Need help to make sure I check everything.

A lady I know came into work last week wrote a letter and went to print it. Sometimes her printer doesn't work and she has to unplug and replug the USB. When she did her printer spit out 4 pages of porn and then her document.

They asked me to check into how this could have happened for them, so I did. The computer has McAfee antivirus on it, it is current, appears to be setup correctly and working. I dumped a Hijack this log and the only negative I found was a MyWebSearch Toolbar, which appears to be only a privacy issue, not a porn feeder. The computer does not show any signs of an active malware infection.

So I checked the temporary internet files. The night before (based on last access) I see a set of entries that look like this.

Yahoo Mail
Little bit of Porn
Yahoo Mail
Lot of Porn
Yahoo Mail

I can see who's yahoo mail account it is in the cached pages from yahoo. And it looks like someone surfing porn to me.

The person who's owns the yahoo account, was the only person in the building when these items were accessed. Yet he flatly denies having done any porn surfing on the computer.

I don't really believe him, but I want to give him every benefit of the doubt.

Do I have him dead to rights already... or is there something else I should check?

If this isn't the best place to ask this... please let me know where to post.

BTW he won't loose his job over this, they just want to get to the truth, and if he is doing this get him to knock off doing it on thier computers.

Thanks for any input you might have on this,

John

 

It's really obvious it was him.
First he has used the computer, since his yahoo account was checked. And if he was the only one in the building, it's pretty obvious that nobody else used the computer between the 2 mail checks.
So why not confront him and say to him "we know it was you, we have evidence".

Also, the IT staff could put some monitoring software or at least some porn blocking.
What about security cameras?

 

Well it seems those pics were queued for printing and when the printer started working again then they were printed.

Is there a way to check as to what time/date those pics were originally set to be printed?

 

>>Is there a way to check as to what time/date those pics were originally set to be printed?

I'm not aware of a print log in XP so I don't see a way to find the time. The web site however had a date last updated on it that was consistent with the the log time for the porn surfing.

I'm not aware of any malware that does print outs.

Anyone ever seen one that does?