Spector Pro 2009 Online Guide

Spector Pro 2009

Online Guide

Version 7.0

January 29, 2009

Table of Contents

Table of Contents ...... ii Introduction ...... 1 Opening the Viewer ...... 2 Closing the Viewer...... 3 What Spector Pro Records ...... 4 How It Works...... 6 What's New ...... 7 Monitoring Activity ...... 8 Using the Viewer ...... 8 Viewing Activity...... 8 Remote Viewing Across a Network ...... 11 Refreshing Data ...... 13 Searching for a Keyword ...... 15 Search In Options...... 18 Menu Options...... 19 Toolbar Shortcuts ...... 24 Snapshot Context ...... 26 View Options...... 27 Keyboard Shortcuts ...... 29 Security Considerations...... 31 Clearing SpectorSoft References...... 32 All Recordings ...... 34 Views of All Recordings ...... 34 Viewing Chat / IM Activity ...... 35 Chat/IM Supported ...... 39 Viewing Online Searches ...... 41 Viewing Web Sites Visited...... 44 Viewing Email Activity ...... 48 Email Supported...... 53 Webmail Supported ...... 54 Viewing Files Transferred...... 57 Viewing Keystrokes Typed ...... 60 Viewing Program Activity...... 65 Viewing User Activity ...... 68 Viewing Document Tracking...... 73 Viewing Keywords Detected ...... 76 Viewing Network Activity ...... 79 Screen Snapshots ...... 83 Viewing Snapshots ...... 83 Marking Snapshots ...... 87 Finding and Filtering Snapshots...... 88 Taking Snapshots Manually...... 89 Saving Snapshots...... 90 Deleting Snapshots...... 94 Top 10 ...... 96 Top 10 Reports ...... 96 Top 10 Chat / IM Activity...... 97 Top 10 Online Searches...... 99

Top 10 Web Sites Visited ...... 100 Top 10 Email Activity ...... 102 Top 10 Program Activity ...... 104 Top 10 Keywords Detected ...... 105 MySpace...... 107 MySpace Activity ...... 107 Viewing MySpace Snapshots ...... 107 Viewing the MySpace Report...... 108 Report - MySpace Accounts ...... 109 Report - Top 10 Messages Received...... 110 Report - Top 10 Messages Sent ...... 111 Report - Top 10 Profiles Visited ...... 111 Report - MySpace Summary ...... 112 Viewing MySpace Messages ...... 112 MySpace Chat/IM ...... 114 Facebook ...... 116 Facebook Activity ...... 116 Viewing Facebook Snapshots ...... 116 Viewing the Facebook Report ...... 117 Report - Facebook Accounts...... 118 Facebook Top 10 Messages Received ...... 119 Facebook Top 10 Messages Sent ...... 119 Facebook Top 10 Profiles ...... 120 Facebook Summary ...... 120 Viewing Facebook Messages ...... 121 Viewing Facebook Chat/IM...... 122 Reporting and Managing Data ...... 124 Filtering Data By User or Program ...... 124 Arranging Columns and Sorting Data ...... 125 Grouping Recorded Events...... 127 Deleting Recorded Events ...... 129 Copying Data ...... 131 Saving and Exporting Data ...... 131 Printing ...... 133 Show Data Files ...... 134 Backing up and Restoring Data Files ...... 136 Deleting Data Files ...... 137 Changing Settings ...... 139 Changing Settings ...... 139 Restoring Default Settings ...... 140 User Profiles...... 142 About User Profiles ...... 142 Add a New User Profile...... 143 Delete a User Profile ...... 144 Changing the Recording Profile ...... 145 Screen Snapshot Settings...... 145 Chat/IM Activity Settings...... 146 Web Sites Visited Settings ...... 147 Email Activity Settings ...... 149 Email Activity Filtering ...... 150 Creating an Email Filtering Rule...... 153 Files Transferred Settings ...... 155 Keystrokes Typed Settings...... 156

Program Activity Settings ...... 158 User Activity Settings...... 159 Network Activity Settings ...... 160 Document Tracking Settings ...... 163 Changing Default Tracking...... 169 When to Record ...... 171 When to Record ...... 171 Changing the Alert Profile ...... 173 Defining a Keyword Watch List ...... 173 Importing Keywords ...... 176 Exporting Keywords ...... 177 Setting up Alert Notification ...... 178 Advanced Alert Notification Settings ...... 180 Keyword Tips ...... 183 Changing the Block Profile ...... 185 Blocking Access...... 185 Blocking Web Sites ...... 188 Importing Web Sites to Block...... 192 Exporting Web Sites to Block ...... 193 Blocking Chat / IM ...... 194 Blocking Internet Access ...... 198 When to Block - Setting Up a Schedule ...... 202 Changing System Settings ...... 204 About System Settings...... 204 Security Settings ...... 205 Data File Settings ...... 207 Application Settings ...... 211 Snapshot System Settings ...... 215 Snapshots - When and How Often ...... 217 Chat/IM System Settings...... 220 Web Sites Visited System Settings...... 222 Files Transferred System Settings...... 223 Email System Settings ...... 224 Keystroke System Settings ...... 227 Program System Settings ...... 228 Advanced Security...... 229 Advanced Application Options ...... 231 Network Activity System Settings ...... 233 Installing, Sharing, Updating...... 235 Installation ...... 235 Options for Installation...... 235 Performing a Standard Installation ...... 237 Performing a Viewer Only Installation ...... 241 Uninstalling Spector Pro ...... 244 Sharing for Remote Viewing ...... 245 Preparing Computers for Remote Viewing ...... 245 Sharing for Remote Viewing...... 246 Opening "Favorites" ...... 248 Data File Sharing with Windows XP Home...... 251 Disabling Simple File Sharing ...... 255 Updates...... 257 Checking for Updates ...... 257

Adding Licenses ...... 259 Troubleshooting ...... 260 Introduction to Troubleshooting...... 260 Technical Support Diagnostics...... 262 Trouble with Screen Snapshots ...... 264 Trouble with Chat / IM ...... 265 Trouble with Web Sites ...... 266 Trouble with Email...... 267 Trouble with Keystrokes ...... 269 SpectorSoft Information...... 270 Contact Us...... 270 Company Profile ...... 271 Copyrights and Trademarks ...... 272 Glossary ...... 274

Index...... 278

Introduction

Spector Professional Edition (Spector Pro) is a premier surveillance tool that allows you to track everything happening on the computers in your home or office. As soon as you install it, Spector Pro begins recording activity - but it's so stealthy no one knows it is there. Return to the recorded computer to view the activity, or monitor the activity from another computer on your network. Powerful recording capabilities combined with easy-to-use viewing makes Spector Pro ideal for parents and small business owners.

Learning About Spector Pro Choose a topic to answer your questions:

What Spector Pro records

Opening the Spector Pro Viewer

Viewing activity

Remote viewing across a network

Blocking Internet access

Detecting Keywords

Installing and Configuring Spector Pro

Install Spector Pro on a computer you want to record

Install a Spector Pro Viewer to monitor other computers

More Help

What's New in This Version

Updating Spector Pro

Troubleshooting

Contacting SpectorSoft

Opening the Viewer

The Spector Pro Viewer allows you to view activity at the recorded computer, or from a remote computer where a Viewer has been installed.

To open the Spector Pro Viewer at the recorded computer:

1. Press the hotkey sequence you chose during installation. The default sequence is Ctrl + Alt + Shift + S. Hold each key down as you type the next.

2. If you defined a password to open Spector Pro during installation, enter the password at the prompt. Click OK to open the Spector Pro Viewer. Click Cancel to exit.

Spector Pro stops recording when you open the Viewer.

To open a "visible" Viewer at the recorded computer:

If you installed Spector Pro so that it is visible on the recorded computer, simply click the red square on the Windows task bar at the bottom of the screen. If you defined a password during installation, enter the password.

To open a remote Viewer (Viewer-Only installation):

If you have installed only a Viewer and wish to view recorded computers on your network, make sure you follow the instructions in Remote Viewing Across a Network. Select Windows Start > All Programs > Spector Pro Viewer. The Viewer opens, along with the Browse for Folder window. If a Browse for Folder window doesn't open, select Open > Data Files from the menu bar. Unless there is data on the local computer, you need to navigate to a remote computer and select its Spector Pro Data Files folder to load data.

Spector Pro does NOT stop recording while you review activity from a remote Viewer. To see the latest activity - minutes or seconds after it has occurred - refresh the data.

Closing the Viewer

When you close Spector Pro, you are asked to continue recording and clear references to the SpectorSoft web site from browser history.

To close Spector Pro:

Select File > Exit from the menu bar or click the close box (x) in the upper right corner of the window. Resume Recording - A message asks if you wish to resume recording. Click Yes to record or No to close without re-enabling recording. You will not have the option to disable recording from a remote Viewer. Clear References - If you have visited the SpectorSoft web site and have left Internet Explorer open, a message asks if you wish to clear references to SpectorSoft to maintain stealth. Click Yes to clear references (Internet Explorer will be closed) or No to leave the browser open and references in place. See Clearing SpectorSoft References.

NOTE: This message will not appear for browsers other than IE, but you can manually remove references to SpectorSoft.

What Spector Pro Records

Spector Pro records the following types of activity and stores the recordings in hidden files. Spector Pro provides a "view" of each recorded activity and summary Top 10 views of selected activity types. When any activity is recorded at MySpace or Facebook, Spector Pro gathers these recordings in an organized MySpace or Facebook view. In the list below, click the icon at left to see what activity recording looks like.

Screen Snapshots Spector Pro takes a "picture" of the computer screen every 20 seconds, on a page or window change, when a new program is opened, or when other "triggers" occur. It's like having a surveillance camera at the computer; you know exactly what was on screen.

Chat/IM Activity Spector Pro records every word in chat and instant messaging conversations and highlights the top chat contacts. Find out who is talking to whom and what they are saying in AOL Instant Messenger, MSN Messenger, Yahoo Messenger, ICQ, Google Talk, Myspace, Facebook, Skype, or elsewhere. If you don't like an outside contact, block that communication.

Online Searches Spector Pro records what people are searching for on sites such as Google or Yahoo, or any other site using a standard search engine. View a complete log of search activity, or get a quick picture of the top searches entered. Find out who is "googling" what, and whether or not they actually follow a link to a web page.

Web Sites Visited Spector Pro records each web page visited, the time and duration of the visit, and provides a link to the site. If you don't like what you see, immediately block future access to a site. View Top 10 web sites by length of visit, frequency of visit, or attempts to visit blocked sites.

Email Activity Spector Pro records incoming and outgoing mail from popular email programs and webmail sites, such as Hotmail, Yahoo, or AOL. Review date and times, subjects, recipients, and read every word of every communication. View a complete email log, or instantly see the Top 10 email recipients or senders.

Files Transferred

Spector Pro tracks all uploads and downloads that occur via web site, FTP, or Peer-to- Peer (P2P) communication. Watch for downloads of pirated software, illegal music, pornographic pictures, large video files that take up valuable network bandwidth, online gambling software, and more. Whatever you don't like, you can block.

Keystrokes Typed Spector Pro records every keystroke typed on the keyboard. Use this complete log of keys typed or pressed to see what (and how much) has been entered in any application or on the web. You will be able to view non-displayed characters, such as Shift and Control, and passwords normally hidden by asterisks (***).

Program Activity Spector Pro lists every program executed on the monitored computer, telling you how much activity occurred in the program. You'll be able to see if someone opens an application and leaves it up unused, or works actively in it all day. Spector Pro can record all programs or just the ones you want to record, and provides a Top 10 view of the most used or most active programs.

User Activity Spector Pro records all log in and log out activity, as well as periods of activity and inactivity. Use this convenient "time card" to see who take long breaks and who is working hard.

Document Tracking Spector Pro records document printing and all activity at removable drives, and you can direct it to record much more. Tell it to track read, write, and delete activity on the local drive, network drives, or other storage devices. Track all or specific documents. Find out if CDs were burned or files were copied to a zip drive.

Keywords Detected As soon as you give it words to watch for, Spector Pro will detect those words in Chat/IM, email, keystrokes, web sites, or other locations as you direct it. You can view the complete log of keywords detected or the Top 10 detected keywords. In addition, Spector Pro can send email notification on keyword detection, allowing you to quickly intervene in sensitive situations.

Network Activity One look at captured network information tells you where and how much Internet communication and data transfer is occurring. Track use of streaming audio / video and online gaming programs, find out if applications are making unnecessary Internet transactions, and determine possible security violations.

How It Works

Spector Pro uses two components: a Recorder and a Viewer.

Spector Pro Recorder When you install Spector Pro on the computer you wish to monitor (STANDARD installation), you install an invisible, undetectable software recorder. The Recorder starts working immediately after the computer restarts, and silently captures and records all activity.

Screen Snapshots show exactly what was on screen

There is no evidence that the Recorder is running on the computer. The Recorder stores its data in hidden files. You can adjust recording by changing Settings. The Recorder STOPS recording when you open the Spector Pro Viewer and prompts you to start recording again when you close the Viewer.

See What Spector Pro Records.

Spector Pro Viewer Included with the hidden Spector Pro Recorder is a Viewer you use to monitor activity. You can also install the Viewer ONLY on another computer on your network and view recorded activity remotely.

Access the Viewer using a secret hotkey sequence and password. The Viewer opens the hidden data files and under tabs at the top of the window displays All Recordings - 12 views of activity

Top 10 summaries and MySpace activities, if available Facebook activities, if available Screen Snapshots Web Sites Visited Keystrokes Typed The Viewer allows you to view all activity, search for keywords, investigate incidents by jumping to Screen Snapshots or Keystrokes, copy or save data for use elsewhere, and change recording preferences.

If you need to record more than one computer, simply purchase a license for each computer. You can monitor any computer on your network from a single Viewer. Contact SpectorSoft Sales about a license to monitor a Macintosh (OS 10.4 or higher) from your Windows computer.

What's New

Previous users can look for the following improvements in Spector Pro 2009: User Profiles allow you to monitor multiple users on one computer with different Record, Block and Alert settings for each, if you wish. System Settings organize computer-wide recording separately from user recording profiles. Remote Viewing of Data - You can now view Macintosh data remotely when used in conjunction with Spector Pro | Mac 2009. Improved Settings Interface - Enhanced and simplified interface makes it easier to use.

Monitoring Activity

Using the Viewer

Viewing Activity

The Spector Pro Viewer allows you to monitor activity that has been recorded on a computer - keystrokes, email, instant messaging, web sites visited, and more. Recorded data is organized behind tabs, each providing a different view of the information. It allows you to adjust and focus the display of data, change the recording settings, and get Help.

To load the latest activity or activity for a date range into the Viewer, press F5 (Data > Refresh).

Menu Bar Menus at the top of the window allow you to navigate through, save, select, copy, print, delete, filter, and search for information. The menu bar also allows you to interface with SpectorSoft resources, including our extensive Knowledge Base and Technical Support options. Click the appropriate menu and submenu combination to perform the desired task. See Menu Options.

