What Does Investigator Do?

What Does WinWhatWhere Investigator™ Do?

Investigator's unique ability to invisibly monitor and record all computer activity along with keystroke logging make it ideally suited for the [image] investigative needs of law enforcement, government, business, and private individuals.

The data is presented in easy to read reports that include a raw keyboard output along with a "final copy" display that processes and removes all editing replicating the final output of a document. The data is exportable making it accessible to a broad range of other applications for analysis and reporting.

Investigator is virtually undetectable and tamper proof. Deployed on a network, Investigator reports all activity on every workstation to a single database.

Data Collected By Investigator

Workstation

Computer name
User

Login name
Date

Date of entry
Start

Start Time
Elapsed

Time window was active
Keystrokes

Number of keystrokes recorded
Caption

Caption of the current control. This can be the window title, button caption, etc. The is can also include information from text fields such as passwords, instant messaging, and incoming email.
EXE

Full name of program
Formatted Text

Captured keystrokes with editing processed. This column will closely resemble the final output.
Raw Text

Captured keystrokes as it was recorded. Includes all function keys, arrow keys, etc.

Raw vs Formatted Example

Raw Text | Formatted Text
<LEFT><LEFT><LEFT> <LEFT><DELETE><DELETE> <DELETE><DELETE> <DELETE><RIGHT><RIGHT> <RIGHT><LEFT><LEFT> <RIGHT><END>, control, and other special keys are translated into ket<BACK>y descriptions. F<SHIFT>or example:<SHIFT> <UP><RIGHT><RIGHT><RIGHT> | control, and other special keys are translated into key descriptions. For example:


Getting Started With WinWhatWhere Investigator

Follow these simple steps to get Investigator up and running.

Register

After Installation, start Investigator's Setup program. W3iSetup.EXE. If you have purchased Investigator, click on the Registration Tab.

Enter your case sensitive registration name and number exactly as shown on your Invoice or registration notice you received via email. (Don't bother trying the example.)

Click on Register. The text to the right should now say "WinWhatWhere Investigator is licensed for X computers to XXXXX". If it does not, check your caplock key.

Start Tab

After Investigator is registered, you will be able to remove additional checkmarks on the Start Tab.

Remove the checkmarks from Start with splash screen and Show in system tray to completely hide Investigator.

You can also add password protection to the setup and reporting programs. Enter a case sensitive password and place checkmarks next to History and/or Setup.

Start Investigator

Finally, start Investigator if it is not running and exit by clicking on OK.

Remove Investigator from the Desktop

You can safely delete the two icons installed on your desktop.

It's running and collecting data

You can now view all activity by running the Report Program, W3iHIST.EXE


Getting Started with Stealth Email

The Stealth Email feature of WinWhatWhere Investigator can be used to send the collected data from the monitored computer to any email address as a standard email attachment. The collected data can then be viewed on another computer using Investigator's Report program, W3iHIST.EXE This feature is useful when the monitored computer is not readily accessible or is not on the same network as the computer that will be used to view the collected data.

Notes:

  • Both the computer being monitored and the computer viewing the data will need to have WinWhatWhere Investigator installed.

  • You will only need a single license for each computer monitored. One of the monitored computer’s licenses can also be used on the computer viewing the data.

  • If both computers are on the same network, you may want to consider simply pointing both computers’ data paths to the same location on the network. This is the easiest and simplest way to remotely monitor and does not involve sending data via email.

Install Investigator on the computer to be monitored.

Do a normal installation. (See Installing Investigator ) Click on the Stealth Tab in W3iSetup.EXE.

The information required to enable Stealth Email is about the email account that will receive the Investigator data. You do not need any information from the monitored computer's email account. Investigator does not use the monitored computer’s email software, accounts, or other information in any way. Stealth email will leave no trace of email activity on the monitored computer.

Place a check mark in “Use Stealth Emailer”

To

Standard email address that will receive the data.

Mail Server

This is the name of the SMTP server used by the email account entered in the TO field. The SMTP Server name is usually stored in your existing email program. For example, in Microsoft Outlook this can be located at Tools – Services – Properties – Servers.

Stealth email cannot be sent to an AOL account. We suggest you use a free Web based email service such as HotMail.

The SMTP server for HotMail is mail.hotmail.com

Account Name

The name used to log on to your email.

