Member Avatar for sockmonkey1976

Hi, Folks.
I hope someone can help me. I have an situation in my family where someone is dealing with a serious porn addiction issue. There are several sites listed in the Internet Explorer history (running on XP) that this person claims to have never visited. These sites are not in the temporary internet files. (Though those could have been cleared. Of course, one would assume he would clear the history while at it. But, I have read that there are issues that can make the browser history return after you attempt to clear it. So, maybe he did clear it.)

I know that it is possible to have websites you have never visited show up in your internet browser history because of some spyware or something. But, how frequently does this happen? Is it reasonable to believe that this is the case? Or is it just a possible but unlikely explanation?

Basically, I am just wondering what the most plausible scenario is.
Thanks!

  • 2 Contributors
  • 3 Replies
  • 104 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

— unexpected IE history entries are not, by themselves, proof of deliberate browsing. pointed toward external causes; the next step is to treat the evidence like a small forensic problem and look for corroborating artifacts that show a human intentionally used the browser.

On Windows XP the most useful artifacts to inspect are the IE history file (index.dat, under the user profile History\History.IE5), the typed-URL list in the registry (HKCU\Software\Microsoft\Internet Explorer\TypedURLs), Prefetch files (C:\Windows\Prefetch) which record program launches, and Explorer MRU/UserAssist entries that show interactive activity. Correlate a history entry timestamp with a matching Prefetch/UserAssist timestamp and with a cached file for the page. If those three line up, the case for an actual visit is much stronger.

Entries can also be created without someone consciously navigating to the site: background fetches from toolbars or other apps, redirects and ad networks, a link clicked inside an email/IM preview, or another person using the same account. Because of that, a single history line is weak evidence unless matched to process/run artifacts and file data. Also check scheduled tasks, autorun entries and DNS cache around the time in question to see what made the request.

For future incidents preserve an image before altering the system, keep accounts separate, and capture router/DNS logs so records survive local reformat. If the matter could have legal or employment consequences, engage an incident-response professional so evidence is collected with a proper chain-of-custody.

Recommended Answers

All 3 Replies

Member Avatar for jbennet

I know that it is possible to have websites you have never visited show up in your internet browser history because of some spyware or something. But, how frequently does this happen? Is it reasonable to believe that this is the case? Or is it just a possible but unlikely explanation?

It could be a virus/spyware.

Do you have dialup? if so check your phone bills. There are viruses called porn dialers that ring expensive lines using your modem.

Run a virus AND antispyware scanner then report back the results.

I personally think a vorus is more likely as if someone wanted to hide his surfing habits, he wouldnt miss out the history but do the temp files (if anything, id expect it to be the other way around)

Member Avatar for sockmonkey1976

Thanks for your response. I thought the same thing about the browser history not being cleared. But, I have read that there are some situations where the history might re-appear after someone clears it. So, I wasn't sure.

We've tackled the problem by formating the computer and installing key logging software. (It was the person with the addiction that requested we install the key logger. Personally, I think it's a little creepy. He said he would like to be able to have proof he wasn't doing anything if this ever happened again.)

Thanks again for the response.

Member Avatar for jbennet

no problem :)

one thing to note, history entries can appear due to popup viruses, not just browsing

e.g if i you have those popup viruses that advertise porn sites, each time it pops up, it can add an entry to the hisory.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.