Feature Tabs

All Recordings - Select to view Screen Snapshots and complete logs of "events" for each type of recorded activity.

Top 10 - Select to view summary reports, such as Top 10 Web Sites Visited, that help you identify trends in activity.

MySpace Activity - If activity has been detected on MySpace, select to view Screen Snapshots and all other events that occurred at MySpace.com.

Facebook Activity - If activity has been detected on Facebook, select to view Screen Snapshots and all other events that occurred at Facebook.com.

Toolbar

For each event window you access, the lower portion of the toolbar is automatically customized to provide relevant shortcut functions that help you manage the information displayed. Use the shortcuts to playback, select, search for, delete, and jump to recorded information.

Profiles, Settings, and Help

Other toolbar buttons include:

Profiles - Click to set up User Profiles, and adjust the Record, Alert, and Block settings for profiles. Spector Pro records everyone and everything by default, but Profiles allow you to control who and what is recorded, blocked or detected for alerts.

Settings - Click the Settings button at the top right to access the Settings window

Help - Click to access instructions for the current view of data. Use the Help menu at the top of the window for additional updating and diagnostic tools.

Spector Pro Views Each view of activity is designed to display recorded events in the most user friendly and flexible way, depending on the type of information it contains. Screen Snapshots provide a slide show of was on the computer screen. For some views, selecting from a list of events in an upper Event pane allows you to view the Content (such as a conversation from an instant messaging session) of the event in the lower pane. The following views use an Events upper pane and a Content lower pane:

Chat/IM Activity Email Activity Keystrokes Typed

Event Pane (upper pane) – Contents are displayed in the lower pane

For other views of data, an upper Navigate pane allows you to navigate through a tree of dates, domains, or other relevant data groupings and make a selection to view a Summary and Details about activity in the lower pane. The following use a Navigate - Summary/Details view.

Online Searches Web Sites Visited Files Transferred (does not include a Summary) Program Activity User Activity (the Summary includes a graph) Document Tracking (does not include a Summary) Keywords Detected Network Activity

Navigate Pane (upper pane) – Summary and Details are displayed in the lower pane

Status Bar

At the bottom of the Viewer window, the status bar shows relevant information about the recorded events currently displayed or selected. When various items are selected the status bar shows any of the following information fields: Total: Total number of events recorded for the current selection. User name: The name of the user logged in, if more than one user logs in to this computer. Program: The name of program where an event was recorded. Date and Time: Day of week, month and day, year and HH:MM:SS AM/PM (depending on your system clock format).

Remote Viewing Across a Network

With two or more computers in a local network, it is possible to review activity recorded by Spector Pro from a separate "Viewer" computer. The computers you monitor can be either Windows or Macintosh (OS 10.4 and higher). A "network" can be any computers connected by cable or wireless that share a common printer or Internet access. If you don't have a workgroup or domain network set up, see Preparing Computers for Remote Viewing.

A SpectorSoft license is required for each recorded computer. Your serial number must be enabled for the number of computers being recorded. It's easy to add licenses to your serial number. Contact SpectorSoft Sales for information about purchasing licenses for Macintosh computers.

To set up Spector Pro for remote Viewing:

1. Install Spector Pro (Standard) on computers you wish to monitor. You must be the owner of and purchase a SpectorSoft license for each computer receiving a Standard installation. 2. Share the Spector Pro Data Files folder. On the recorded computer, share the folder where Spector Pro stores its data using the settings to set up sharing. You will be given a hidden share name for the computer. You may need to take steps to prepare computers for sharing. 3. Install the Viewer Only on your computer. Use either the Standard or Viewer Only installation, but note that a Viewer Only installation does NOT require an additional license. So, if you have a license to record ONE computer, install Standard Spector Pro on the computer you wish to monitor and install the Viewer Only on the computer where you will review activity.

4. Make sure all computers are visible on the network. If you don't have a domain network, use a Windows Workgroup. Macintosh computers can be added to the Workgroup. See Preparing Computers for Remote Viewing.

To view data from a remote computer:

At the Windows computer where you wish to view data: 1. Open the Spector Pro Viewer. For Viewer Only installation, use Windows Start > All Programs > Spector Viewer. Otherwise, use the hotkey sequence and your password to open Spector Pro. 2. Open files from the remote computer. Select File > Open Data Files from the menu bar to open the Browse for Folder box. 3. Type the share name. Type in the complete path that you copied down for the hidden share, including two back slashes, computer name, back slash, share name, and dollar sign (\\computer name\share name$).

If you have already bookmarked the folder, simply click Favorites to display a list of bookmarked locations, select one, and click OK.

Use Add to Favorites to make the data easier to load next time.

If you are opening data from a Macintosh, navigate to the shared computer or folder and select it, or type the computer name (or IP address) and shared data files folder (\\maryjane\Library or \\192.168.100.1\Library). You will be prompted for the Administrator user name and password for the Macintosh. 4. Load data from the folder. Click Open and wait for the data files to load. They will take longer to load over a network.

Refreshing Data

Use the Refresh feature when you want to view the most current data or limit the events are shown by date. Refresh is also useful if the data folder has no activity in the default date range loaded (no data would appear). You can refresh the date range from any Spector Pro view.

To refresh to the latest data:

Suppose you are monitoring your daughter's activity from another computer on your home network while she is on the computer. After you open your Viewer and load the data from her computer, you can refresh your Viewer and load new data to see what she's been up to in the last few minutes. 1. Select Data > Refresh on the menu bar or press F5. 2. Click OK and wait for the Viewer to refresh with new data.

To refresh and limit data:

Suppose your Web Sites Visited view contains so much information that you can't find what happened on February 6. You can refresh and enter a date range that starts and ends with that date. 1. Select Data > Refresh on the menu bar or press the F5 key. (A Refresh button is provided on the Data > Show Data Files toolbar). The Refresh Data window opens. The latest date range selected displays. (If you have never altered the date range, the date range displayed reflects all recorded data currently stored by Spector Pro.) 2. Type over the month, day, or year in the From or To field, or Click the down arrow on next to the field.

A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month.

3. Click on the From date in the calendar (such as February 6); the calendar closes and the newly selected date appears in the From field on the Refresh Data window. 4. Use the same steps for the To field.

5. Click OK to save the changes made, or Cancel to discard them. The window closes, and a progress bar indicates that new data is being loaded into the Viewer. When loading is complete, the new dates appear in the From and To fields on the toolbar. The window contains only data for February 6. The date range selected applies to all the windows you navigate to after this, including the Data File window, until you change it again.

Web Sites Visited - Feb 06 only

Show Data Files - 02/06 only

Searching for a Keyword

In every view except Screen Snapshots you can search for a keyword or phrase. This allows you to locate specific information quickly. Only the information that exactly matches the search criteria you enter is displayed in the Viewer after you click Go or press Enter. The Search Results window is temporary, and you can exit back to the normal, complete view of the activity. You know your kids are chatting away with their friends, and you recognize most of the screen names you see in Chat Activity. It's the ones you aren't familiar with that you want to focus on. While scanning throughthe Email Activity From column, you notice a specific name you don't know (let's say "big daddy13") so you perform a search for "bigdaddy13". Then you spend some time carefully reading through these messages. You suspect a certain employee of stealing data. You want to monitor his / her Program Activity, but there is too much of it. You can go into Program Activity and perform a search for "telephone" or "security" "password" and narrow your search to specific documents having to do with these sensitive issues.

To search in an activity view:

1. Select the view you wish to search (any under All Recordings except Screen Snapshots). 2. Type a word, words or phrase in the "Search [activity] for" box. See Search Rules below.

3. Press Enter or click Go. For an advanced Search, click the down-arrow next to Go.

Search Results The Search Results pane replaces the upper pane, and all events are limited to those containing the matching word or phrase. A Search filters the data shown so that only matches are displayed. The Search Results remain in the view until you either click Exit Search Results or close the Viewer. This allows you to compare results in different views. At any time, return to the normal, complete view of the activity by clicking Exit Search Results.

Advanced Search Use Advanced Search to narrow the returned search results or to change default settings for a basic Search. Your Advanced Search criteria is maintained while the Viewer is open or until you select new criteria. If there are no recorded events on the window, the Search window does not open.

To perform an advanced search:

1. Click the down-arrow next to the Go button OR select Edit > Search. The Search window opens. 2. Enter your search terms, select criteria (all fields are described below), and click Search.

Exact upper and lower case match - If you check this box then the case must match. By default, the Search is case insensitive and does not have to match. For example... When this box is checked, SPECTORSOFT is a match; Spectorsoft is not a match; spectorsoft is not a match.

Include partial word match - If you check this box, the word is considered a match even when surrounded by other alpha or numeric characters. By default, Search must find a word surrounded by a character that is NOT alpha or numeric. For example... Using SPECTORSOFT as the search word: When this box is checked, SOFT is a match; soft is also a match. When this box is NOT checked, neither SOFT nor soft are a match. When this box AND Exact upper and lower case match is checked, SOFT is a match; soft is NOT a match.

Search in - Select at least one check box indicating where you want to search for a match. Search in options change for each activity. For example, the Web Sites Visited activity allows you to select Search in Web page URL and Search in Web Page Title, while the Keystrokes Typed allows you to Search in Text and Search in Title. If you do not check at least one option, you receive an error message.

Date selection - Narrow the search by indicating a specific date or date range. Date values entered are inclusive. For example, if you enter date values 4/1/03 to 4/2/03 the search includes everything fitting the search criteria from 4/1/03 at 12:00:00 AM to 4/2/03 at 11:59:59 PM.

All dates - Click this to include all available dates in the currently loaded data.

Specific Date - Click this to limit the search to a specific date.

Date Range - Click this to enter both a start and an end date for the search. 3. Click Search to conduct the search, or Cancel to close the Search window without conducting the search.

Search Rules Follow the rules to get the most out of your search. All of the words entered must be found to detect a match. However, the words do not need to be in the same order. If you enter hello there it DOES match there hello or any other combination. Use quotation marks to find specific phrases, or words in a special order. If you enter "hello there" it DOES NOT match there hello.

The words can be spread throughout any of the "Search In" fields selected; i.e., you enter GOOD DAY and select the URL and Page Title "Search in" fields. If the URL contains GOOD and the page title contains DAY, then it is considered a match. Double quote marks cancel each other. If you enter ""hello there"" search looks for the words hello and there in any order. Phrases are space sensitive. The entry hello there (single space between words) does not match hello there (double space between words).

When you View Details from a Top 10 view, Spector Pro performs a Search and displays Search Results.

Search In Options

The Search In options are different for each activity, as shown below. Check and uncheck boxes to indicate where you want to search. There must be at least one box checked. By default all boxes are checked.

Web Sites Visited Keystrokes Typed

Chat / IM Email

Online Searches Files Transferred

Program Document Tracking

Network

Menu Options

Menu options at the top of the Spector Pro Viewer window change from view to view. In the table below, a menu option always appears unless a particular view is indicated for the option, such as SNAPSHOTS ONLY. Note that "Snapshots" includes the Screen Snapshots for MySpace and Facebook.

File Menu

Open Data Files Open a Browse For Folder window and navigate to a Spector Pro Data Files folder on this computer or on another computer. You must have share permissions to read the folder.

Save As Save recorded data as a file, or save Screen Snapshots as images or a video file. List: Save one selected item, or the entire list in the upper Event pane. Item: (Chat/IM, Email, and Keystrokes only) Save the information in the lower Content pane.

Print (Ctrl+P) Print the information displayed in an Event, Summary or Detail pane. The Print window opens. Click Print.

Delete All Data Delete all data files. Files

Settings Open the System Settings window.

Uninstall Remove Spector Pro from your computer.

Close Close the Spector Pro Viewer and begin recording.

Edit Menu

Copy (Ctrl+C) Copy highlighted information to the Clipboard. From there, the information can be pasted into a document.

Select All (Ctrl+A, Alt+I) Highlight all the information displayed on the screen.

Search (Ctrl+F, Alt+S) Locate specific information quickly using criteria you enter. Search Results display, if any. Not available in User / Snapshots / Top 10

Close Search Use to close the Search Results window. Not available in User / Snapshots / Top 10

Delete (Del) Delete a specific highlighted event(s).

Delete Range SNAPSHOTS ONLY Delete a series of consecutive snapshots.

Delete All SNAPSHOTS ONLY Delete all recorded snapshots.

Edit Menu

Tag / Untag SNAPSHOTS ONLY (Space) Mark and unmark a snapshot for future action.

Clear All Tagged SNAPSHOTS ONLY Eliminate all tags from snapshots.

Delete All SNAPSHOTS ONLY Delete all snapshots that are tagged. Tagged

View Menu

Tagged SNAPSHOTS ONLY Show All Snapshots: Show all snapshots, tagged or not. Show Tagged Snapshots: Show only tagged snapshots.

Toolbars Event Bar: Display two dropdown lists on the event bar, one of snapshots identified by date, time and URL, and one of keywords detected. Frame Slider Bar: Display the frame slide bar. Click or click and drag the slider to the right to move toward the end of the day; click to the left to move toward the beginning of the day. Toolbar: Display the main Viewer toolbar which contains both shortcuts and tabs. Status Bar: Display the Status Bar which contains today's date and time, and additional information about the recorded events. Sidebar: Display a Navigate pane at left

Options Display the View Options window and select options regarding viewing MySpace Activity, resume recording, and clearing references to SpectorSoft from Internet Explorer.

Upper Pane Arrange Columns: Choose to Hide or Show columns, and select their order from left to right. Default Columns Settings: Return the display and order of columns to the original configuration. Group by: Select the categories by which you want information grouped, e.g., Date, Domain, Site, Program Window Title, Program Execution, Program Description, User). Arrange Custom Grouping: Select additional categories for grouping information, as well as the order in which they appear in the Navigate pane tree. Custom Grouping: When new groups are selected or groups are rearranged, this is checked.

View Menu

Lower Pane Summary / Details: Select whether you want to view data in summary, or in detail. Arrange Columns / Default Column Settings: Choose to Hide or Show columns, and select their order from left to right. Applies either to Summary or Detail pane, depending on which is selected at the time. Graph Options: Select which items to include in the graph, as well as its time interval (User Activity only). KEYSTROKES TYPED ONLY - Show Keystrokes / Characters: Display either view for the event that is highlighted in the Event pane (upper). Show Formatted: Display the Formatted view for whichever event is highlighted in the Event pane (upper). Show Raw: Display the Raw view for the event that is highlighted in the Event pane (upper). Show Custom: Display the Custom view for the event that is highlighted in the Event pane (upper). Custom Settings: Display the Custom Keystroke View window from which you select the types of keystrokes you want to display in the Custom view, as well as set a time interval.

Snapshot Open a floating window that displays a snapshot of selected data with all Context the playback controls found in a Snapshot event window.

Jump to Jump to the Snapshot event window to view what was on the screen Snapshot when a particular activity occurred.

Jump to Jump to the Keystrokes event window to view what was typed when a Keystrokes particular activity occurred.