Password

The password used to log on to your email.

Always On Settings

Investigator will always send any accumulated data immediately whenever a new valid Internet connection is made. This is true when using a standard dial up modem connection that is not always connected to the Internet.

If you are using an “always on” connection such as cable or DSL a “new connection” will never be made.

This setting is provided to force “always on” connections to periodically send the accumulated data.

This setting can also be used to force data to be sent whenever there has been a connection for XX minutes no matter how the initial connection was made.

Use "Assume always online" to disable the connection sensing altogether.

Send Test Email
Install and configure the computer that will be reading the data.

The email attachments must be processed by Investigator and displayed in Investigator’s reporting program, W3iHIST.EXE

First, do a normal installation on to the computer that will be reading the emailed data. (See Installing Investigator )

Enter the registration information.

On the Start tab of W3iSetup.EXE, be sure to remove the checkmark from “Start with Windows” unless you want to monitor yourself. If Investigator is running, end it. Click on OK and exit the setup program. You should not need to run this again.

You will never need to run Investigator’s main data gather program, W3i.EXE. You are ready to receive and display the data sent from the monitored computer.

Processing an incoming email attachment

When email arrives from Investigator it will be a standard email message with an attachment name W3i.SEM. It will look something like this:

From Outlook From HotMail

Open the attachment. You will briefly see a message from Investigator.

The data is now available in Investigator’s Report program, W3iHIST.EXE.

See Also: Renaming EXE's


Setup

Investigator Setup

Use Setup to configure how, when and what Investigator will monitor.

Click on the tabs for detail information on each topic.

Additionally, there are a group of buttons and indicators at the bottom of the Setup window.

Start/Stop W³i Investigator can be started or ended from here.

Uninstall Investigator is Uninstalled using this button. The program will give you several opportunities to cancel this operation. Once completed, Investigator will be completely removed from the registry and the drive.

Note: Uninstall does not appear in Add/Remove Programs.

Help You're there now.

About Version and license information

Save Save any changes and end Setup.

Cancel End and save nothing.


Start

Investigator Setup - Start

Start With Windows

Automatically start Investigator with Windows.

Show Splash Screen

Display splash screen at startup. Displaying the splash screen at startup can be used to notify users that they are being monitored.

The Show Splash Screen setting cannot be disabled unless Investigator is registered .

Monitor Keystrokes

Deselect this option to run Investigator without capturing keystrokes.

Example of keystrokes
Monitor File Activity

Use this option to capture DELETE, COPY, CREATE, or MOVE file operations. To conserve resources, this will not monitor activity in the Windows\Temp directory or any activity involving desktop links (.LNK).

Example of captured file activity

Monitor DOS

Log DOS programs run in the DOS Shell. This option will not record internal DOS commands such as DIR, CHDIR, MKDIR, DEL, etc.

Show in System Tray

Displays Investigator icon in system tray. This can also be used as a visual indicator that the computer is being monitored.

The red ball indicates that Investigator has been paused by the user, is not monitoring the current application due to settings in

EXE Monitor, or is inactive because of Run Times settings.

The green ball indicates that Investigator is active. This ball will occasionally bounce indicating that activity is being recorded.

Enable these menu items

A [image] popup menu displays when the system tray icon is clicked with either the left or right mouse button. You can remove or disable the following menu items.

  • Help

  • Reports

  • Setup

  • End Investigator

  • Pause / Resume

When the system tray display and splash screen are off, Investigator is virtually undetectable.

Investigator will never appear on the task list.

The System Tray setting cannot be disabled unless Investigator is registered.

Password

A single password is available for access to the Setup and Report modules. Enter a case sensitive password and select the modules to password protect.

The password prompt will appear prior to running the program.

Warning: If you apply a password to Setup and forget it, you will not be able to get into Setup! Should this happen, contact us and we will get you in.
Path where data will be stored

This path is where all data collected by Investigator will be stored. This path can be anywhere on the computer or computer network. If the path does not exist, it will be created.

If you are only monitoring this computer or the data will be emailed elsewhere, leave this setting alone.

If you are using Investigator on a network and several workstations will be reporting to a single database, make sure that this path is entered as a UNC. (Universal Naming Convention) Be careful when using mapped drive letters. It is possible that a mapped drive letter will not always be available.

