Hi
A little late with my two cents worth.
In addition to what has been posted. If you can find any FTP applications that may exist have a look through the installation folders.
I found one called 'QuickConnect' within an application called SmartFTP.
In thier was a number of .xml files that showed an automatic login had been setup to the remote hosting site that displayed the offending website. This auto setup contained both username and encrypted password plus domain details and path to 'home' folder containing the images in question.
Also found a registry key 'LastVisitedMRU' showing access of a folder on the local machine by the smartFTP app which contained images that had been used on the site. Last written time and date for this key was a few seconds prior to the upload time and date of the subject image files found on the server.
Cheers
Also found a registry key 'LastVisitedMRU' showing access of a folder on the local machine by the smartFTP app which contained images that had been used on the site. Last written time and date for this key was a few seconds prior to the upload time and date of the subject image files found on the server.
If you don't mind me asking, what's the full path to that key, and how did you definitively tie it to the smartFTP app and not the user?
Thanks,
h
Hi keydat89
The full path was
Software/Microsoft/Windows/CurrentVersion/Explorer/ComDlg32/LastVistedMRU
The entry was one of the MRU list and I was viewing it through AccessData reg viewer. The value was as follows
S∙m∙a∙r∙t∙F∙T∙P∙.∙e∙x∙e∙∙∙C∙∙\∙D∙o∙c∙u∙m∙e∙n∙t∙s∙ ∙a∙n∙d∙ ∙S∙e∙t∙t∙i∙n∙g∙s∙\∙T∙e∙s∙t∙\∙M∙y∙ ∙ D∙o∙c∙u∙m∙e∙n∙t∙s∙\∙T∙e∙s∙t∙ ∙P∙i∙c∙s∙∙∙
(This key was from a test machine I set up to see if I could re-create it) This key appeared when using the SmartFTP app to upload from the 'Test Pics' folder.
Right, but that's not directly associated with the app, it's associated with the user…
yeah…
sorry have I missed the point? I thought McCrea was looking for ways to try and show a particular machine was used to upload files.
Although having re-read my post I see how it can be interpreted that the app was acting without user control? If thats the case I will take more care in future.
cheers
By the way what does NoVA stand for?