Jump to Web ONLINE SEARCHES ONLY – Go to the Web Sites Visited view where you Sites Visited can open the actual web site and block access to a web site.

Open Web Site WEBS SITES VISITED - Open a browser displaying the web site.

View Post Data WEBS SITES VISITED - View data posted to an online form, such as an application completed or a password entered.

Block Chat/IM CHAT/IM ONLY - Block access to the selected chat / IM program (Chat / Access IM only).

Block Web Site Block access to the selected web site. Access

Reset Report MYSPACE, FACEBOOK ONLY

View Menu

All, Last 30 Days TOP TEN ONLY - Display the range of data you want to view. Last 7 Days Last 2 Days Custom

Custom Settings TOP TEN ONLY - Select a date range to view. Arrange Columns / Default Column Settings: Choose to Hide or Show columns, and select their order from left to right.

Playback Menu (Snapshots Only)

Play (Enter) Start the presentation of screen snapshots.

Back (Left arrow) When the Viewer is "stopped," back up one snapshot.

Forward (Right arrow) When the Viewer is "stopped," move forward one snapshot.

First (Home) Move to the first snapshot.

Last (End) Move to the last snapshot.

Prev Day (Ctrl+Left arrow) Move to snapshots from the previous day.

Next Day (Ctrl+Right arrow) Move to snapshots from the next day.

Fit To View See an entire snapshot in your adjusted window size.

Full Screen (Esc) Expand the snapshot to fill your entire screen. Click Exit Full Screen on the floating toolbar, or click Esc to return to the normal view.

Slower (Down arrow) Decrease the speed of the automatic playback of snapshots.

Faster (Up arrow) Increase the speed of the automatic playback of snapshots.

Data Menu

Show Data Files Show all currently existing data files.

Filter Select to hide or show recorded events. by Windows Users: Displays the Filter window, allowing you to display information for selected user names. Only available if more than one user is has an account on this computer. by Programs: Displays the Filter window, allowing you to display information for selected programs.

Backup Backup all existing data files in a file on your computer.

Data Menu

Refresh (F5) Update the Viewer with events that have been recorded since it was last opened, and / or select specific dates for the time span displayed.

Window Menu

All Recordings Screen Snapshots, Chat / IM Activity, Online Searches, Web Sites Visited, Email Activity, Files Transferred, Keystrokes Typed, Program Activity, User Activity, Document Tracking, Keywords Detected, Network Activity.

Top Ten Chat / IM Activity, Online Searches, Web Sites Visited, Email Activity, Program Activity, Keywords Detected.

MySpace MySpace Snapshots, MySpace Report, MySpace Messages, MySpace Chat IM.

Facebook Facebook Snapshots, Facebook Report, Facebook Messages, Facebook Chat IM.

Help Menu

Online Help Access online documentation and learn all about how the program works.

Contact Technical Jump to the Technical Support by Email web page on the SpectorSoft Support web site.

Access Knowledge Jump to the Knowledge Base web page on the SpectorSoft web site. Base

Give us Your Go to an opinion web page on the SpectorSoft web site. Suggestions

Technical Support Send Settings Configuration: Automatically sends your settings to Diagnostics Tech Support. Send Log File: Automatically sends the log files to Tech Support. View Log File: Display the files Tech Support may need to help solve a problem. Restore Default Settings: Change the settings back to how they were when you purchased this product.

Check for Updates Jump to the Downloads web page on the SpectorSoft web site. You will be informed if a new update is available.

Upgrades/Additional Jump to the Upgrades/Additional Licenses web page on the Licenses SpectorSoft web site where you can find out if you qualify for an upgrade, view your current licenses and purchase additional licenses.

Help Menu

Notify me of Check this if you want to be notified whenever SpectorSoft puts out a Updates free maintenance release.

About Display information about your software including version, build and serial number; and jump to the Technical Support by Email web page on the SpectorSoft web site.

Toolbar Shortcuts

When you select a specific activity, the corresponding event window opens. The lower portion of the toolbar for each window is customized with shortcuts to important functions designed to help you manage the information on the window.

All Recordings Toolbar The following shortcuts are found on most windows within the All Recordings tab. The User Activity window does not have a search shortcut, the Keystrokes Typed window does not have Snapshot Context, and Blocking is specific to Web Sites Visited and Chat /IM.

Group by - This feature allows you to customize the display of recorded data to suit your needs in any window that has a hierarchical tree. You may select how data is grouped, and the order in which the groups appear in the tree. You can also determine the direction in which information is sorted (ascending or descending).

Snapshot Context - From within an event window you can open a floating window and view a snapshot that corresponds to a selected event. You can also navigate through the snapshots to get an idea of the context within which the activity occurred, without leaving the event window you are currently in. Jump to - This feature becomes active when you select an individual event from a Navigate, Detail, or Event pane. It provides different options, depending on which event window you are viewing, including: Snapshots - This selection jumps you to the Screen Snapshots window and a view of what was appearing on the computer when the selected event was recorded. Keystrokes - This selection jumps you to the Keystrokes Typed window, and a view of the keystrokes that were typed when the selected event was recorded. Open Web Site - This selection opens a browser window and jumps you to the actual web site that was visited when the selected event was recorded. Web Sites Visited - This selection jumps you to the Web Sites Visited window and a view of the details of the visit. Block Web Site or Chat / IM - Click to block access to a selected web site from the Web Sites Visited event window, and click to block access to a particular contact name from the Chat / IM Activity window.

Search - The Search feature (basic and advanced) works like a filter to display only the recorded events that match the criteria you enter. Search results are maintained as long as the Viewer is open, even while you navigate from one activity to another.

Delete - You can delete one or more recorded events. Once you delete an event, it cannot be retrieved. Make sure that when you tell Spector Pro to delete recorded events, you no longer need them. You may want to backup or save data prior to deletion.

Snapshot Toolbar

The Snapshot view (under All Recordings, MySpace, or Facebook) contain the shortcuts listed below.

Size Controls - These buttons allow you to change the size of the screen, as well as manage how much of the snapshot you see. Browse Controls - These buttons allow you to browse through snapshots one at a time. Playback Controls - Standard playback buttons stop and start a slide presentation, and how fast or slow it goes.

Top Ten Toolbar

The following shortcuts are found on all Top 10 windows. The MySpace Report window has all of these shortcuts as well, except for Show Top 10.

Show Top 10 - This dropdown list provides a choice of what kind of data you want to view. It changes depending on the Top 10 window you are viewing. All - Loads all Top 10 recorded events available. Last 30 Days - Loads Top 10 recorded events from the previous 30 days. Click again to access data from the 30 days prior to that, and so on until no prior data is available. Last 7 Days - Loads Top 10 recorded events for the previous week. Click again to access data from the prior seven days, and so on until no prior data is available. Last 2 Days - Loads Top 10 recorded events for the previous two days. Click again to access data from the prior two days, and so on until no prior data is available. Custom - Click to bring up a From calendar and a To calendar to select a customized date range.

Snapshot Context

The Snapshot Context button allows you to open a floating snapshot window from within the Online Search, Web Sites Visited or Program Activity view. Browse through snapshots in the Snapshot Context window to understand the context for the currently selected event, without leaving the event window. For example... While viewing the Web Sites Visited window, you see a web site in the Navigate pane having to do with marijuana. Curious about this site, and what else your child has been looking at, you click Snapshot Context. A snapshot window opens.

To view a floating snapshot:

1. Click to highlight an event on a Detail or Event pane. 2. Select View > Snapshot Context from the menu bar, or click the Snapshot Context button. The Snapshot Context window opens showing a snapshot from the time period of the selected event.

3. Use the Playback toolbar at the top of the Snapshot Context window to navigate through the snapshots. 4. Select any other date, folder, or event in the Viewer to change the Snapshot context. The Snapshot Context stays open for a particular view until you close it or close the Viewer. 5. Click the window's close button to close it and return to the activity view you came from.

View Options

Select View > Options from the menu bar to open the View Options box. From here you can choose various settings having to do with MySpace and Facebook Activity tabs, clearing references to SpectorSoft from Internet Explorer, and recording on exit. Return to the default settings for this dialog box at any time by clicking Defaults at the bottom of the box.

Displaying the MySpace Tab

By default, the MySpace tab appears only if MySpace activity has been recorded. It is possible to display this tab whether or not activity has been recorded or never display it at all. Select: Always to display the MySpace tab whether or not data is available. Only when MySpace data is available to retain the default setting. Never if you do not want to display the MySpace tab.

Displaying the Facebook Tab

By default, the Facebook tab appears only if Facebook activity has been recorded. It is possible to display this tab whether or not activity has been recorded or never display it at all. Select: Always to display the Facebook tab whether or not data is available. Only when Facebook data is available to retain the default setting. Never if you do not want to display the Facebook tab.

Clearing References to SpectorSoft from Internet Explorer

By default, Spector Pro gives you the option to clear all references to SpectorSoft that may exist in the cookies, cache, address bar or history each time you close the Spector Pro Viewer. (This only occurs if you have visited the SpectorSoft web site AND if you are using Internet Explorer as your browser). Remove SpectorSoft references from Internet Explorer on exit - Clear this option to disable this feature. You will not be prompted when you close the Viewer, Internet Explorer will not be closed, and references will not be cleared. Always close Internet Explorer - If the "Remove References" feature above is checked, and if references to SpectorSoft exist, select this option to close Internet Explorer and remove references with NO prompting. Never close Internet Explorer. Some references may remain - If the "Remove References" feature above is checked, and if references to SpectorSoft exist, select this option to NEVER close Internet Explorer but to remove other references to SpectorSoft. Prompt me - If the "Remove References" feature above is checked, and if references to SpectorSoft exist, select this option to receive a prompting message asking if you want to close Internet Explorer and remove all references to SpectorSoft.

Resume Recording on Exit

By default, Spector Pro asks whether or not you want to resume recording when you close the Viewer. You can eliminate the prompt. Always. If recording was toggled off you will be prompted - Select this option to automatically resume recording whenever you close the Viewer WITHOUT being prompted. The prompt is used if you have manually paused recording. Prompt me - Leave this option selected to display the prompt that allows you to select Yes, No or Cancel when you close the Viewer. Cancel exits the request to close the Viewer.

NOTE: It is possible that you have manually paused recording using the hotkey sequence and that you have selected Always, indicating that you want to resume recording without a prompt. In this case, you will receive a prompt when you close the Viewer asking whether or not you want to resume recording. Select Yes to override the manual pause.

If Spector Pro is set to resume recording, the program begins recording activity on all computers on which Spector Pro has been installed. Information is captured for all programs and users, 24 hours a day / 7 days a week, according to the settings.

Keyboard Shortcuts in General

Shortcut Function

F1 Opens Help for the current view.

F5 Opens the Refresh Data box allowing you to refresh data in the Viewer or change the date range.

Ctrl+C Copies the currently selected item to the Clipboard (except Navigate panes). For example, you can copy a Chat/IM record from the upper Event pane and paste it in a document.

Ctrl+P Opens the Print box allowing you to print data in the active pane.

Ctrl+A Selects all items in the current pane (except Navigate panes).

Delete Deletes the currently selected data, if any. Displays a confirmation box.

Down arrow In an Event pane, moves the selection bar down the list. Shift+Down multiple selects the event items.

Up arrow In an Event pane, moves the selection bar up the list. Shift+Up multiple selects the event items.

Enter When a Keyboard, Chat/IM or Email event is selected, displays the content for the event in a separate window. for Navigation Panes The "tree" in the upper Navigate pane of some event windows has keyboard shortcuts that make traversing the tree simpler.

Shortcut Function

Numeric Expands everything under the current selection. Keypad * NOTE: This is particularly useful when used with the Snapshots Sidebar, allowing you to navigate through events and view the matching snapshots.

Numeric Expands the current selection. Keypad +

Numeric Collapses the current selection. Keypad -

Right arrow Expands the current selection if it is not expanded; otherwise it goes to the first child.

Shortcut Function

Left arrow Collapses the current selection if it is expanded; otherwise it goes to the first child. in Screen Snapshots

Shortcut Function

Enter Toggles between Play the snapshots (same as green play button) and Stop the snapshots from playing (red button)

Esc Toggles between Full Screen and Exit Full screen.

Right arrow Go to next snapshot.

Left arrow Go to previous snapshot.

Ctrl+Right arrow Go to first snapshot of the next day

Ctrl+Left arrow Go to the first snapshot of the previous day

Home Go to first snapshot.

End Go to last snapshot.

Security Considerations

With Spector Pro, you can have peace of mind knowing that your recordings are secure. Without changing any settings, you no unauthorized person can detect or open the program. Only you will be able to view or delete information, change settings, or remove the program. Depending on your needs for home or office, there are several ways to increase security or to allow more visibility.

ALL users of the computer must be logged off and all programs closed before you adjust Spector Pro settings. If not, the changes are not registered for those users and programs. If you are monitoring more than one computer, make sure you adjust settings at each computer where you want changes to take effect.

Stealth for Security Stealth ensures confidentiality of people using the computer. It also ensures that a user will not tamper with the program or its data. By default, Spector Pro has stealth measures in place. Stealth Mode - An ultra-secure cloaking system makes Spector Pro invisible and virtually impossible to detect. When installed in the default "Stealth Mode," the program does not appear in the Windows system tray, the list of Programs, or in any visible or recognizable folder. Event the Windows services and registry entries used by the program would be difficult for an average user to identify. To open the program (the Viewer), you must use the hotkey sequence. The "Set to Stealth Mode" settings can be turned on or off under System Settings > Security. Hotkey Sequence - If Spector Pro is installed in Stealth Mode, a hotkey sequence is required to open the Viewer. For greater security, change the default hotkey sequence. This setting is available under System Settings > Security. Password to Access - If you requested a password for Spector Pro when you installed it, the hotkey sequence displays a password prompt before it opens the Viewer. You can set or change the password to open Spector Pro under System Settings > Security. Password-Protected Data - By default, the data files on a recorded computer are accessible by anyone who has access to Spector Pro (hotkeys and password). To further secure data, you can add a password to access data. This means a password prompt appears before the data loads into the Viewer. Set this password under System Settings > Data Files. Hidden Data Files - By default Spector Pro stores data files appear as "hidden" in Windows, within a randomly named folder, deep in the system. If Windows Explorer is set to Show Hidden Files and Folders, the files will appear. If it is set to Do Not Show Hidden Files and Folders, this folder appears to be empty. This on/off setting is available under System Settings > Data Files.

Visibility for Transparency Visibility may be desirable for legal or courtesy reasons. It's possible to make Spector Pro visible to the user, yet protect access to the Viewer and Settings. Visible Mode - In Visible Mode, Spector Pro is available on the computer as an application. A red square appears in the Windows task bar, and Spector Pro will now appear in the Windows Start list. Generally, this mode of operating is used for only demonstration or if you are monitoring only yourself. When the program is visible, someone could view confidential information, uninstall the

program, or destroy data files. The "Set to Stealth Mode" settings can be turned on or off under System Settings > Security. Set Logon Warning - A logon warning informs a user they are being monitored without actually making Spector Pro visible (and vulnerable). Turn on this warning in Advanced System Security settings.