Use the Browse button to locate an existing folder or to create a new folder.


EXE Monitor

Investigator Setup - EXE Monitor

EXE Monitor allows you to record or exclude certain programs.

The EXE monitor lets you discard unwanted programs before they get to the database. This feature can dramatically reduce the amount of data collected. For example, you may not care what is done in Explorer, File Manager, or Program Manager. Or, you may only want to see what was done in Netscape or Internet Explorer.

You can set the EXE Monitor status to:

Disabled

Watches everything (default setting)

Only in list

Only programs listed will be monitored

Not in list

Only programs not in list will be monitored

The programs in the list do not need path names. Only the root name plus extension is required. For example, if you wanted to watch

C:\MSOFFICE\WINWORD\WINWORD.EXE

you would only enter

WINWORD.EXE

You can add programs to the list by

  • Entering the name and pressing enter

  • Browse Computer This will bring up a standard file selection dialog.

  • Browse Database This option will display all programs currently known to Investigator's database.

Delete programs from list

Highlight the program to remove and press the DEL key.


Run Times

Investigator Setup - Run Times

Use Run Times to have Investigator only collect data on certain days of the week and/or times.

The days and times checked are the times when Investigator will collect data. By default, Investigator will record all the time.


Testing the Stealth Email settings

Connect to your ISP

Click on Send Test Email You will see a diagnostic window displaying information on the progress of the test email message and any errors. It will look something like this:

If there were errors, you will be able to save the list as a file. This may be useful in debugging any errors.

If the test was successful, you will have a test message waiting on the recipients email account. This message is only a test and should not be used by Investigator.


Banner

Investigator Setup - Banner

Use the banner feature to provide a supervisory notice whenever Investigator is started.

The text of the default notice is based on CERT Advisory CA-92.19 (http://www.cert.org/advisories/CA-92.19.Keystroke.Logging.Banner.Notice.html)

Default Banner Notice

This system is for the use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel.

In the course of monitoring individuals improperly using this system, or in the course of system maintenance, the activities of authorized users may also be monitored.

Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence of such monitoring to law enforcement officials.


Hot Key

Hot key is the key combination that hides/displays Investigator's icon in the system tray.

Investigator in the System Tray

To set the hot key, choose at least two selections from CTRL, ALT, and or SHIFT. Also select a single letter, number, or F Key.

Do not use any combination that includes combinations such as CTRL + SPACEBAR, CTRL + P, CTRL+C, CTRL+X, CTRL+V, CTRL+Z or any other standard Windows hot key.


Registration

WinWhatWhere Investigator - Registration

How to Register Investigator

To enter your registration name and number, start W3iSetup.exe (options) and click on the Register Tab. Enter the supplied case sensitive name and number in the appropriate fields.

See Getting Started With WinWhatWhere Investigator.

A registration name and number is supplied when Investigator is purchased.


Reports

Viewing & Using The Data Collected By Investigator

Investigator's Report program, W3iHIST.EXE is used to view, export, print, query, delete and manage the collected data.


Queries

Selecting the data

A query retrieves Investigator's data using criteria you specify.

Simplified Data Selection

The simplified data selector allows you to quickly select data based on date and keyboard activity. The displayed spreadsheet will always reflect the query (filter) criteria described here.

Note: These selections are used in addition to any criteria set on the Advanced tab.

Dates

All Dates Every date in the database will be displayed.

Today

Yesterday

This Week

This Month

This Year

Since Last Time - This selection will display data added since the last time Reports was run.

These selections always are based on the current date. For example, if you select "Today" then the data displayed will always be from the current date.

This Week is from the previous Sunday through today.

Using the Calender

The calender control allows you visually select dates from the database. Dates in the database are listed in yellow. Dates selected are shown in blue.


Advanced Data Selection

The advanced data selector is a powerful query generator that will allow you to drill down on the data in a very specific manner. Using this tool, you describe the query criteria using a combination of fields and comparisons. Only records meeting the criteria will be displayed.

Note: These criteria are used in addition to the items selected in the Simplified Data Selection .

Field

Use the pull down box to select a data field. The available fields are described in Data Collected By Investigator.

