Notification

Icon
Error

Internet history of an user (IE and Firefox)

Posted: Wednesday, September 2, 2009 3:59:38 PM(UTC)
0
Like
Well, in the last weeks I've faced a lot of new vírus that were not detected by an antivirus, so I had to figure out how they have entered in the computer. I've installed this neat action to check logged in user internet history, and it also works for files accessed:
1. get this great nirsoft utility http://www.nirsoft.net/utils/iehv.html
2. add this action:
Code:
\\server\share$\Lansweeper\iehv.exe -folder "\\{computer}\c$\Documents and Settings\{username}\Local Settings\History"


That's it, you get the history and you can easilly know where that vírus come from, many of them are from google searches and they only install when clicking on the search result, if you click directly on the link it does nothing. I will not post examples since I could be helping to spread those vírus - they offer themselfs to the user as being an antivirus sofware,
Options
mrdaytrade
#1mrdaytrade Member Posts: 99  
posted: 9/2/2009 5:14:21 PM(UTC)
This is a great custom action... thank you!
0
cvau89
#2cvau89 Member Posts: 6  
posted: 9/11/2009 9:26:08 PM(UTC)
Hey - Great custom action - does anyone understand how to do anything similar with the chrome browser?
0
Perkins
#3Perkins Member Posts: 19  
posted: 10/10/2009 12:07:00 AM(UTC)
Great Tool....thanks!
0
afionda
#4afionda Member Posts: 3  
posted: 11/3/2009 11:52:32 PM(UTC)
VERY NICE BULL !!!!
0
BullGates (no longer LS user due to abusive increased costs)
#5BullGates (no longer LS user due to abusive increased costs) Member Original PosterPosts: 249  
posted: 7/13/2010 6:28:50 PM(UTC)
Although this is not so simple or usefull for many of you, I've made a simple interface so I can use Internet history of a Firefox user, using the tool from Nirsoft: http://www.nirsoft.net/u...ozilla_history_view.html

Using AutoIt, I've made this simple script to get the firefox profile directory:
Code:
Global $FFprofilesDir
$FFprofilesDir = $CmdLine[1]
$FFprofilesIni = $FFprofilesDir & "\profiles.ini"
$ProfilePath=IniRead($FFprofilesIni,"Profile0","Path","")
$replace = StringReplace($ProfilePath, "/", "\")
Run("MozillaHistoryView.exe -file " & """" & $FFprofilesDir & "\" & $replace & "\places.sqlite" & """")


Note that I read the file "places.sqlite", but it can be history.dat depending on your firefox version I guess.

You will need to put this dll's on the same folder of the actions if you don't have firefox installed on the running computer:
http://www.sqlite.org/sqlitedll-3_6_23_1.zip
You should also put MozillaHistoryView.exe on the actions folder, as well as the compiled autoit script, I've named it FirefoxVHHelper.exe

The action should be something like:
Code:
{actionpath}FirefoxVHHelper.exe "\\{computer}\c$\Documents and Settings\{username}\Application Data\Mozilla\Firefox"


Thats it.

Edit: For those who need the compiled version of the script, I've attached now that file. It only reads "places.sqlite" file; the code is posted on the top of this message.
Handles attachments
FirefoxVHHelper.zip (280kb) downloaded 191 time(s).
0
isit
#6isit Member Posts: 7  
posted: 3/27/2012 7:50:54 PM(UTC)
I am trying to use this action but, I am having trouble connecting to the user's computer. I have installed the utility (on the lansweeper server under actions) but, when I run the custom action, it only runs is on the server instead of the users pc. In your code, you have "-folder" when I remove this, it gives the server history, when I add it, it gives nothing. So what exactly does folder represent? What do we replace it with if anything?
0
isit
#7isit Member Posts: 7  
posted: 3/28/2012 7:01:45 PM(UTC)
I got it working!
0
Jono
#8Jono Member Posts: 111  
posted: 4/12/2012 6:23:49 PM(UTC)
Is there an easy way to edit these scripts to make them work with Windows XP clients and Windows 7 clients without having to distinguish between them first?