Clearing SpectorSoft References

All browsers (AOL, Firefox, Netscape, Internet Explorer) automatically save information about each web site visited, including the SpectorSoft web site. If you have visited the SpectorSoft web site and have left Internet Explorer open, the following message appears when you close the Viewer. Clearing references to SpectorSoft provides an extra measure of stealth and security. You can change this setting using View > Options from the menu bar.

This feature works only for Internet Explorer (IE). See Knowledge Base Article #244447 for procedures on clearing information if your browser is anything other than Internet Explorer.

At this point you have a choice to clear the references or not. Click Yes to close Internet Explorer and clear all references to SpectorSoft. Click No to leave the references.

Information Removed Internet Explorer must be closed in order for Spector Pro to clear these references. If it is not closed, all data is deleted EXCEPT the data in the address bar. The following information is removed from your Internet Explorer web browser: SpectorSoft cookies ENTIRE browser history SpectorSoft addresses in the address bar history ( e.g., http://www.spectorsoft.com and http://www.spectorpro.com) SpectorSoft web cache (temporary Internet files) - see below. Form information (such as past searches on Yahoo! or Google) stored on your hard drive for fast retrieval in the future.

Web Sites Deleted The following web sites are deleted from the IE Temporary Internet Files folder (the browser's cache). All other files in the cache are not affected and remain in the folder:

www.spectorsoft.com www.spectorpro.com www.spector.com www.eblaster.com www.spectorcne.com www.spectror360.com

All Recordings

Views of All Recordings

Views under the All Recordings tab organize all Spector Pro data by activity. These views allow direct access to every recorded event. Select from the list below to learn more about each view. Note that you must select Network Activity from the Window > All Recordings menu.

Chat / IM Activity

Online Searches

Web Sites Visited

Email Activity

Files Transferred

Keystrokes Typed

Program Activity

User Activity

Document Tracking

Keywords Detected

Network Activity

Screen Snapshots

Viewing Chat / IM Activity

Spector Pro records both sides of chat and instant message (IM) conversations from many of the most popular applications including AOL chat, AOL Instant Messenger (AIM), MSN Instant Messenger, Yahoo Messenger, ICQ, Trillian, Google Talk, Skype, and IRC chat. Use this window to view, print or save a complete record of all the conversations that have taken place. Click here to view which types of Chat / IM are recorded.

Practical Uses

View their private instant messages - Find out what's really going on. For example, your 16-year- old has been sneaking out of the house while you thought she was reading, doing homework, and going to sleep early. You will be able to confront this behavior.

Find how they are presenting themselves - The screen name they're using may tell you something about how the children are choosing to present themselves to the chat or IM community.

Find out who they're meeting in chat rooms - The use of chat rooms introduces kids to unknown entities. Read what they're talking about and make sure there isn't someone on the other end who needs to be avoided. If this is the case, you can block access to a particular contact name.

By default, Spector Pro captures chat / IM activity. To learn more about the settings that affect what you view in this window, see Chat / IM Activity Settings.

What Is Recorded? The Chat / IM Activity window uses an Event pane and Content pane to display information. Recorded events are listed in the upper Event pane, with information about each event displayed in a series of columns. You may change how columns are arranged and sorted.

Event Pane (upper) Each chat / IM session is considered one recorded event. Each event is listed in the Event pane.

Double-click on an event to open a Chat / IM Content window where both sides of the actual conversation are displayed.

From this window you can save, cut, copy, paste and print the contents, as well as view the next or previous chat / IM session. To save a conversation on your computer:

Click Save As, or select File > Save As from the menu bar. On the Save As window that appears enter a path, file name and format (you can use either rtf or txt).

Click Save. If you save the event as an rtf file, a Word document is created. If you save the event as a txt file, a Notepad document is created, as shown below.

Content Pane (lower) The Content pane displays both sides of the actual chat or IM conversation for the event selected in the Event pane.

Event Pane The following columns are displayed in the upper Event pane: Time - The date and time when the chat / IM was recorded, using the format MM/DD/YYYY HH:MM:SS AM/PM. By default, events are listed in chronological order. Sign On Name - How the user identifies him / herself in this chat or IM conversation (contact name). Chatted With - How the person chatted with identifies him / herself (contact name). Participants - The number of participants in the chat room when the conversation was recorded.

Right-click and select any of the following additional columns for display: User - The user logged in to Windows. Computer - The name of the computer on which activity was recorded. Program - The program being used. Protocol - The underlying language used by the chat / IM program.

Content Pane When you click to highlight a chat / IM event in the upper Event pane, the conversation displays in the lower pane.

Shortcuts The Chat / IM Activity event window contains the following shortcuts:

Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

Block Chat / IM - Use Blocking to discontinue access to a particular person chatted with. NOTE: If you are viewing recorded eve nts from a Viewer Only computer, this button does not appear.

Search Chat / IM Activity - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Chat/IM Supported

You can record chat and instant message (IM) conversations from most of the popular applications. The person you are monitoring can log in to any of the following Chat / IM protocols, and the communication will be captured. Spector Pro will not capture encrypted communication.

If recording of a Chat / IM program you wish to monitor is NOT supported, you can still retrieve information in Keystrokes Typed and Screen Snapshots.

AOL The following interfaces are recorded: AOL Chat - Accessed within the proprietary AOL interface AIM (AOL Instant Messaging) AIM 6.0 (formerly AIM Triton) AIM Express - Uses a Java applet to perform AIM conversations Dead AIM - Third-party modification of AIM AIM Pro

ICQ The following ICQ interfaces are recorded: ICQ 2002 ICQ 2003 ICQ 5.1 (formerly ICQ Lite)

Yahoo The following interfaces are recorded: Yahoo! Messenger Yahoo! Chat 2.0 Yahoo! Java Chat

Microsoft Most instant message conversations are recorded from Microsoft interfaces including: MSN Messenger - IM using a .NET passport account Windows Live Messenger - IM via a free MSN download client MSN Exchange Client - IM on an internal network MSN Chat - Active X control in a browser

MySpace / Facebook MySpace Instant Message MySpace beta Facebook Instant Message

IRC Chat Client The following interfaces are recorded. Some IRC Clients use non-standard communication ports and may not be recorded under the default settings. Use the Advanced button in Chat / IM Settings to adjust the ports that Spector Pro monitors: mIRC Pirch Trillian (Trillian Pro encrypted is NOT captured) Morpheus ViRC XiRCON

Skype Skype is a VoIP service that provides messaging in addition to voice conversations. Spector Pro does not capture voice. Chat / IM

Google Google Talk

Jabber G talk

Viewing Online Searches

Spector Pro records every online search using the most popular search engines including Google, AOL, MSN, and Yahoo. You get a quick picture of what users have been looking for, and whether or not they actually visited each web page listed. See the date, time, terms searched for, the number of times searched, and the search engine used.

Practical Uses Get a quick picture of what's on their minds whether or not they actually go to each web page listed, by spotting a trend in online searches. This may alert you to inappropriate activity, or put your mind at ease. Make discoveries by finding out what they want online or what might make a good gift.

Spector Pro always captures Online Searches. There are no settings to turn off or adjust recording for this activity. However, if Web Sites Visited recording is turned off, no online search information is recorded.

What Is Recorded? The Online Searches event window uses a Navigate, Detail, and Summary panes to display information. You may change how columns are arranged and sorted.

Navigate Pane (upper) Each online search is considered one recorded event. Events are arranged in groups and sub groups and sub-sub groups, each of which is displayed like a branch on a tree. By default events are grouped first by date, although you may choose to group the events differently.

Click the plus (+) sign next to Online Searches to expand the tree and view dates. Click the plus (+) sign, next to a date to expand and view each site (domain) where a search was recorded.

Summary Pane (lower) Click the Summary tab to view this pane. The Summary pane displays totals for the recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you display a wider or narrower view of events.

For example, select a particular date, for example Thu, Aug 24, to display totals for each search conducted on that date.

Detail Pane (lower) Click the Details tab to view this pane. The Detail pane displays specific information about each recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you can display a wider or narrower view of events.

For example, select a search site, for example Google, to display details for every search conducted using that search site.

Summary Pane The Summary pane displays these columns: Search Term – Each word or phrase entered in a search site. For example, if the same word was entered three times, it appears once as a search term, with total searches recorded as 3. Total Searches - Indicates how many times this word or phrase was searched for. Right-click and select any of the following additional columns for display: Search Site – The domain where the search was performed, such as, google.com or search.msn.com. Protocol - The Type of Uniform Resource Identifier of the search site, for example HTTP, HTTPS. First Search – The date and time when this word or phrase was first searched for, using the format MM/DD/YYYY HH:MM:SS AM/PM. Last Search - The date and time when this word or phrase was last searched for, using the format MM/DD/YYYY HH:MM:SS AM/PM.

Detail Pane

The Detail pane displays the following columns. You may arrange and sort the information in the columns: Time - The date and time the search was recorded, using the format MM/DD/YYYY hh:mm:ss AM/PM. Search Term – Each search term is listed once for each time it was entered in a search engine. Search Site – The domain where the search was performed, such as google.com, or search.msn.com. The following data column is also available. Right-click the column headings to select columns. Protocol - The Type of Uniform Resource Identifier of the search site, for example HTTP, HTTPS.

Shortcuts The Online Searches event window contains the following shortcuts:

Group by - Use this to customize the display of recorded data in the Navigate pane tree. You can change how data is grouped and ordered in the Navigate pane tree.

Snapshot Context - Click to open a floating window and view a snapshot that corresponds to a selected event. You can also navigate through the snapshots to get an idea of the context within which the activity occurred, without leaving the event window you are currently in. Jump to - Click to jump to Snapshots, Keystrokes, or Web Sites Visited for the event selected in the lower Details pane.

Search Online Searches - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing Web Sites Visited

Get an exact picture of the user's web surfing habits. Spector Pro saves a record of every web page that is accessed on the computer for you to review. Although similar to the History feature of typical browsers, Spector Pro goes further by providing important details such as the total number of visits made to a web site, the total amount of time there was keyboard or mouse activity during the visit, and more. You can quickly highlight any domain, subdomain or URL and block access to it.

Practical Uses

See firsthand where they're surfing and whether you need to block access to a particular domain or subdomain.

Find out if web time is cutting in to work time and schedule certain times when the Internet is not accessible, if necessary.

Avoid productivity drain by monitoring which users are connecting to the Internet, when the connections are made, and which Internet addresses are accessed.

By default, Spector Pro captures web site activity. To learn more about the settings that affect what you view in this window, see Web Site Settings.

What Is Recorded? The Web Sites Visited event window displays information in three panes: Navigate, Detail, and Summary. Use the Navigate pane to select different information to display in the other two panes. See Arranging Columns and Sorting Data to customize the display.

Navigate Pane (upper)

Each visit to the Internet is considered one recorded event. Events are arranged in groups and sub groups and sub-sub groups, each of which is displayed like a branch on a tree. By default, events are grouped first by date, although you may choose to group the events differently.

Click the plus (+) sign next to Web Sites to expand the tree and view dates. Click the plus (+) sign, next to a date to expand and view each web site visited. Click a minus (-) sign to close a branch of the tree.

Summary Pane (lower)

Click the Summary tab to view this pane. The Summary pane displays totals for each recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you display a wider or narrower view of events. For example, select a particular date, for example Fri, Aug 25, to display totals for each domain visited on that date. Select a domain, for example partypoker.com, to display totals only for that domain.

Detail Pane (lower)

Click the Details tab to view this pane. The Detail pane displays specific information for each recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you display a wider or narrower view of events. For example, select a domain, for example partypoker.com, to display details for each subdomain visited within that domain. Double click on an event where a thumbtack icon appears to open a Post Data Content window which displays the information that was posted. Double click on an event where a thumbtack icon appears to open a Post Data Content window which displays the information that was posted.

Summary Pane The Summary pane displays the following columns: Domain – Identifies the general address of a web site, within which are grouped such things as files, folders, and web pages. Active – The total length of time, presented as HH:MM:SS, that there was keyboard or mouse activity during the visit. Visits – The total number of visits made to each domain, host or URL listed. Each visit displays in the Detail pane with more specific information. Right-click in the pane and select User, Computer, Program, or any of these additional columns for display: Title - The page title of the specific URL visited. Web Address - The specific URL visited. Subdomain - A section within a domain or web site. Last Visit – The date and time of the start of the last visit to this web site, using the format MM/DD/YYYY HH:MM:SS AM/PM. Total – The total length of the visit, whether it was in focus, active, or inactive. Focus – The total length of time, presented as HH:MM:SS, that the visit had the primary window on display.

Details Pane The following columns are displayed in the Detail pane: Time – The time indicating the beginning of the last visit occurred. Post - A thumbtack icon indicates a form was submitted online. Double-click an icon where this icon appears to open a Content window where the information posted is displayed.

The fields that have data are displayed first, followed by all the fields that were posted with no data. From this window you can save, cut, copy, paste and print the contents, as well as view the next or previous posted data. Title - The page title of the specific URL visited. Active – The total length of time, presented as HH:MM:SS, that there was keyboard or mouse activity during the visit. Subdomain - A section within a domain or web site. Right-click in the pane and select any of the following additional columns for display: Type - Tells you the type of request sent to the web server: Web: The user navigated to this web page. Post: The user submitted information (a form) through the web page to a server. Redirected: The requested web page was redirected to a different page. Redirector: The user navigated to this page and it redirected him/her to another page. Blocked: The user navigated to this page and it was blocked. Blocked Redirector: The user navigated to the page and it redirected him/her to a blocked page. Blocked Redirected: The user was redirected to this page and it was blocked. Start - The date and time of the beginning of the specific web site visit, using the format MM/DD/YYYY HH:MM:SS AM/PM. End - The date and time of the end of the specific web site visit, using the format MM/DD/YYYY HH:MM:SS AM/PM. Total – The total length of the visit, whether it was in focus, active, or inactive. Focus – The total length of time, presented as HH:MM:SS, that the visit had the primary window on display. Web Address – The specific URL visited. Domain – The name of the web site visited. Post Data - View the first few fields of information submitted, depending on how much information is included in each field. For a complete view, click on the event.

Toolbar The Web Sites Visited toolbar contains the following shortcuts:

Group by - Click to change the data grouping in the Navigate tree. For the top level, select Date (the default), Domain, Custom Grouping, or Arrange Custom Grouping. See Grouping Recorded Events.

Snapshot Context - Click to open a floating Snapshot window that corresponds in time to the selected event. You can use the window to browse through the snapshots and discover the contest in which the activity occurred, without leaving the event window you are currently in. Jump to - Available only when you select an event in the lower Detail pane. Click and select Snapshots or Keystrokes to open the corresponding view from the same time, or select Open Web

Site to open a browser displaying this web site. NOTE: Some web pages will display their login information.

Block Web Site - Click this button to add the domain or subdomain to the list of web sites to block for this user's profile. The user will no longer be able to access this site. NOTE: If you are viewing recorded events from a Viewer Only computer, this button does not appear.