Is

Use the pull down box to select an evaluation. The available comparisons are:

is equal to

Must match exactly
is not equal to

Must not match
is less than or equal to
is greater than or equal to

Value must be less than or equal to. These fields are useful only with numeric data such as Date, Start, Elapsed, and Keystrokes.
contains
does not contain

Must contain somewhere in data. These fields are useful only with textual data such as Caption, EXE, Workstation, User, Formatted Text, and Raw Text. When using these comparisons it is not necessary to include any "wildcard" characters such as *

Compare

Enter the data to be matched. If the Field is Caption, EXE, Workstation, User, or Date, then right clicking here will display a pull down selection box containing all of the data from the selected field. You may then select an item and edit it.

And/Or

Each row must contain either And / Or.

Clearing Selections

To clear a row, right click on the row and select Clear Row.

To clear all selections, right click on the spreadsheet and select Clear All.


Run Program - Go To URL

If a listed EXE can be located, or the caption appears to reference an Internet location or local document, you can jump to or run the listing by double clicking on it.


Layout

Setup how and what is displayed in the reports

Layout gives you control over what and where the captured data is displayed.

Access the layout functions by selecting Layout from the menu, clicking on the Layout Icon, or by right clicking anywhere on the spreadsheet.

Fields

Arrange the data that will appear in each column. Set the field to be displayed by clicking on the drop down combo box or by right clicking on the column.

Set the column to "Nothing" to disable.

Columns can be rearranged by dragging and dropping.

See also Data Collected By Investigator

Font, Color

Select Font and Color to change these settings using standard Windows Dialogs.

Gridlines

Set the horizontal and vertical gridlines in the spreadsheet.

Headers

Turn the Row and Column headers Off/On.


 Automatic Summaries

Automatic Summaries are an easy, powerful way to group and summarize the displayed information.

For example, if the following columns were listed in the displayed data:

Clicking on Auto Summary returns:


Refresh

Updating the database

Investigator's database is current as of the time that you started Reports. If further activity has occurred since starting Reports, use Refresh to make the database current.

The database is automatically kept current by Reports and Investigator. You may manually update the database at any time by running W3IUPD.EXE located in the main program directory.


Printing Reports

Clicking on the print icon or the menu, File Print will immediately print the displayed data to the current printer. During printing, a window is displayed allowing you to cancel the print operation.


Print Preview

Displays each page as it will look when printed.

How your pages appear in the preview window will vary depending on the available fonts, the resolution of the printer, and what colors are available.


Database Utilities

These utilities are not used in normal day to day operation. Generally, these will be used only in case of emergency.

Remote Data Paths

Specify data paths to check for temporary Investigator data files when starting W3iHist. This will cause W3iHist to look through multiple locations for the temporary datafiles to be placed in the database. Normally, each workstation, points Its datapath to a single location. This option allows the inverse.

Repair Database

This may be able to recover missing data in the database.

Compact Database

Normally performed automatically during deletes.

Use Different Database

This will allow you to temporarily use a different database such as an archive or back up. The default database will be reset when W3iHIST.EXE restarts.

Database Miscellaneous

The Database is in a file named ZW84.DAT

If the database is moved or deleted, it will be recreated.

It is an Access 97 database. It can be opened and reports, queries, etc. can be added as long as the underlying structure of the tables is not altered.


Deleting Data

Delete allows you to delete Investigator data based on age or the currently displayed data.

Delete records older than XX days.

Use the slider control or enter the age in number of days to delete. Click on Delete Now to immediately remove those records.

Always Delete data older than XX days

Select this option to have Investigator automatically keep records older than XX days deleted.

Delete displayed data (XXX records)

Clicking on this button will immediately delete the data displayed. The button will always list the number of records that will be deleted.


Export

Sending data to other applications

Export can save the currently displayed data as:

  • CSV comma separated value file

  • XLS Excel 7 worksheet

  • HTM HTML document.


Deploy Utility

W3ideploy preconfigures Investigator and creates a setup program that can be placed on diskettes or into a single EXE file.

Investigator is automatically installed and started when the generated diskettes or EXE is run on the target computer.

Select Installation Type

Deploy can create an installation for diskettes or a single EXE. The diskette installation will prompt you for the next diskette and the installation will be visible. The EXE installation can be made visible with standard SETUP installation messages, or it can be made completely invisible. When invisible, the program will appear to do nothing. When the invisible EXE installation is complete, it will automatically restart Windows. This uses a standard Windows shutdown routine and nothing will be lost. When Windows restarts, Investigator will be running.

