Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 44 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow How to determine which user installed software on Windows XP
EH-Net
May 18, 2013, 09:33:05 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: How to determine which user installed software on Windows XP  (Read 8156 times)
0 Members and 1 Guest are viewing this topic.
neteng33
Newbie
*
Offline Offline

Posts: 8


View Profile
« on: August 14, 2009, 05:32:54 PM »

Hello All,

I am examining a Windows XP system, and there are multiple profiles on this system.  I would like to determine which user installed some of the software on this machine, but am not sure exactly where to look or what tools would be most useful for this task; can anyone point me in the right direction?
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #1 on: August 14, 2009, 06:05:38 PM »

This one  is a little tough.   Your friend with this one is the registry.   There is a key that tracks track installed software, however it is on a per-machine basis.    The isn't necessarily going to tell you who installed the software.  

Code:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal

What you can do is look for the registered owner of the software.   This would be something  the user entered during the installation wizard process.  You could get lucky and have that field completed.   You would look for "RegCompany" and "RegOwner" entries in the registry.   This could be under the above registry key or under the individual registry key for the software you are investigating.

You could also look for instances of the msiexec process being run in each users' Event Log.   The logs may tell you what the software being installed is, or they may not.  This wouldn't work if the installer didn't user msiexec.  

Another valuable registry key is the User Assist key.  It is user specific and could provide you with the information you are looking for.   The key is ROT13 encrypted, but there are a ton of parsers for this key on the web.  

Code:
HKCU\Software\Microsoft\Windows\CurrentVersion \Explorer\UserAssist

Various MRU registry keys (Most Recently Used) are a good place to look for programs being executed, including setup programs.

Code:
HKCU\Software\Microsoft\Windows\ CurrentVersion\Explorer\RunMRU

additional MRUs are referenced here:

http://windowsxp.mvps.org/RegistryMRU.htm

Mounted Devices is another good registry key to correlate to various Link files you may find on the machine.   You can even reference that against prefetch files based on the times.  For example, suppose that a USB drive was mounted, and find a link file pointing to the Setup.exe file on the USB device.  You can look for a prefetch file for most likely msiexec and see if it was executed around the same time.

Code:
HKLM\SYSTEM\MountedDevices
HKLM\SYSTEM\ControlSet00x\Enum\USBSTOR

For Internet downloaded software, check the users Internet History and Link files.  If they downloaded the file, chances are they installed it.  You can reference the above artifacts to confirm this.

Check out this PDF from Access Data for additional registry artifacts that may help you:

http://www.accessdata.com/media/en_US/print/papers/wp.Registry_Quick_Find_Chart.en_us.pdf


When all else fails, search the entire registry for a list of keywords.   It helps if you have access to a tool like Access Data's Registry Viewer.  

<edit> I forgot to mention that the HKCU hive is the ntuser.dat file under each profile.   The HKLM\SOFTWARE hive is in the WINDOWS\SYSTEM32\CONFIG folder, it's the SOFTWARE file. </edit>
Hope this helps.
« Last Edit: August 14, 2009, 06:08:49 PM by Ketchup » Logged

~~~~~~~~~~~~~~
Ketchup
neteng33
Newbie
*
Offline Offline

Posts: 8


View Profile
« Reply #2 on: August 17, 2009, 03:39:57 PM »

Thanks a bunch Ketchup - The info you provided did spark my "creative thought process", and I was able to find most of what I was looking for. 
Logged
jimbob
Guest
« Reply #3 on: August 19, 2009, 06:51:22 AM »

If you have logs of when users logged in you may be able to match this to the creation date of the software which was installed. You may also find shortcuts on the desktop and start menu of particular users which may also indicate who installed it.

Regards,
Jimbob
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.571 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.