Search Web Sites Visited - Use Search to quickly locate a specific word or phrase. Search works like a filter, displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing Email Activity

Spector Pro records both incoming and outgoing email messages, as well as file attachments, from many of the most popular applications including webmail. You can easily browse through both header information and body content. Spector Pro even keeps a copy of deleted email. Click here to see which email applications are recorded.

Practical Uses

At home, find out who they communicate with and keep them safe. You may be alerted to inappropriate behavior, or you may put your mind at ease.

At the office, decrease legal liability and obtain proof to support accusations of wrongdoing in regard to racially or sexually offensive emails.

To open email content details:

Double click on an event to open an Email Content window displaying all actual email addresses, listing all CC and BCC addresses, displaying "flag" messages (see below) and any email attachments in addition to the content of the email. From this window you can save, cut, copy, paste and print the email. You also can use the window to navigate to the previous and next email in the Event list.

To save this message:

Click Save As, or select File > Save As from the menu bar. In the Save As box select a folder and file type for the file and click Save. If you save the event as an rtf file, a Word document is created. If you save the event as a txt file, a Notepad document is created, as shown below.

To view an attachment

Double click to open the Email Content window. An Attach field appears below the Status line, with the name of the document that was attached. If attachments are being captured, you can click on the file and either Open or Save the attachment. You must have an application installed capable of opening the file.

When Email Attachments are NOT captured, the attachment file appears, as in the illustration above, but cannot be opened. The Status supplies INFO information (see below) about this.

By default, Spector Pro captures email activity, but does NOT capture attachments. Even if attachments are not captured, information about them still appears. When email attachment recording is ON, the attachment is only captured if it does not exceed the Maximum Attachment Size. You can turn on recording of attachments and adjust the maximum size in the Email Activity Profile.

What Is Recorded? The Email Activity event window uses an Event pane and Content pane to display information. Change the display by Arranging Columns and Sorting Data.

Event Pane (upper)

Each email sent or received is considered one recorded event. Each event is listed in the Event pane.

Content Pane (lower) The Content pane displays the actual email message for the event highlighted in the Event pane.

Event Pane The following columns are displayed in the upper Event pane: Time - The date and time when Spector Pro recorded the email, (NOT the date and time the email was sent or received on the monitored computer), using the format MM/DD/YYYY HH:MM:SS AM/PM. Flag - A red flag indicates that Spector Pro has added a message about the recording of the email. To view a message, open the email content by double-clicking a message in the event pane. The flag message appears directly beneath the Subject line in a new Status line. Possible messages include:

ERROR: Unable to read email body - An error occurred while Spector Pro was attempting to read the body of the email. As a result, the body of the email was not recorded.

ERROR: Unable to read email attachment(s) - Spector Pro DOES NOT support attachments sent through AOL or web mail. They must use POP/SMTP email clients (e.g., MS Outlook, Outlook Express, Eudora, Incredimail, etc.).

INFO: Attachment capture turned off - Capture Attachments is not checked in the Email Activity Settings window, so Spector Pro does NOT record any attachments that accompany an email; however, an attachment was sent or received with this email.

INFO: Attachment(s) exceeded size limit - not recorded - There was an email attachment but it exceeded the maximum allowable size for attachments. You can adjust the maximum attachment size in the Email Activity Settings window.

INFO: Email data was encrypted - The email was encrypted by the email application, and Spector Pro is not able to capture these messages, although it is possible that some parts of the email may be recorded. The following message may accompany an email, but without a red flag: INFO: Email was recorded before it was sent - This message applies only to Microsoft Exchange, which may hold email messages for a period of time in the Outbox before sending them. This message lets you know that although this message was captured, it may not have actually been sent. In / Out - Indicates whether the email was incoming or outgoing from the monitored PC. Attachment icon - If an attachment was sent or received with an email, a paper clip icon appears in this column. This occurs even if attachment recording is OFF or the attachment size limit was exceeded. From - The person who sent the email, identified by a screen name. To - The person to whom the email was addressed, identified by a screen name.

Subject - The title of the email assigned by the sender. Type - The type of email (POP / SMTP, Yahoo, etc.). Right-click and select any of the following columns (in addition to User, Computer, and Program) for display: CC - Indicates anyone who received a copy of the email. BCC - Indicates anyone who received a blind copy of the email. Email Date - The date and time the email was sent from or received by the monitored compute. This could vary by days if, for example, the email was sent on Monday but the user did not access the email application until Friday.

Content Pane

When you click to highlight an email event in the upper Event pane, the body of the email message appears in the lower pane.

Shortcuts

Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

Search Email Activity - Use Search to quickly locate a specific screen name, word or phrase. Search works like a filter displaying only the data that matches the search criteria. For both the From and the To line, Spector Pro searches the friendly name as well as the email address, even if only the friendly name is displayed.

Delete - Use Delete to remove one or more events.

Email Supported

Spector Pro is able to record email (sent and received) using many of the popular types of email. We are constantly improving and updating our software to keep up with new software and technologies.

If your email program is NOT supported, the alternative for capturing and viewing this activity is to retrieve information in Keystrokes Typed, and Screen Snapshots.

SMTP/POP Email Spector Pro can record email sent and received using the industry standard SMTP and POP protocols. The majority of the email sent and received on the Internet uses SMTP / POP, but it is only recorded by Spector Pro if it is sent directly from the recorded user by SMTP or received by the recorded user by POP. Popular Windows programs that send and receive email directly from the computer using the SMTP / POP protocols include Microsoft Outlook, Outlook Express, Incredimail, and Eudora.

Web Email (webmail) Spector Pro can only record webmail if the user on the monitored PC opens the email or composes the email. If the email is listed in the webmail account but is not opened by the user, the message is not recorded by Spector Pro. See Webmail Supported.

Spector Pro DOES NOT capture attachments sent through web mail. They must be sent through POP/SMTP email clients (e.g., MS Outlook, Outlook Express, Eudora, Incredimail, etc.) and Microsoft Exchange using MS Outlook.

AOL Email Spector Pro is able to record AOL email sent and received using the proprietary AOL Internet interface. This includes AOL versions 5.0, through 9.0, AOL German, and AOL Mexico. Spector Pro can also record AOL that is sent and received through the web email interface at www.aol.com. The capture of AOL email accessed through the web site at www.aol.com is supported as part of Spector Pro's ability to capture email from the most popular web email sites. Spector Pro does NOT record email accessed within the proprietary AOL Communicator interface unless AOL Communicator is configured to record an SMTP/POP account.

IMAP Spector Pro records this server-based email interface.

Exchange / MAPI Email Spector Pro can record email sent and received using Microsoft's business messaging software, MS Exchange, if the user has logged into the account on the monitored computer.

Spector Pro can only record MS Exchange email when the monitored computer is using Outlook 2000, Outlook XP, or Outlook 2003. Earlier versions of Outlook are not supported. This limitation does not apply if Outlook is being used to send and receive POP or SMTP email only.

Webmail Supported

Spector Pro records email being sent and received from web email sites. Spector Pro records webmail when it is composed or when it is opened. A message received by a user would NOT be recorded unless the user opened the email to be read. Spector Pro does NOT record email attachments sent or received through webmail. Spector Pro can record mail messages and any email address used for sending and receiving email through the following Web sites. If you are attempting to record a type of webmail not listed here, you may have to rely on Screen Snapshots and Keystrokes Typed for your information.

United States Web Email Sites Supported

Email Site Email Address (links are not active in this document)

Adelphia http://webmail.adelphia.net

AOL http://www.aol.com

ATT WorldNet http://www.att.net

BellSouth http://webmail.bellsouth.net

Charter http://mail.charter.net

Comcast http://www.comcast.net/comcast.html

Compuserve http://csmail.compuserve.com

Cox http://webmail.cox.net

Dellmail http://dellmail.com

Exchange Webmail (2000 and Any Exchange webmail accessed at the recorded 2003) computer. Use the Advanced Email Settings to configure internal webmail.

Excite http://email.excite.com

Facebook http://www.facebook.com

Fastmail.FM http://www.fastmail.fm

Google - Gmail http://www.gmail.com

Hotmail http://hotmail.com

Juno http://www.juno.net

Lycos http://mail.lycos.com

Mail.com http://www.mail.com

Email Site Email Address (links are not active in this document)

Mail2Web http://www.mail2web.com

MSN http://www.msn.com

MySpace http://www.myspace.com

Neopets http://www.neopets.com

Netscape http://www.netscape.com

NetZero http://webmail.netzero.net

OpenWebMail Use the Advanced Email Settings to configure SqWebMail internal webmail.

PeoplePC http://mail.peoplepc.com

Verizon http://www.verizonmail.net

Windows Live Mail http://login.live.com OR http://mail.live.com

Yahoo http://mail.yahoo.com

Yahoo (US Spanish) http://correo.espanol.yahoo.com

Yahoo (SBC) http://sbc.yahoo.com

International Webmail Sites Supported

Email Site Email Address (links are not active in this document)

AOL (Argentina) http://www.aol.com.ar

AOL (Brasil) http://www.aol.com.br

AOL (Canada) http://www.aol.com.ca

AOL (France) http://www.aol.com.fr

AOL (Germany) http://www.aol.com.de

AOL (Mexico) http://www.aol.com.mx

AOL (United Kingdom) http://www.aol.co.uk

Earthlink http://www.earthlink.net

GMX http://www.gmx.net/de

Hotmail (English & Japanese) http://www.hotmail.com

Netscape (Canada) http://www.netscape.ca

Email Site Email Address (links are not active in this document)

WebDE http://freemail.web.de

Yahoo (Argentina) http://ar.yahoo.com

Yahoo (Australia) http://mail.yahoo.com.au

Yahoo (Brazil) http://mail.yahoo.com.br

Yahoo (Canada) http://mail.yahoo.com.ca

Yahoo (Denmark) http://dk.yahoo.com

Yahoo (France) http://fr.yahoo.com

Yahoo (Germany) http://mail.yahoo.de

Yahoo (India) http://in.yahoo.com

Yahoo (Italy) http://mail.yahoo.it

Yahoo (Mexico) http://mx.yahoo.com

Yahoo (Norway http://mail.yahoo.no

Yahoo (Spain) http://mail.yahoo.es

Yahoo (Sweden) http://mail.yahoo.se

Yahoo (United Kingdom) http://mail.yahoo.co.uk

Viewing Files Transferred

Files Transferred shows you file traffic to and from the computer via web site upload or download, FTP upload or download, and Peer-to-Peer (P2P). Watch for pirated software, illegal music, pornographic pictures, large video files that take up valuable network bandwidth, online gambling software, and more. See the domain name and IP address of where the transfer was sent to or received from, the name, protocol and type of file that was transferred, and whether it was an upload or a download. Whatever you don't like, you can block.

NOTE: Spector Pro does NOT record Skype file transfers.

Practical Uses

At home, protect yourself and your kids - Stop download of inappropriate material such as pirated software, illegally copied music, online gambling software, and pornographic pictures.

At work, protect resources - stop viewing of sports TV and other video files, which take up valuable network bandwidth and eat up productivity time. Once any of these activities are discovered, you can easily block access to them.

It is possible to block Internet access for these kinds of exchanges. By default Spector Pro captures Files Transferred activity. To learn more about the settings that affect what you view in this window, see Files Transferred Settings.

What Is Recorded? The Files Transferred event window uses a Navigate pane and a Detail pane to display information. You may change how columns are arranged and sorted.

Navigate Pane (upper) Each file that is transferred is considered one recorded event. Events are grouped in a hierarchy with Date at the top, unless you choose to group the events differently.

Click on the plus (+) sign next to Files Transferred to expand the tree and view dates on which file transfers were recorded. Click a plus (+) sign next to a date to view the name of each program used to perform a file transfer on that date. Click on the plus (+) sign next to a program to view the names of domains accessed

Detail Pane (lower) The Detail pane displays information for each recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you display a wider or narrower view of events.

The Details pane displays information for all events within the selected group in the Navigate pane. For example, select a Fri, Jul 21, to display details for each file transfer that occurred on that date. Or, select a particular domain to display details only for file transfers to and from that domain. Select a particular domain to display details only for file transfers to and from that domain.

Details Pane By default the following columns are displayed in the Detail pane: Time – The time the transfer occurred, using the format MM/DD/YYYY HH:MM:SS AM/PM. Type – Indicates whether a file was Uploaded or Downloaded, or a Search was performed. Protocol - The protocol used in the transfer, for example HTTP (GNUTELLA), HTTPS, FTP, KAZAA. Program – The application (program) used to conduct the file transfer. Domain – The domain the file was uploaded to or downloaded from, for example .gov, .edu, .org, .com, .net. Also indicates if file was sent as an attachment via email. File Name - The name of the file that was transferred. Right-click in the pane and select any of these additional columns for display: User - The user logged in to Windows. Computer - The name of the computer on which activity was recorded.

Media - The type of file that was downloaded or uploaded. File types include: Audio: A music or sound file in a defined audio format such as MP3, WAV, or AVI. Image: A picture in a defined graphic format such as JPG, GIF, or BMP. Video: A movie defined by a video format such as MPG or MOV. Software: A program file defined by a software format such as EXE. Document: A document file format such as DOC or TXT. Compressed: Contains compressed files in a format such as ZIP. Unknown: The file media type is unknown. Remote IP – The IP address of the computer the file was uploaded to or downloaded from, for example 64.233.187.104 (Google). File Size – The size of the file. Full Path - The URL of the file that was transferred.

Shortcuts The Files Transferred event window contains the following shortcuts:

Group by - Click to rearrange data in the Navigate pane tree by changing the data grouping. You can change the hierarchy and how data is sorted. Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.

Search Files Transferred - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing Keystrokes Typed

Spector Pro logs every key typed on the monitored computer associates the Keystrokes Typed with Screen Snapshots as nearly as possible. This gives you access to the full context of any typing activity. Spector Pro records all standard alphanumeric keystrokes, non-displayable or hidden keystrokes (Shift, Ctrl, Alt, Enter, Backspace, spacebar, etc.), "True" keystrokes (such as the actual password typed instead of the *** that appears on screen). Spector Pro also can display foreign language characters created by typing combinations of keystrokes.

Practical Uses

Track your password - You will be able to tell if someone has discovered your password and has been using it to get into important, private documents.

If Spector Pro doesn't record a program, see what's happening - If an email or chat program is being used and Spector Pro doesn't record that particular application, you can still find out what the user in your house has been typing by viewing the Keystrokes event window.

Trace exact activity - If, for example, the user copied and pasted something into a new document, you will see the document name and application, the exact time, and hidden keystrokes Ctrl+C (copy).

Then you will see the document name and application, the exact time, Ctrl+V (paste), then [Save As], the exact time, and the name of the new document in which the information was saved.

By default, Spector Pro captures keystroke activity. To learn more about the settings that affect what you view in this window, see Keystroke Settings.

What Is Recorded? The Keystrokes Typed window uses an Event pane and a Content pane to display information. You may change how columns are arranged and sorted.