Run Setup

Clicking on Setup will take you to a modified version of the standard Investigator Setup program. By default, this will contain information pertaining to the current setup on this computer. Make any necessary changes and save. Changes made here will not affect the local machine's configuration.

Create Installation


Data Collected By Investigator

Workstation

Computer name
User

Login name
Date

Date of entry
Start

Start Time
Elapsed

Time window was active
Keystrokes

Number of keystrokes recorded
Caption

Caption of the current control. This can be the window title, button caption, etc. The is can also include information from text fields such as passwords, instant messaging, and incoming email.
EXE

Full name of program
Formatted Text

Captured keystrokes with editing processed. This column will closely resemble the final output.
Raw Text

Captured keystrokes as it was recorded. Includes all function keys, arrow keys, etc.

Raw vs Formatted Example

Raw Text | Formatted Text
<LEFT><LEFT><LEFT> <LEFT><DELETE><DELETE> <DELETE><DELETE> <DELETE><RIGHT><RIGHT> <RIGHT><LEFT><LEFT> <RIGHT><END>, control, and other special keys are translated into ket<BACK>y descriptions. F<SHIFT>or example:<SHIFT> <UP><RIGHT><RIGHT><RIGHT> | control, and other special keys are translated into key descriptions. For example:


Renaming EXE's

Any of the following EXE's may be renamed from Windows. After renaming the EXE, run it. This is required so that it may register its new name with the other components of Investigator.

Location | Original Name |
Installed directory | W3i.EXE | The monitor
Installed directory | W3iSETUP.EXE | Options
Installed directory | W3iHIST.EXE | Reports
Installed directory | W3iUPD.EXE | Database updater
Installed directory | SEM.EXE | Stealth Emailer
<WINDOWS\SYSTEM> | AA81232.EXE | Investigator Loader


Contact Information

WinWhatWhere Corporation
925 W Kennewick Ave
Kennewick WA 99336

Phone: 509 585 9293
Fax: 509 585 9294

w3@winwhatwhere.com

winwhatwhere.com


License Agreement

© 1993-2000 WinWhatWhere Corporation - All Rights Reserved

LICENSE AGREEMENT

IMPORTANT-READ CAREFULLY: This WinWhatWhere Investigator End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and WinWhatWhere Corporation for the SOFTWARE identified above, which includes the User's Guide, any associated SOFTWARE components, any media, any printed materials other than the User's Guide, and any "on-line" or electronic documentation ("SOFTWARE"). By installing, copying, or otherwise using the SOFTWARE, you agree to be bound by the terms of this EULA. If you do not agree to the terms of this EULA, do not install or use the SOFTWARE. If the SOFTWARE was mailed to you, return the media along with the rest of the package to the location where you obtained it within 30 days from purchase.

1. The SOFTWARE is licensed, not sold.

2. GRANT OF LICENSE.

(A) Registered Copy. To register your copy, you should visit winwhatwhere.com and follow the instructions. After you have purchased the license for SOFTWARE, and have received the information enabling the registered copy, you are licensed to copy the SOFTWARE only into the memory of the number of computers corresponding to the number of licenses purchased. The primary user of the computer on which each licensed copy of the SOFTWARE is installed may make a second copy for his or her exclusive use on a another computer solely for the purpose of viewing data collected by the SOFTWARE. Under no other circumstances may the SOFTWARE be operated at the same time on more than the number of computers for which you have paid a separate license fee. You may not duplicate the SOFTWARE in whole or in part, except that you may make one copy of the SOFTWARE for backup or archival purposes. You may terminate this license at any time by destroying the original and all copies of the SOFTWARE in whatever form. You may permanently transfer all of your rights under this EULA provided you transfer all copies of the SOFTWARE (including copies of all prior versions if the SOFTWARE is an upgrade) and retain none, and the recipient agrees to the terms of this EULA.

(B)Evaluation Copy. You may use the SOFTWARE without charge on an evaluation basis for fourteen (14) days from the day that you install the SOFTWARE. You must pay the license fee and register your copy to continue to use the SOFTWARE after the fourteen (14) days. If you continue to use the SOFTWARE after the fourteen (14) days without paying the license fee you will be using the SOFTWARE on an unlicensed basis.

