Kaseya Community

Stolen Laptops....what to do?

  • I have a current live laptop that is online intermittently and still has it's kaseya agent checking in.

    So far I've:

    * Hidden the Kaseya Agent
    * Removed the uninstall feature for this
    * Hacked together a script to do screengrabs and email them to me every minute it is on - this worked last night an absolute treat and I have a name of the current user (logging into Twitter & hotmail)

    Anyone got any other nice scripts I can run on this machine to gather further evidence?

    I have been asked to try and delete his my docs etc - anyone got a script to do this?

    Thanks!
    Graeme

    Legacy Forum Name: Stolen Laptops....what to do?,
    Legacy Posted By Username: notgraham
  • check this thread: http://community.kaseya.com/xsp/f/114/t/4905.aspx

    Legacy Forum Name: How-To,
    Legacy Posted By Username: richardprice
  • Grab all ip info when its online


    Script Name: Collect IP information
    Script Description: This script writes the current Connection Gateway and IP Address to the SCript Log and also collects all ipconfig information.

    IF True
    THEN
    Write Script Log Entry
    Parameter 1 : Current IP address: #vMachine.IpAddress#
    OS Type : 0
    Write Script Log Entry
    Parameter 1 : Current Connection Gateway: #vMachine.ConnectionGatewayIP#
    OS Type : 0
    Execute Shell Command
    Parameter 1 : ipconfig /all >> "#vAgentConfiguration.AgentTempDir#\ipconfig_output.txt"
    Parameter 2 : 1
    OS Type : 13
    Get File
    Parameter 1 : #vAgentConfiguration.AgentTempDir#\ipconfig_output.txt
    Parameter 2 : ..\Docs\ipconfig_output.txt
    Parameter 3 : 3
    OS Type : 13
    Delete File
    Parameter 1 : #vAgentConfiguration.AgentTempDir#\ipconfig_output.txt
    OS Type : 13
    ELSE


    Legacy Forum Name: How-To,
    Legacy Posted By Username: thirteentwenty