Event Pane (upper) Keystrokes are either categorized by program (each time the program was opened) or by program window title (the document opened in the program). For example, the user opens Microsoft Word one time and, within that program session, opens three new documents (three window titles). If you group by program execution, there is one recorded event. If you group by window title, there are three recorded events.

Double click on an event to open a Keystrokes Typed Content window which displays the actual keystrokes. (Keystrokes display according to the filters selected in the lower Content pane).

From this window you can Save or Save As an .rtf (Rich Text Format - opens in Microsoft Word) or .txt (Text) document; you can Cut, Copy, Paste, and Print the event; and you can switch among Keystroke Formatted and Raw, and Custom views. Use Next or Previous to progress through events in the Events list.

Content Pane (lower) The Content pane displays the keystrokes and characters typed during the event highlighted in the upper Event pane. Keystrokes are displayed as Formatted, Raw, or Custom, depending on what you have selected. See below.

Event Pane (Program Execution) The following columns are displayed in the upper Event pane: Start - The date and time when the program was executed, using the format MM/DD/YYYY HH:MM:SS AM/PM. Program - The name of the application (program) that was executed. Keystrokes - The total number of keystrokes typed in the program. (Program Window Title) The following columns are displayed in the upper Event pane: Start - The date and time when the window was opened. Title - The title of the active window in use when the keystrokes were recorded. Keystrokes - The total number of keystrokes typed in the window. Program - The name of the application (program) that was executed. Right-click in the pane and select any of these additional columns for display: User - The user logged in to Windows. Computer - The name of the computer on which activity was recorded. End - The date and time when the program or window was closed, using the format MM/DD/YYYY HH:MM:SS AM/PM. Characters - Some languages commonly require more than one keystroke to create a character. For example, the user may type 4 keystrokes and create 2 characters. This column shows the total number of characters typed. If this is selected, the Character tab appears in the Content pane below.

Content Pane - Keystrokes Filters add flexibility to how keystroke and character information is displayed in the Content pane. Both Keystroke and Character views are available by selecting the appropriate tab, and may be customized to include or exclude various types of keystrokes and characters. Select the Keystrokes tab to view all keystrokes typed. Keystrokes display in black. Formatted - In this view, keystrokes appear just as they look in the original document, retaining all formatting. By default, Show Start Time is turned on.

NOTE: If the Num Lock was ON when keystrokes were typed, numerals display. If the Num Lock was OFF when keystrokes were typed, navigation keys display, for example:

Raw - In this view, keystrokes appear as a continuous string that includes displayable keystrokes (letters, numbers and punctuation), non-displayable keystrokes (words appear for such keys as ), and words that were deleted due to backspacing. In addition, you can view keystrokes which may otherwise appear differently (such as an * when a password is typed). Keystrokes appear in ALL CAPS.

Custom - Click the small triangle next to Custom and the Custom Keystroke View window opens. Select which items you want to display in either the Formatted or Raw view. Choices include:

Show Displayable: When this box is checked, the Content pane displays numbers, letters, and punctuation. Show Non-Displayable: When this box is checked, the Content pane displays items such as , , and wherever they were pressed.

Show Words for Space / Enter / Tab: When this box is checked, the Content pane displays , and wherever they were pressed.

Process Backspace: When this box is checked, Spector Pro eliminates the keystrokes that were deleted because of backspacing, as well as the designation

Format Keystrokes: When this box is checked, the Content pane displays keystrokes in upper and lower cases, as typed in the original document. Font Size: Enter the font size in which you want the view displayed.

If you select only Show Displayable, Process Backspace and Format Keystrokes, the Custom view is identical to the Formatted view.

Content Pane - Characters Select the Characters tab to view all characters typed. This tab only appears if you have changed the Record Keystrokes profile to capture characters. Characters display in red. Formatted - In this view, characters appear just as they look in the original document, retaining all formatting. By default, Show Start Time is turned on. Raw - In this view, characters appear as a continuous string that includes displayable keystrokes (letters, numbers and punctuation), non-displayable keystrokes (for example, Shift, Backspace, Ctrl), words for Space / Enter /Tab, and words that were deleted by backspacing. Custom - Click the arrow next to Custom and the Custom Keystroke View window opens. Select which items you want to display in either the Formatted or Raw view. See Custom above.

NOTE: This tab is only visible IF Capture Character Information has been selected in Keystroke Settings, and if Character is selected as a column in the upper Event pane.

Toolbar The Keystrokes Typed toolbar contains the following shortcuts:

Group by - Use this to customize the display of recorded data in the upper event pane. You may select how data is grouped, and the order in which the groups appear in the tree. Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots.

Search Keystrokes Typed- Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria. You can search in both the keystroke and character mode.

Delete - Use Delete to remove one or more events.

Viewing Program Activity

Spector Pro records information about every program that runs on the monitored computer and every window where there has been keystroke or mouse activity. Programs that run in the background, or those visible in the system tray, are NOT recorded unless they are opened by the user to reveal a window. You can focus on how much time a program was ACTIVELY used. Spector Pro records all programs or just the ones you want to record. To limit programs recorded, see Application Settings.

Practical Uses

At home, control games - Your only concern is a certain video game that you don't want the youngest child to use. Monitor whether or not the rules are being followed.

At the office, determine productivity - Find out how a certain user is spending her time. By viewing a summary for a particular day or sequence of days, you can get an overview of the programs that were used the most and how much time was actually spent on them.

By default, Spector Pro captures program activity. To change default settings affecting what you see within this event window, see Program Activity Settings.

What Is Recorded? The Program Activity event window uses a Navigate, Detail, and Summary pane to display information. You may change how columns are arranged and sorted.

Navigate Pane (top) Each time a program is executed is one recorded event. Events are arranged in a hierarchy starting with date, unless you group the events differently.

Click on the plus (+) sign next to the Programs icon to expand the tree and view each date on which Program activity was recorded. Click a plus (+) sign next to a date to expand the tree and view each program executed.

Summary Pane (bottom)

Click the Summary tab to view totals, by Program, for the group selected in the Navigate tree. By selecting a group higher up or further down in the tree above, you display a wider or narrower view of events. For example, select the date Tue, Aug 29, to display totals for each program executed on that date.

Detail Pane (bottom)

Click the Details tab to view all data recorded for the event(s) selected in the Navigate pane. For example, select a program such as AOL Instant Messenger to display details for that program.

Summary Pane The Summary pane displays the following columns: Program Description – The name of the program (application) that was running when activity was generated. Active - The total length of time, presented as HH:MM:SS, that there was keyboard or mouse activity for each program or instance. The Active amount equals the Total amount minus the Inactive amount. The collective length of time appears in the column heading. Right-click the column headings and select any of these additional columns for display: User - The user logged in to Windows.

Computer - The name of the computer on which activity was recorded. Program - The name of the application (program) that was executed. File Path - The location of the program that was executed. Title - The name of the window in use when keystrokes and mouse activity was generated. Instance - Displays information for each time the program was executed, using the format HH:MM:SS - program name. Last Used - The last date and time there was activity for the program or program instance, using the format MM/DD/YYYY HH:MM:SS AM/PM. Total - The total length of time that the program or instance was open, presented as HH:MM:SS, whether it was in focus, active, or inactive. Focus - The total length of time, presented as HH:MM:SS, that the program or instance had the primary window focus.

Count – The total number of recorded events for each program or instance listed. Each recorded event displays in the Detail pane.

Details Pane By default the following columns are displayed in the Detail pane: Time – The date and time when activity started for the particular recorded event, using the format MM/DD/YYYY HH:MM:SS AM/PM. Program Description – The name of the program (application) that was running when activity was generated. Active - The total length of time, presented as HH:MM:SS, that the user was generating keystrokes or mouse activity during the particular recorded event. The Active amount equals the Total amount minus the Inactive amount. See Program Activity Settings. Title - The name of the window in use when keystrokes and mouse activity was generated. Right-click the column headings and select any of these additional columns for display: User - The user logged in to Windows. Computer - The name of the computer on which activity was recorded. Program - The name of the application (program) that was executed. Start - The date and time when activity started for the particular recorded event, using the format MM/DD/YYYY HH:MM:SS AM/PM. End - The date and time when activity ended for the particular recorded event, using the format MM/DD/YYYY HH:MM:SS AM/PM. Total – The total length of time that the event had the primary window focus, using the format HH:MM:SS. Focus - The total length of time, presented as HH:MM:SS, that the program or instance had the primary window focus. File Path - The location of the program that was executed.

Instance - Displays information for each time the program was executed, using the format HH:MM:SS - program.

Shortcuts The Program Activity event window contains the following shortcuts:

Group by - Click to rearrange data in the Navigate pane tree by changing the data grouping. You can change the hierarchy and how data is sorted.

Snapshot Context - Click to open a floating snapshot window that corresponds to a selected event. You can navigate through the snapshots to get an idea of the context within which the activity occurred, without leaving the event window you are currently in. Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.

Search Program Activity - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing User Activity

Spector Pro shows you when each user logs on to the computer, when the user is active and when the user stops being active. The User Activity view presents an easy-to-read summary graph that allows you to see, at a glance, patterns of behavior over a designated period of time.

Practical Uses

Keep an electronic time card - The activity and inactivity recorded about each user identifies exactly when the computer was in use each day and for how long for each user.

Find out if the system was manipulated - Spector Pro also identifies when and if a clock change took place, showing if an attempt has been made to manipulate the system time. If recording is interrupted for any reason, this information is also displayed.

By default, Spector Pro records all activity for all users who log in to the computer. To limit recording, alerting, or blocking by user, set up user profiles and adjust the settings for each.

What Is Recorded? Information displays in the lower Summary and Detail panes for the event(s) highlighted in the upper Navigate pane. You can arrange the columns and sort the data by column as you choose.

Navigate Pane (upper) Each user log-on is recorded as one event. Events are arranged in hierarchically, starting with date, unless you choose to group the events differently.

Click the plus (+) sign next to Users to expand the tree and view each month for which activity was recorded. Click a plus (+) sign next to a month to view weeks and then days on which activity was recorded.

Summary Pane (lower)

Click the Summary tab to view a graphic representation of activity during the time selected in the Navigate pane. For example, select a the Week of Jul 17 to display an activity graph for that week. Light blue indicates activity; dark blue indicates inactivity; a red icon indicates a clock change; a black icon indicates Spector Pro recording was interrupted.

Detail Pane (lower)

Click the Details tab to view all log-on, log-off and activity data recorded during the selected time period. For example, select Week of Jul 17 to display activity details for that week.

Summary Pane The Summary pane displays the following columns: Date - Date activity was recorded. Day - Day of the week activity was recorded. Graph - A graphical representation of the user's activity for the time period. The graph portion of the Summary displays these elements:

Options - Opens a box where you can select User Activity graph options. See below. Activity - The light blue marks time periods when the user was typing, scrolling, or using the mouse. Inactivity- The dark blue marks time periods when the user was not active. Clock Change - A red icon represents each point in time when the user attempted to change the clock. Recording Interrupted - A black icon represents each point in time when recording has been interrupted for any reason. Recording could be shut down because of anti-spyware, a program conflict, user tampering, at the user's request, or due to failure of the recorder to initialize correctly. 12 AM - 12 PM - Activity is presented in a 12-hour interval, starting with 12 AM. Right-click in the column heading area and select any of the following additional Summary columns for display: User - The user logged in to Windows. Computer - The name of the computer on which activity was recorded. Type - Type of activity marker: End Activity, End Inactivity, Logon, Start Activity, Start Inactivity. Logon - Time the user logged on to the computer. Active - Total time of activity per day. Inactive - total time of inactivity per day.

Summary Pane - Options The Graph Options for User Activity are:

Logon - Turn the display of Logon data on and off. Bright green shows the total time during which a user is logged on, whether they are active or inactive. Activity - Turn the display of Activity data on and off. Inactivity - Turn the display of Inactivity data on and off. Clock Change - Turn the Clock Change graphic on and off. Recording Interrupted - Turn the Recording Interrupted icon on and off. Days with No Activity - When checked, days when there is NO user activity are displayed so that there is a line for every day of the week. Start Hour / End Hour - Use the dropdown list to select a different Start or End Hour to limit the number of hours displayed. Shortening the number of hours increases the size of the columns. By default, hours are presented from 12:00 AM through 12:00 PM.

Details Pane The Details pane displays the following columns. Time – The date and time when the activity was recorded, using the format MM/DD/YYYY HH:MM:SS AM/PM. Type – The type of activity, for example Logon, Logoff, End Activity, Start Activity. Start - The time when activity began, using the format MM/DD/YYYY HH:MM:SS AM/PM. End - The time when activity ended, using the format MM/DD/YYYY HH:MM:SS AM/PM.. Total - The difference between the start time and the end time, in seconds. Right-click in the column heading area and select any of the following additional columns for display: User - Identifies which user was logged in to the computer, by his / her unique user name. Session ID - An internal ID. Session Start - Date and time that the computer was first logged into, using the format MM/DD/YYYY HH:MM:SS AM/PM.

Session Timeout - Indicates whether an unexpected log off occurred (Yes / No) and at what time. This is also indicated in the Summary graph as Recording Interrupted.

Shortcuts The User Activity event window contains the following shortcuts:

Group by - Use this to customize the display of recorded data in the Navigate pane tree. You may select how data is grouped, and the order in which the groups appear in the tree. Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.

Delete - Use Delete to remove one or more events.

Viewing Document Tracking

Document Tracking records creating, opening to write, renaming, printing, and deleting of files. You can choose where to track document activity: on local drives, network drives, and/or on drives mapped to removable storage devices (for example, CD/DVD drives, USB memory, zip drives). Track documents to find out if a private file has been copied or altered. This type of monitoring can also help you remember what you named and where you stored a file you were working on.

Practical Uses

At home, have you ever misplaced a file? - Renamed a file and can't remember the new name? Want to know if homework was really sent to the printer? Wondering if family financial information being copied, printed or deleted? Document Tracking helps answer these questions.

At the office, prevent theft - Intellectual property theft and the leaking of confidential company information has become an increasing security threat. Technology has made it relatively easy for almost any employee to copy important documents to removable media such as floppy disks, zip drives, CDs, DVDs, USB drives and memory sticks, or to print out these documents and transport them off company premises. The recording of document activity on a network drive can be a useful way of determining which user may have copied, deleted or modified an important network document.

By default, Document Tracking records all five types of document activity (creating, opening to write, renaming, deleting and printing) to any file device defined as being removable or to CDs / DVDs. To learn more about the settings that affect what you view in this window, configure activity on specific drives, or add filters, see Document Tracking Settings.

What Is Recorded? The Document Tracking event window uses a Navigate pane and a Details pane. Information displays in the lower Detail pane for the event(s) highlighted in the upper Navigate pane. You may change how columns are arranged and sorted.

Navigate Pane (upper) Each Create, Delete, Edit or Print activity is one Document Tracking event. Events are arranged hierarchically starting with date, unless you choose to group them differently.

Click on the plus (+) sign next to Document Tracking to expand the tree and view each date on which activity was recorded. Click a plus (+) sign next to a date to view each drive or device where document activity took place on that day. Expand the tree again to view each instance of a program where document activity took place on that drive or device.

Detail Pane (lower) Click the Details tab to view all data recorded for a Document Tracking event.

How many events are displayed depends on the group you select in the Navigate tree. For example, select the Document Tracking icon at the top of the tree to display details for all events recorded (within the currently loaded date range).

Details Pane The Details pane displays the following columns: Time – The time the activity occurred, using the format MM/DD/YYYY HH:MM:SS AM/PM. Program – The application (program) that was running and on which a specific activity was performed. File Name – The name of the file where the activity occurred. Drive Type – The type of device where the file activity occurred. The Drive Type may be Printer, Network, Removable, Local, CDROM, Other, and Unknown. Action - Create, Delete, Edit (opening to write or renaming), or Print. File Size – The size of the file where the activity occurred. Size is not provided for Printer activity. Full Path - The entire Windows file path used for the file activity. For print activity this includes the full name of the print device. For UNC files, the full UNC path is provided. Right-click in the column heading area and select any of the following additional columns for display: User - The user logged in to Windows.

Computer - The name of the computer on which activity was recorded. Media – A description of the type of file that was recorded. This is derived from the file extension and may not be available for all file types. For example, files with .doc extensions have a media type of document. The currently defined media types are Audio, Compressed, Document, Image, Application, Video, and Script. Drive - The letter assigned to the specific drive.

Shortcuts The Document Tracking event window contains the following shortcuts:

Group by - Use this to customize the display of recorded data in the Navigate pane tree. You may select how data is grouped, and the order in which the groups appear in the tree.

Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.

Search Document Tracking- Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing Keywords Detected

A “Keyword” is a word or phrase that you want Spector Pro to watch for in programs, Chat/IM conversations, email, web pages, or searches. You must create a list of keywords before Spector Pro can begin detecting and recording them. It is possible to increase the frequency of snapshots when a keyword is detected and to receive immediate notification about the keyword detected at any email address.

Practical Uses Use Keyword Alerts to find out immediately: If your credit card number or a password is being used by someone else If inappropriate web sites are being accessed If activity occurred concerning a sensitive file

What Is Recorded?

No keywords are defined when you first install Spector Pro, and no Keyword Alerts are recorded. You need to provide the "red flag" word or words. Spector Pro will then scan for your keywords in: Web URLs and domains Content of web sites Content of email and chat messages Content of keystrokes typed (following any edits or deletion) Names of domains and files in file transfers (uploads and downloads)

The Keywords Detected event window uses a Navigate / Detail and Summary pane design. Information displays in the lower Summary and Detail panes for the event(s) highlighted in the upper Navigate pane. You may change how columns are arranged and sorted. Each time a keyword is detected, an "event" is recorded, and you will be able to view data about the event. A Keyword Alert event captures: The keyword or phrase detected (for example, "online gambling") Application being used Date and time of detection

Type of activity in which the keyword was detected If you have requested Keyword Alerts Forwarding, an email is immediately sent to you with this information.

Navigate Pane (upper) Each time a keyword is detected in a new location or during a new activity, Spector Pro records a Keyword event. Events are arranged hierarchically starting with date, unless you choose to group the events differently.

Click the plus (+) sign next to Keywords to expand the tree and view each date on which activity was recorded. Click a plus (+) sign next to a date to view each keyword detected on that date.

Summary Pane (lower)

Click the Summary tab to view totals for events within the currently selected group in the Navigate pane. By selecting a branch further up or down the tree, you display totals for more or fewer events. For example, select a particular keyword, such as “drugs,” to view totals for that word on that day.

Detail Pane (lower)

Click the Details tab to view complete data for each keyword detected within the currently selected Navigate group. For example, to see ALL events, select the top-level Keywords icon in the Navigate pane. To see only the Keywords Detected on Fri, Aug 25, select that day in the Navigate pane.

Summary Pane The Summary displays the following columns: Keyword – The actual word that you added to the Keyword list and which was detected. Total – The total number of times the keyword was detected. Chat – The number of times the keyword was detected in a chat / IM conversation, sent or received. Web Address – The number of times the keyword was detected in a web address (URL). Web Site - The number of times the keyword was detected in a web page. Email - The number of times the keyword was detected in an email message, sent or received. Keystroke - The number of times the keyword was detected when it was typed into a document.

Right-click in the column area to display additional columns: Type - Where the keyword was found, for example Web Site, Keystroke, Email or Chat. First - The date and time of the first detection, using the format MM/DD/YYYY HH:MM:SS AM/PM. Last - The date and time of the last detection, using the format MM/DD/YYYY HH:MM:SS AM/PM.

Details Pane By default the following columns are displayed in the Detail pane: Time – The date and time when the keyword was detected and recorded, using the format MM/DD/YYYY HH:MM:SS AM/PM. Keyword – The actual word that you added to the Keyword list and which was detected. Type – Where the keyword was found, for example Web Site, Keystroke, Email or Chat. Text - If the Type is a web site, the URL where the keyword was detected. Otherwise, the keyword is repeated.

Shortcuts The Keywords Detected event window contains the following shortcuts:

Group by - Use this to customize the display of recorded data in the Navigate pane tree. You may select how data is grouped, and the order in which the groups appear in the tree.

Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.

Search Keywords Detected - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Viewing Network Activity

Spector Pro records information about every network connection made on the monitored computer, providing you with a complete overview of network usage. It lets you know which web sites are visited and how much data is transferred to and from those sites. Network Activity can only be accessed by selecting Window > Network Activity. There is no designation for it on the Viewer toolbar.

By default, Spector Pro does NOT capture Network activity. To learn about how to capture this data, and how it affects what you view in this window, see Network Activity Settings.

Practical Uses

After analyzing Network activity data, you may decide to block Internet access to TCP ports or domains, remove applications from computers, or tighten your company Internet use policy. Network activity helps you detect: The use of streaming audio / video, online gaming, and other potentially inappropriate programs. Productivity drains by monitoring which users are connecting to the Internet and when the connections are made, the Internet address they connected to, what TCP ports they use, and the amount of network bandwidth consumed by those connections Which users may be violating company policy by consuming network bandwidth with streaming media, file downloads, or other Internet activity. Security violations by listing which applications are connecting to the Internet. Which Internet resources are most often connected to, which may not be reflected in other Spector recording tools.

What Is Recorded? The Network Activity view uses a Navigate pane with Summary and Details to display events. Select a branch in the Navigate tree and view those events in the lower pane. Both the Summary and Details panes allow you to change how columns are arranged and sorted.

Navigate Pane (upper) Each network connection made is one recorded event. Events are arranged hierarchically starting with date, unless you choose to group the events differently.

Click the plus (+) sign next to Network to expand the tree and view the dates when activity was recorded. Click a plus (+) sign next to a date to expand the tree and view each domain where a connection was made on that date. Domains expand to subdomains.

Summary Pane (lower)

Click the Summary tab to view totals for all recorded events in the currently selected Navigate branch. By navigating up or down in the tree above, you display a wider or narrower view of events. For example, select Fri, Aug 25, to display totals for each network connection recorded on that date. Select a domain under Fri, Aug 25, to display only connections at that domain.

Detail Pane (lower)

Click the Details tab to view all data (listed below) for each recorded event within the currently selected Navigate branch. To see details for all Network Activity events, select the highest “Network” branch.

Summary Pane The Summary pane displays the following columns: Program - The name of the program that established the network connection. Domain - The name of the web site that was visited.

Port - The IP port used for the network connection. Connections - The total number of connections for the program listed. Sent - The total number of bytes sent for all connections made to the program listed. You can estimate the amount of bandwidth the connections used. Recv - The total number of bytes received for all connections made to the program listed. Duration - The total connection time from the beginning of the first connection to the end of the last connection to the program listed. Right-click in the column heading area to display additional columns: Protocol - Only TCP network traffic is captured. Subdomain - The subdomain (section of a web site) to which the network connection was made. First - The date and time when the first connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM. Last - The date and time when the last connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM.

Start Time is not always the actual time the network connection started. Network connections for events that begin on one day and continue past midnight into the next day, are broken up into two separate events.

For example, the first start time is when the Network activity begins recording and the end time is at 11:59:59 PM. The second Network activity connection starts at 12:00:00 AM and either ends again at 11:59:59 PM or when the connection ends. Last - The time, presented as MM/DD/YY HH:MM:SS AM/PM, when the last connection ended for the recorded event.

Details Pane The Details pane displays the following columns: Start - The date and time when the first connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM. Program - The name of the program that established the network connection. Subdomain - The subdomain (section of a web site) to which the network connection was made. IP - The IP address of the site where the connection was made. Port - The IP port used for the network connection. Connections - The total number of connections for the program listed. Sent - The total number of bytes sent for all connections made to the program listed. You can estimate the amount of bandwidth the connections used. Recv - The total number of bytes received for all connections made to the program listed. Duration - The total connection time from the beginning of the first connection to the end of the last connection to the program listed. Right-click in the column heading area to display additional columns:

End - The time when the last connection ended for the recorded event, using the format MM/DD/YYYY HH:MM:SS AM/PM. Protocol - Only TCP network traffic is captured. Domain - The name of the web site that was visited.

Shortcuts The Network Activity event window contains the following shortcuts:

Search Network Activity - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use Delete to remove one or more events.

Screen Snapshots

Viewing Snapshots

Spector Pro takes full-screen snapshots, very much like a surveillance camera. Use standard playback and browse controls to view a detailed visual history of exactly what was on the screen when the snapshots were taken. Intelligent triggers determine when a snapshot is to be taken: a web site loading, a page scrolling, a program starting, a window title changing, a left / right mouse click and the Enter key being pressed.

If you have disabled the recording of screen snapshots, when you click on the Screen Snapshots tab the following message appears:

You can still view past snapshot data. If you want to turn off this message so that it doesn't appear each time you go to view past snapshots, click Don't show me this message again and click OK to close the message box.

Practical Uses Screen snapshots help you:

Save important information when you are using the recorded computer. For example, you purchase a stock online and receive an order confirmation number. You can save the snapshot in a safe place.

Understand the context in which activities were performed. As a surveillance tool, Screen Snapshots provide a front row seat to exactly what was on a monitored computer screen. Watch your child looking at inappropriate content or working hard on a project for school. The exact nature of the web site visited is revealed.

Spector Pro automatically captures one Screen Snapshot every 30 seconds. Snapshots cease whenever activity stops and resume when any trigger occurs. You can change the rate and what "triggers" Screen Snapshots from the Screen Snapshot Settings. You can also configure a hotkey sequence that allows you to manually take a snapshot at any time.

What Is Recorded? Screen Snapshots graphically depict all activity that has occurred on the monitored computer. Because it is easy to accumulate a large number of snapshots (each one is a graphic file), there are tools available to help you manage the snapshot files including:

Filtering Snapshots Deleting Snapshots

Toolbar The Screen Snapshots toolbar includes play buttons and a number of special options. Playback Controls - These standard playback buttons allow you to control what you see in the slide presentation. They are visible in all three window sizes. Options include the green Play button. As soon as you click Play, the red Stop button replaces the Play button, and the Slow and Fast buttons replace the Back and Next buttons that were on either side of Play. Last and First buttons become inactive.

First - Click when the Viewer is "stopped" to move to the first snapshot available. Back - Click when the Viewer is "stopped" to back up one snapshot. Next - Click when the Viewer is "stopped" to move to the next snapshot. Last - Click when the Viewer is "stopped" to move to the last snapshot available. Green Play - Click to begin a slide-show presentation of all snapshots recorded, beginning with whatever snapshot is currently in view. The snapshots are presented one after the other, in sequential order, and stops when the most recent snapshot is reached. Red Stop - Click to stop the slide-show presentation of snapshots at any time. The Back and Next buttons are reactivated. Slow - Click during the slide-show presentation to decrease the speed of the presentation. Fast - Click during the slide-show presentation to increase the speed of the presentation.

Event Sidebar - Use this to toggle between showing and hiding the event sidebar. Delete All - Use Delete All to remove all snapshots.

Fit to View / Full Size - Use this button to toggle between the two sizes. Click Fit to View to see the entire snapshot in an adjusted window size. If your window is small, the entire snapshot is shrunk down to fit this view. Click Full Size if you want to return to a larger view of the snapshot, without changing the window size. Some of the snapshot may be cut off. Full Screen - Click to expand the view of a snapshot to fill your entire screen. Once this is selected, the following floating Snapshot Viewer toolbar appears. To exit the full screen mode and return to the previous mode (Full Size or Fit to View): click Exit Full Screen; press Esc; or click on the X in the upper right corner of the toolbar.

If you click the minimize icon on the Snapshot Viewer toolbar, you receive a message telling you that the toolbar will close and that the keyboard is still available to control the following activities: Press

Esc to exit the Full Screen mode; press Enter to start and stop playback; press left and right arrow keys to navigate through the snapshots one at a time.

Additional Toolbars The Screen Snapshots event window contains several unique toolbars: Event Sidebar - Shows a hierarchical tree view of the snapshots. The tree may be grouped by Web Sites, Keywords or Programs. When grouped by Web Sites, information can be sorted by Date, Domain, or Order Visited; when grouped by Keywords, information can be sorted by Location Found or Order Found; when grouped by Program, information can be sorted by Date or Program. Event Toolbar - The Event toolbar, hidden by default, has two separate parts: Internet - Lists each individual URL that was visited. The Event bar displays the day, date and time, and the actual URL (e.g., http://www.spectorsoft.com). Use the dropdown list to jump to the snapshot taken closest to when the site was first visited. Keywords - Lists each instance of a keyword detection. The Event bar displays the day, date and time, the specific keyword detected, and where it was found (e.g., Found in web page, web address, keystrokes). Use the dropdown list to jump to the snapshot taken closest to when the keyword was detected.

Frame Slider Bar - The slider, which appears below the Event bar, provides a quick way to browse through the series of snapshots that are currently available for viewing. Click to the right or the left of the timeline pointer to view snapshots in increments. Or, drag the slider to the right to move toward the end of the series and drag toward the left to move toward the beginning of the series.

Status Bar The status bar contains the standard items, as well as the items below, which indicate the action that triggered the snapshot.

Snapshot Trigger Status Bar Label

Take snapshots every . . . Seconds Timer

Website page is loaded URL

Website form is submitted HTTP POST

Program is loaded Prg Activation

Window title changes Title Changed

Window contents are scrolled Window Scroll

Left mouse button is clicked Mouse Click

Left mouse button is double-clicked Mouse Dbl Click

Right mouse button is clicked Mouse Right Click

Enter key is pressed Key Enter

Selected key is pressed Custom Keystroke

Snapshot hotkey combination Hotkey

Marking Snapshots

Spector Pro allows you to mark or "tag" screen snapshots for future action. There are three primary reasons why you would want to mark snapshots: It gives you the option of viewing ONLY the tagged snapshots instead of wading through all of them to find the ones you wish to view again. You can select a group of snapshots to save in a different file. You can choose a group of snapshots you want to delete.