IMPORTANT. Purchasing and registering the SOFTWARE enables the portion of the SOFTWARE that allows the SOFTWARE to be run invisibly.

(C)Redistribution of Evaluation Copy. If you are using SOFTWARE on an evaluation basis you may make copies of the evaluation SOFTWARE as you wish; give exact copies of the original evaluation SOFTWARE to anyone; and distribute the evaluation SOFTWARE in its unmodified form via electronic means (Internet, BBS's, Shareware distribution libraries, CD-ROMs, etc.). You may not charge any fee for the copy or use of the evaluation SOFTWARE itself, but you may charge a distribution fee that is reasonably related to any cost you incur distributing the evaluation SOFTWARE (e.g. packaging). You must not represent in any way that you are selling the SOFTWARE itself. Your distribution of the evaluation SOFTWARE will not entitle you to any compensation from WinWhatWhere. You must distribute a copy of this EULA with any copy of the SOFTWARE and anyone to whom you distribute the SOFTWARE is subject to this EULA.

3. RESTRICTIONS. You may not reverse engineer, de-compile, or disassemble the SOFTWARE, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation. You may not rent, lease, or lend the SOFTWARE. You may permanently transfer all of your rights under this EULA, provided the recipient agrees to the terms of this EULA. You may not use the SOFTWARE to perform any unauthorized transfer of information or for any illegal purpose.

4. SUPPORT SERVICES. WinWhatWhere may provide you with support services related to the SOFTWARE. Use of Support Services is governed by the WinWhatWhere polices and programs described in the user manual, in on-line documentation, and/or other WinWhatWhere-provided materials, as they may be modified from time to time. Any supplemental SOFTWARE code provided to you as part of the Support Services shall be considered part of the SOFTWARE and subject to the terms and conditions of this EULA. With respect to technical information you provide to WinWhatWhere as part of the Support Services, WinWhatWhere may use such information for its business purposes, including for product support and development. WinWhatWhere will not utilize such technical information in a form that personally identifies you.

5. TERMINATION. Without prejudice to any other rights, WinWhatWhere may terminate this EULA if you fail to comply with the terms and conditions of this EULA. In such event, you must destroy all copies of the SOFTWARE.

6. COPYRIGHT. The SOFTWARE is protected by United States copyright law and international treaty provisions. You acknowledge that no title to the intellectual property in the SOFTWARE is transferred to you. You further acknowledge that title and full ownership rights to the SOFTWARE will remain the exclusive property of WinWhatWhere and you will not acquire any rights to the SOFTWARE except as expressly set forth in this license. You agree that any copies of the SOFTWARE will contain the same proprietary notices which appear on and in the SOFTWARE.

7. EXPORT RESTRICTIONS. You agree that you will not export or re-export the SOFTWARE to any country, person, entity, or end user subject to USA. export restrictions. Restricted countries currently include, but are not necessarily limited to Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria. You warrant and represent that neither the USA Bureau of Export Administration nor any other federal agency has suspended, revoked or denied your export privileges.

8. NO WARRANTIES. WinWhatWhere expressly disclaims any warranty for the SOFTWARE. THE SOFTWARE AND ANY RELATED DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OR MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.

9. LIMITATION OF LIABILITY. IN NO EVENT SHALL WINWHATWHERE OR ITS SUPPLIERS BE LIABLE TO YOU FOR ANY CONSEQUENTIAL, SPECIAL, INCIDENTAL, OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE DELIVERY, PERFORMANCE, OR USE OF THE SUCH DAMAGES. IN ANY EVENT, WINWHATWHERE'S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT, OR ANY OTHER THEORY OF LIABILITY WILL NOT EXCEED THE GREATER OF U.S. $1.00 OR LICENSE FEE PAID BY YOU.

10. U.S. GOVERNMENT RESTRICTED RIGHTS. The SOFTWARE is provided with RESTRICTED RIGHTS. Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of The Rights in Technical Data and Computer SOFTWARE clause of DFARS 252.227-7013 or subparagraphs (c)(i) and (2) of the Commercial Computer SOFTWARE- Restricted Rights at 48 CFR 52.227-19, as applicable. Manufacturer is: WinWhatWhere Corporation, 925 West Kennewick Avenue, Kennewick, WA 99336 USA.

