take us seriously when we give the ultimatum's.....why dunno??

    I will be getting into his computer tonight and will let you know what I learn.

    Any other suggestions/advice or possible scenarios why 'Word' would be shutting down the monitoring software Please chime in. Thanks for those already.
     
  7. dadwith6

    dadwith6 Thread Starter

    Joined:
    Oct 31, 2011
    Messages:
    4
    Well I found out what he has been doing with Microsoft Word...it is a macro....it can be done with powerpoint and others. It makes the computer start to restart and shuts off processes then quits the restart and back to windows. He found it on accident. Do not think its good idea explain how it is done so other kids do not know how to fool their parents. It can be stopped so parents don't think your kids have anything on you. The combination of a keylogger and remote monitoring is necessary.....please read the post above for the why??? Thanks for the ideas, I especially like the filters in the router idea.
     
  8. md2lgyk

    md2lgyk

    Joined:
    Jul 3, 2003
    Messages:
    1,068
    Weird. Never would have suspected Word could be made to do such a thing.
     
  9. Rockn

    Rockn

    Joined:
    Jul 29, 2001
    Messages:
    21,334
    Word can do any number of things if the account that is logged in has the permissions to do things on file system or service objects. You could create an admin account and make everyone else just a normal user with rights to do what you allow them to do.
     
  10. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1024784

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice