How do I find out if my employer has installed spyware on my computer?

Question

In my office yesterday, we had a power blip and all of our computers restarted. Upon restarting, I had a dialog box that an application was installed and my computer required a restart. I mentioned this to several colleagues and none of them had the same happen.

I guess I can't post a screenshot image, but here's what it said:

"A newly installed program requires this computer to be restarted. Please save your work and restart your computer. Your computer will automatically be restarted in 2 hours 53 minutes 1 second."

I restarted again and that took care of the message.

I don't recall installing a program recently, though we are asked to log off rather than shut down every day. I can't be sure the last time I even rebooted the computer.

Anyway, I have no illusions about a "right to privacy" when it comes to my company computer. I'd just like to know whether they are spying on me or not.

What can I do to see if they've installed spyware on my computer?

Answer 1

Without getting into communication issues between employers and employees, and who has the right to do what. I have a couple thoughts along general lines that apply more to, if I got this message on boot on my computer, what would I do.
First I would think that there are several things which most people install that probably update transparently that would also give the same message. Not necessarily including, but for example Java runtimes, Adobe readers and players, etc. Stuff like that which you just automatically install when you need it, then forget about it, even windows updates do the same thing on my computer.
Second, if I really wondered, I would run a simple registry analyzer which could be run from a USB key drive. I really like Regseeker if I don't want to install something. I would use this to analyze what is started on boot and then identify or investigate anything that I didn't recognize.

Answer 2

It's a fairly common practice for IT departments to push out software updates, new applications, and the like. One tool that does this is Microsoft System Center. Using such a tool an application could be pushed out and a reboot scheduled on any system within an organization. While I'm sure that there are some employers who monitor computer usage, I'd like to think that they're in the minority. I could see the need for such monitoring in certain situations such as positions where there are security concerns. In such a case I also imagine that anyone who was the subject of such monitoring would be so advised in advance and/or would have a reasonable expectation that such monitoring might occur. If an employer suspected wrongdoing on an employee's part, that might also be a reason for monitoring. Finally, an employer could easily "sniff" the network for any traffic from/to a particular workstation without installing anything and Internet use could be tracked by using a proxy server.

I'd just ask the IT department if they've pushed out any software lately. A call to the help desk could garner an explanation of the message you saw.

Answer 3

Ask your employer.

Answer 4

Scan your filesystem and find the recent files by date (I have no idea how would you do that on Windows). Even you have user rights, you might have read access to those files. If you find an executable/dll, you could try your luck by submitting it to an online service like virustotal.com. If it's a spyware trojan, there are chances that one of the antiviruses will return a positive.

Answer 5

Get a Linux boot CD (something like System Rescue CD) with the antivirus scanner. Plug it in, boot into Linux, and scan your computer. That may be against your company's policy though, so use wisely.