11. MISCELLANEOUS. If you acquired the SOFTWARE in the United States, this EULA is governed by the laws of the state of Washington. If you acquired the SOFTWARE outside of the United States, then local laws may apply.

Should you have any questions concerning this EULA, or if you desire to contact WinWhatWhere for any reason, please contact WinWhatWhere by mail at: 925 West Kennewick Avenue, Kennewick, WA 99336, or by telephone at: 509 585 9293, or by electronic mail at: w3@winwhatwhere.com.

This software is intended primarily for use as an aid in monitoring computer use. Any use of this software in conjunction with any hardware, device or apparatus to surreptitiously intercept wire, oral, or electronic communications may violate state and federal laws, so there.

WinWhatWhere Corp has exclusively licensed Daniel Daly, 281 Seaver Avenue, Staten Island, NY, for use of Investigator within the Field of Use of Computer Monitoring Services for a Fee.


Purchasing Investigator

All orders for Investigator will be shipped on CD by postal mail (airmail outside North America) within two business days after they are received; there is no additional charge for the postage. We will also ship via FedX for an additional fee.

On-line Delivery

On-line delivery of the registration code for Investigator is available for credit card orders placed via the Internet using the Purchase link at the WinWhatWhere site

http://www.winwhatwhere.com/buy.htm

You can also place orders using the Internet order forms or the order form below.

Ordering by Check

To order by check, send a completed order form available at: www.winwhatwhere.com/orderfrm.htm and a check payable to WinWhatWhere to:

WinWhatWhere Corporation
925 W Kennewick Ave
Kennewick WA 99336
USA

Payments must be in US dollars drawn on a US bank, or you can send international postal money orders in US dollars.

Credit Card Orders

You can place secure credit card orders via the Internet using the Purchase link at the WinWhatWhere site:

http://www.winwhatwhere.com/buy.htm

You can also place credit card orders by calling WinWhatWhere at

1 888 239 5396

or

509 585 9293 outside the US.

Any questions about the status of the shipment of an order, refunds, registration options, product details, technical support, volume discounts, dealer pricing, site licenses, etc., should be directed to WinWhatWhere. You can send email to w3@winwhatwhere.com; our goal is to respond to all email inquiries within one business day.

Purchase Orders

Purchase orders (net 30 days) are accepted from government and accredited educational institutions and major corporations, provided that they are submitted on purchase order forms with a purchase order number.


Installation

To install from CD

  1. Turn on your computer and start Microsoft Windows 95/98, NT4 or Windows 2000.

  2. Place the WinWhatWhere Investigator™ CD in your CD-ROM drive. Installation begins automatically.

  3. Follow the on-screen instructions.

If your CD-ROM drive does not support automatic installation, follow the steps below:

  1. Place the WinWhatWhere Investigator™ CD in your CD-ROM drive.

  2. Double-click on “My Computer” located on the Desktop. Double-click on the CD-ROM drive icon. Double-click on the “Setup.exe” icon.

  3. Follow the on-screen instructions.

To install from download

  1. Download the program.

  2. If you downloaded an EXE (W3i2.EXE) then double-click the executable to run the install.

  3. If you downloaded a ZIP file, unzip the file to a temporary directory and double click on SETUP.EXE to install.

  4. Follow the on-screen directions.

Uninstalling

The uninstall function removes all files associated with WinWhatWhere Investigator™ from your PC.

  1. Run W3iSETUP.EXE If you do not know where this program is located, click on Start - Find - Files or Folders and enter W3iSETUP.EXE

  2. Click on the button labeled "Uninstall".

  3. Follow the on-screen instructions.


 Deploy Utility

W3ideploy preconfigures Investigator and creates a setup program that can be placed on 2 diskettes or into one EXE file. When the generated SETUP is run the end user sees a standard installation screen, but no user input is allowed or required.


 Email Account Info

This information is about the email account that will receive the data from Investigator. You do not need any information from the monitored computer's email account.

You can generally find this information in your email program. For example, in Microsoft Outlook, click on Tools Services and select Internet EMail Properties.

All fields must entered.

To Email address that will receive the data.

