We run a keylogger on some of our desktop machines at work. This is because a while back we caught someone stealing valuable company data, and since then have warned staff that they will be monitored in this way. I have lately become concerned because on three out of the 12 desktop machines I keep seeing entries like this presenting themselves in the logs of the keylogger (not always the same keypresses)
*/{PgUp}{Scroll Lock}{Ctrl}{F12}{Back Space}{F9}{F7}{F4}{F8}{F1}9[{Enter}02{Right}{Down}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Left Win}{Alt}{Alt}{Alt}{Alt}{Alt}{Alt}
This always happens in the early hours of the morning when it is not possible for anyone to gain entry to the office
My question is, how do I start tracing the root cause of this and how do I prevent this happening? Does anyone know what this could be?
Some facts: There are no event log entries corresponding to this set of events. Sometimes the desktops have no open apps running when it happens and no startup entries defined that would achieve this effect.
I thought I would add another set of keypresses from a different machine so you will have more info
{Ctrl}c{Ctrl}v{Back Space}{Home}{Del}{Del}
{Scroll Lock}{PgUp}{Shift}*{Back Space} ={Enter}
{F10}{F9}3{F3}2{F2}{F8}{F9}{F10}{F3}{F2}45
45rtyh ,{Right Win}{Ctrl}1{Left}{Right}52
I would be grateful if someone could even tell me a little more about what might be happening. Thank you .