Currently, both of these will only work on Windows XP ("Documents and Settings" folder doesn't exist on W7).

Thanks,
Jono
0
TNTreasury
#9TNTreasury Member Posts: 19  
posted: 4/30/2012 11:15:47 PM(UTC)
i downloaded the files and save to my actions folder but when i select the action from the Lansweeper web page, I get Error: file not found.

.any thoughts?


the action i have is
iehv.exe -folder "\\{computer}\c$\Documents and Settings\{username}\Local Settings\History"
0
Lansweeper
#10Lansweeper Member Posts: 13,442  
posted: 5/1/2012 9:25:17 AM(UTC)
add {actionpath} variable to your action
0
MCanning
#11MCanning Member Posts: 5  
posted: 3/6/2013 8:45:50 PM(UTC)
This works great - I have a mix of XP & Win 7 boxes here so I added another action entry:

For Win 7
Code:

{actionpath}iehv.exe -folder "\\{computer}\c$\Users\{username}\Local Settings\History"
0
Argon0
#12Argon0 Member Posts: 44  
posted: 11/9/2017 5:56:54 PM(UTC)
All good... But I need to get history from IR11...

So the tool BrowderHistoryView from nirsoft looks good, but I can't work out if there is a way to pass the computer name to it automagically (rather than launching and pasting/typing the name).

...

Argon0
0
jgranese
#13jgranese Member Posts: 3  
posted: 12/7/2017 6:11:22 PM(UTC)
I have setup BrowserHistoryView and it is working

Get it here: http://www.nirsoft.net/u...owsing_history_view.html

This is the action I used:

{actionpath}BrowsingHistoryView.exe /HistorySource 7 /ComputerName {computer} /VisitTimeFilterType 1 /StopIECacheTask 1

I still have to click OK but the setting are what works for me. The download page has the parameters if you need to change some.
2
Tizi@no
#14Tizi@no Member Posts: 2  
posted: 4/1/2022 1:32:49 PM(UTC)
Originally Posted by: jgranese Go to Quoted Post
I have setup BrowserHistoryView and it is working

Get it here: http://www.nirsoft.net/u...owsing_history_view.html

This is the action I used:

{actionpath}BrowsingHistoryView.exe /HistorySource 7 /ComputerName {computer} /VisitTimeFilterType 1 /StopIECacheTask 1

I still have to click OK but the setting are what works for me. The download page has the parameters if you need to change some.


Thanks this work with Win10 and Win11
0

Active Discussions

Lansweeper Lansweeper Dark Theme
by  mrobbins   Go to last post Go to first unread
Last post: Yesterday at 5:38:01 PM(UTC)
Lansweeper Detect Docking Stations
by  GlenH   Go to last post Go to first unread
Last post: Yesterday at 3:52:13 PM(UTC)
Lansweeper Exclude non-windows assets from scanning by assetname
by  rapheren   Go to last post Go to first unread
Last post: Yesterday at 1:18:12 PM(UTC)
Lansweeper HTTPS Certifikate untrusted
by  pskup   Go to last post Go to first unread
Last post: Yesterday at 9:20:07 AM(UTC)
Lansweeper Migrate to new host but without SQL
by  pskup   Go to last post Go to first unread
Last post: Yesterday at 9:03:14 AM(UTC)
Lansweeper Object reference error after updating to 10.2.0.0
by  Erik.T   Go to last post Go to first unread
Last post: Yesterday at 8:10:25 AM(UTC)
Lansweeper Custom reporting - Asset Groups and AD Description
by  rbshawn   Go to last post Go to first unread
Last post: 6/29/2022 10:54:10 PM(UTC)
Lansweeper A FIX for an odd Scan Error WMI/DCOM from scanning server
by  danielm   Go to last post Go to first unread
Last post: 6/29/2022 10:14:44 PM(UTC)