Mail Server SMTP Server name.

Account Name Log on account name for mail server.

Password Password for above account.


 Find

Find What

Enter the text you wish to find. If Match Any is selected, then pattern matching can be used.

Match

Exact The contents of the field must match exactly including upper/lower case.

Any Matches any occurrence within the field.

Column

Select which column to search


Frequently asked questions about Stealth Email

What kind of email account can receive the data?

Any SMTP email account can be used to receive the data. The vast majority of ISP's do provide you with an SMTP Email account. AOL and other proprietary systems are not SMTP accounts. Most free web based email accounts are also not SMTP. You should check with your email provider for the specific information required to use SMTP email.

To set up Investigator's Email you will need to know your Email Account, SMTP Server Name, Account Name, and Password.

You can generally find this information in your email program. For example, in Microsoft Outlook, click on Tools Services and select Internet EMail Properties.

What kind of internet connection is needed to send the email?

Investigator can send email from any valid internet connection. This can be virtually any ISP, AOL, CompuServe, or other service.

What happens if the email does not get sent?

No error message will appear on the monitored computer. If the error is with the SMTP server or a connection is lost while sending the data, investigator will retain the message and send it at a later time.


Installing Investigator on the computer to be monitored

Do a normal installation .

After installation, start W3iSetup.EXE (Options) and set the data path to the same location as the computer that will be sending the data.

If the monitored computer is not connected to the same network as the monitoring computer, the Stealth Email feature may be used to automatically email the data to the monitoring computer.

Installation to a monitored computer can also be accomplished by running the

Stealth Deploy Utility.

Be sure to set options such as Start with windows, splash screen, and system tray.


Installing Investigator on the computer that will receive the data.

Do a normal installation. On the computer receiving the data you will probably not want to have Investigator running. You should not start Investigator's main module, W3I.EXE and Start with Windows should be disabled in Setup.

After installation, start W3iSetup.EXE (Options) and set the data path to the same location as the computer that will be sending the data.


Investigator

 WinWhatWhere

Investigator

What does Investigator do?

Setup

Configure How Investigator Will Run

Reports

Viewing & Using The Data Collected By Investigator

Contact Information

Purchasing Investigator

License Agreement

Deploy Utility


 Sample Received Email


 Spreadsheet Appearance

Font activates the Font dialog box. This standard dialog box lets you specify which font is used in the spreadsheet display.

Color Select foreground or background. This activates the Color dialog box. This standard dialog box lets you specify which colors are used in the spreadsheet display.

Gridlines Select horizontal and vertical gridline display.

Headers Select Row and Column header display.


 Stealth

Investigator's stealth features allow you to further hide Investigator and to send the captured data via email.

Using Stealth Emailer

Remove from Start Menu Remove Investigator from the start menu. By default, Investigator displays on Start Programs Investigator

Delete Setup & Reporting Remove W3iSetup.EXE and W3iHist.EXE from this computer. This may be desirable if further configuration is not needed and the reporting will be done from another computer. Password protecting Setup and Reporting can also keep unauthorized users from the programs without deleting them.

Use Automatic Database Updating By default, Investigator updates the database in the background when the computer is not busy. This is not desirable when the data is to be emailed or when manual updating is otherwise needed.

EXE name of W3i The main program, W3i.EXE can be renamed to any valid EXE name. This can be useful to make Investigator less obvious.


WinWhatWhere Investigator Order Form/Invoice

WinWhatWhere Order Form WinWhatWhere Corporation

925 West Kennewick Ave.

Kennewick, WA 99336

509 585 9293 fax 585 9294

email w3@winwhatwhere.com

Copies Product Price Total

WinWhatWhere Investigator - Single User $99.00

WinWhatWhere Investigator - 10 Users $495.00

--------------------------------------------------------------------------------

WinWhatWhere Professional -Single User $99.00

WinWhatWhere Professional -10 Users $495.00

Total:

--------------------------------------------------------------------------------

Payment must be in US dollars drawn on a US bank.

--------------------------------------------------------------------------------

Send To:

Name: _____________________________________________

Company: _____________________________________________

Address: _____________________________________________

_____________________________________________

City, State, Zip _____________________________________________

Phone: ______________________

Fax: ______________________

Email: ______________________

Comments?