Tagging and Untagging

To tag a snapshot:

1. Find and display the snapshot you want to tag. 2. From the menu bar select Edit > Tag or press the Spacebar. Note that the word Tagged appears in the middle of the Status Bar.

3. Once snapshots are tagged, you can delete, view or save only the set of tagged snapshots.

To untag a snapshot:

1. Display the tagged snapshot you want to "untag". 2. From the Viewer menu bar select Edit > Untag or press the Spacebar. Note that the word Tagged disappears from the middle of the Status Bar, indicating the snapshot is no longer in the set of tagged snapshots.

Finding and Filtering Snapshots

By default, Spector Pro captures one snapshot every 30 seconds and deletes the recorded snapshots after a specified number of days, or when the Maximum Data Size is reached, whichever occurs first. You can view all captured snapshots by using the snapshot playback and browse controls, but you can also limit which snapshots you view in several ways:

Filter by Programs – View only data from selected programs in the Spector Pro Viewer.

View Only Tagged Snapshots – Tag important snapshots and view only these.

Delete Snapshots - Delete snapshots that appear to be unimportant, saving disk space.

Save Snapshots - Save crucial snapshots as image or video files for future viewing.

Viewing Only Tagged Snapshots

To view only tagged snapshots:

1. As you browse through Screen Snapshots, tag the snapshots you want to mark for viewing by pressing the Spacebar. Snapshots stay "tagged" until you "untag" them.

2. From the menu bar select Edit > Tagged > Show Tagged Snapshots. Only those snapshots that were tagged are now available for viewing. Note that the Status Bar indicates a new total number of snapshots.

Example: Suppose there are 231 snapshots currently available for viewing. The numbers in the Status Bar reflect this total. Each snapshot has a frame number of 1 through 231, followed by / 231 (indicating that there are a total of 231 snapshots currently available for viewing).

You wish to re-review five of them later so you tag those five snapshots. The next day, follow steps 1 and 2 above. Only five snapshots are now available for viewing. Each snapshot has a frame number of 1 through 5, followed by / 5 (indicating that there are currently 5 snapshots available for viewing).

Finding Snapshots

To find snapshots taken on a date:

Try the following approaches: Scroll through the Internet drop-down list on the Event bar, where snapshots are listed by date, date and time, as well as by URL. Use the Frame Slider bar, which shows the day, date and time above the slider as you move it. Scroll through the Keyword drop-down list on the Event bar, which shows the day, date and time when specific keywords were detected. Refresh the Viewer (press F5) to a date range or a date to eliminate other data from the view.

To find snapshots taken within a program:

Select Data > Filter > Programs and hide all programs except the program you wish to view.

To find a snapshot associated with another event:

1. Open the view (Chat/IM, Web Sites Visited, Files Transferred, etc.) and search for the event you are interested in.

2. Select the individual event in the Events list or Details pane. 3. If it is available, press the Snapshot Context button on the view's toolbar for a quick look at available snapshots. See Snapshot Context.

4. Press the Jump to button and select Snapshots. This puts you in the same time frame within Screen Snapshots as the selected event in the other view.

Taking Snapshots Manually

Whether or not Record Screen Snapshots is turned ON, you can take snapshot of what is on the screen RIGHT NOW at the recorded computer. Do this by pressing the Snapshot hotkey sequence. As soon as you press these keys, Spector Pro adds a Screen Snapshot to its recorded data. The default hotkey sequence is Ctrl+Alt+Shift+P. You can change the sequence in Settings > Application.

To set up the snapshot hotkey sequence:

1. Click Settings to open the System Settings window. Select the Application panel. 2. Next to Snapshot Hotkey, click Change. The Snapshots Hotkey box opens.

3. Select any combination of Ctrl, Shift, Alt, and the Windows key. You must select at least 2 modifier keys.

4. Click in the Regular Key text box and type any letter or digit. 5. Click OK to accept your selections, or Cancel to reject them. 6. Click OK at the bottom of the Settings window to save the changes you have made.

Make sure that the new hotkey sequence does NOT conflict with any Windows keyboard shortcuts or any other Spector Pro hotkey sequence.

Saving Snapshots

Saving Screen Snapshots as image or movie files allows you to view them with another program, share them with others, insert them in a document, or keep them for future reference. You can save a single or a series of consecutive or tagged snapshots. The result is either a collection of image files (in .bmp or .jpg format) or a "movie" (in .avi video format) that reveals a user's activity.

File Names When you save a series of snapshots as a movie, one movie file is created with the base name (or name you specify). When you save a series of snapshots as image files, all snapshots take the base file name with an added snapshot number. For example, if you save 10 snapshots with the base name Snapshot0825, the snapshot files will be named Snapshot0825-1.jpg, Snapshot0825-2.jpg, and so on up through Snapshot0825-10.jpg. If you change the base name from Snapshot0825 to Thursday0825, all snapshots retain the new name.

Snapshots are numbered according to their place in the Screen Snapshot view sequence. This number appears in the Status Bar. If you tag and save snapshots 17, 35, 36 and 48, they are named Snapshot0825, followed by 17, 35, 36, and 48. If you select View > Show Tagged Snapshots before saving, the snapshots are renumbered. For example, if you tag snapshots 17, 35, 36, and 48, view only the tagged snapshots, and then save, the snapshots are renumbered as 1 through 4 and named Snapshots0825-1 through Snapshots0825-4.

Saving Images and Videos

To save one snapshot as an image file:

1. Navigate to the Screen Snapshot window and find the specific snapshot you want to save. 2. Select File > Save As from the menu bar. The Save Snapshots window opens.

Save As - The default format is an image file. Leave this when you are saving an individual snapshot.

Snapshots to Save - Current is selected. Leave this to save the snapshot currently displayed.

Filename - The default location is your My Documents folder with a filename using today's date and the frame number found in the Status Bar. To change the location or file name, click the ... button. An Export To window opens allowing you to navigate to where you want to store the file and to change the file name, if desired.

File Format - The default selection is a JPEG (image) file with the file extension of .jpg. You can change this to a Bitmap image file with a file extension of .bmp, but the file size is considerably larger. 3. Click Save to store the image of the snapshot.

To save any tagged snapshots as image files:

1. In the Screen Snapshots view, tag each snapshot that you want to save. 2. Select File > Save As from the menu bar. The Save Snapshots window opens.

Save As - Leave the Image(s) selection to save tagged snapshots as separate images.

Snapshots to Save - Select Tagged to save all tagged snapshots.

Filename - Use the ... button to select a location and type a new base filename, if you wish.

File Format - Leave the JPG selection or select the larger BMP (bitmap) format.

3. Click Save to store the snapshots. Each tagged snapshot is saved as a separate image file.

To save a range of snapshots as image files:

1. In the Screen Snapshots view, find the range of snapshots you want to save, and note the frame numbers of the first and last snapshot in the series. 2. Select File > Save As from the menu bar. The Save Snapshots window opens.

Save As - Leave the Image(s) selection to save tagged snapshots as separate images.

Snapshots to Save - Select Selected Range to save the consecutive series of snapshots.

Snapshot #: Enter the frame number of the first snapshot in the series, either by typing or by using the up and down arrows.

to Snapshot #: Enter the frame number of the last snapshot in the series, either by typing or by using the up and down arrows.

Filename - Use the ... button to select a location and type a new base filename, if you wish.

File Format - Leave the JPG selection or select the larger BMP (bitmap) format from the dropdown list. 3. Click Save to store the snapshots. Each snapshot in the series is saved as a separate image file.

To save any snapshots as a video file:

1. In the Screen Snapshots view, tag each snapshot that you want to save, or select a range of snapshots as described above. 2. From the menu bar select File > Save As. The Save Snapshots window appears.

Save As - Select Video to save the series of snapshots as a video clip.

Snapshots to Save - Click Tagged or All or Selected Range (and enter the start and end frame numbers).

Filename - Use the ... button to select a location and type a new filename, if you wish.

File Format - When you selected Video, the default file extension became .avi. 3. Click Save. The Video Compression window opens.

Compressor - The default .avi file is full frame and uncompressed. Use the dropdown list to select a type of compressor. The list includes the compressors (codecs) that are installed on your PC.

Quality - If a type of compressor is selected, you must also choose the compression quality, a setting which affects how the saved snapshots will look. The available range is 0 through 100. By default, the .avi file is saved with a quality of 100.

Configure - If this button appears, there are additional options available for the particular codec selected. See the Help for that codec.

4. Click Save to store the video clip of snapshots.

Deleting Snapshots

If there are one or more snapshots that you no longer want to keep, you can easily delete them. If storage space is an issue, consider backing up or deleting data files. Spector Pro provides for several kinds of deletions. You can: Delete a single snapshot Delete tagged snapshots - perhaps you want to delete more than one snapshot at a time, but the snapshots you want to delete are not consecutive. You can "tag" or mark any snapshot that is captured and then delete only those which are tagged. Delete a range of consecutive snapshots - snapshots are numbered consecutively, in the order in which the snapshots were taken (the frame number). Delete all snapshots simultaneously. Select File > Delete All Recordings to delete every activity and snapshot that has been recorded.

Once snapshots have been deleted, they cannot be retrieved. Make sure when you delete snapshots you no longer need them.

To delete a single snapshot:

1. Open the Screen Snapshot view and find the snapshot you want to delete. 2. To delete the snapshot:

Right click and select Del from the dropdown list, OR

Select Edit > Delete from the menu bar.

A confirmation message appears, asking you if you want to delete the selected item. 3. Click Yes to delete the snapshot, or No to cancel the deletion and close the window.

To delete tagged snapshots:

1. Open the Screen Snapshot view.

2. Tag each snapshot you want to delete. 3. To delete the tagged snapshots select Edit > Delete All Tagged (this selection only appears when you have tagged one or more snapshots). A confirmation message appears asking if you want to delete the tagged items. 4. Click Yes to complete the deletion, or No to cancel it and close the window.

To delete a range of snapshots:

1. Open the Screen Snapshot view. 2. Find the range of snapshots you want to delete, and note the frame numbers of the first and last snapshot in the series.

3. From the menu bar select Edit > Delete Range. The Delete Snapshots Range window appears:

Start of range - Enter the frame number of the first snapshot in the series.

End of range - Enter the frame number of the last snapshot in the series.

4. Click OK to delete the range of snapshots. A confirmation message appears asking if you want to do this. 5. Click Yes to delete the range of snapshots, or No to cancel it and close the window.

To delete ALL snapshots:

1. Open the Screen Snapshot view. 2. To delete the snapshots:

Select Edit > Delete All from the menu bar, OR

Click Delete All on the toolbar. A confirmation message appears asking if you are sure you want to delete all the snapshots. 3. Click Yes to delete all currently recorded snapshots, or No to cancel the deletion and close the window.

Top 10

Top 10 Reports

Views under the Top 10 tab display summary information on the activities engaged in most often. Use these reports to identify trends, and then jump to the corresponding All Recordings view for further details. Select from the list below to learn more about each Top 10 window.

Chat / IM Activity

Online Searches

Web Sites Visited

Email Activity

Program Activity

Keywords Detected

Top 10 Chat / IM Activity

Who are they chatting with all of the time? The Top 10 Chat / IM Activity window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding these conversations, and presents the people most frequently chatted with over the course of the date range of your choice. From here, you can view content details, and even block a contact name if you so choose.

Click here to view which chat / IM applications are recorded.

What Is Recorded?

You may arrange columns and sort the data in any column as you like. The following information is displayed: Rank - A number representing a placement of the recorded event within the range of 1 through 10, with 1 being the person most frequently chatted with. Chatted With - The name of each person who has sent or received a Top 10 conversation. Total Chats / IMs - The total number of chats / IMs each person on the list has sent or received. Programs Used - The programs used to send or receive the conversation. View Details - Click this button next to a specific event, or double-click on the event to jump to the Chat / IM Activity event window within All Recordings and view more details. The event will appear in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Chat / IM Activity window.

Block Chat / IM - Click the Block Chat / IM button to discontinue access to a particular person chatted with. NOTE: If you are viewing recorded events from a Viewer Only computer, this button does not display.

Shortcuts The Top 10 Chat / IM Activity window contains the following shortcuts, including date range buttons that allow you to view information within a specific time period.

Show TOP 10 - Your only choice is to view the Top 10 People Most Frequently Chatted With. All - Click to view all Top 10 recorded events available.

Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days. Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice. a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar. b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

Top 10 Online Searches

What are they always looking for online? The Top 10 Online Searches window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding online searches, and presents the most frequently searched for words and phrases, over the course of the date range of your choice. From here you can go on to view more details if you so choose.

What is Recorded?

You can arrange the columns and sort the data based on any column as you choose. The following information is displayed: Rank - A number representing a placement of the recorded event within the range of 1 through 10, with 1 being the most frequently searched for word or phrase. Search Word / Phrase - The word or phrase used in the Top 10 search. Total Online Searches - The number of times a search was actually made. Search Sites - The web site that the online search was pointing to. Details - Click the View Details button next to a specific event, or double-click on the event to jump to the Online Search event window within All Recordings and view more details. The event will appear in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Online Search window.

Shortcuts The Top 10 Online Searches window contains the following shortcuts:

Show TOP 10 - Your only choice is to view the Most Frequently Searched for Words. All - Click to view all Top 10 recorded events available. Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days. Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice.

a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar. b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

Top 10 Web Sites Visited

I know they're online to do homework, but which web sites are they really visiting? The Top 10 Web Sites Visited window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding web sites visited, and presents the web sites most frequently visited and the web sites where the most time is spent, over the course of the date range of your choice. From here you can go on to view more details, access the actual web site, or block it if you so choose.

What Is Recorded?

You can arrange the columns and sort the data based on any column as you choose. The following information is displayed: Rank - A number representing a placement of the recorded event within the range of 1 through 10, with 1 being the most visited web site or the one where the most time was spent. Web Site Domain - The domain of the web site, for example, google.com. Times Visited / Time Spent - The number of visits made at each web site listed, OR the amount of time spent on each web site listed in HH:MM:SS format, depending on which item was selected from the Show Top 10 dropdown list. View Details - Click this button next to a specific event, or double-click on the event to jump to the Web Sites Visited event window within All Recordings and view more details. The event will appear

in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Web Sites Visited window.

Block Web Site - Click the Block Web Site button to discontinue access to a particular person chatted with. NOTE: If you are viewing recorded events from a Viewer Only computer, this button does not display.

Shortcuts The Top 10 Web Sites Visited window contains the following shortcuts:

Show TOP 10 - Choose from: Web Sites Where the Most Time Was Spent - Use the dropdown list to select this if you want to view the Top 10 web sites where the most amount of time was spent. Most Frequently Used Programs - Use the dropdown list to select this if you want to view the Top 10 web sites visited most frequently. All - Click to view all Top 10 recorded events available. Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days. Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice. a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar. b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

Top 10 Email Activity

Who are they emailing all of the time? The Top 10 Email Activity window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding email messages, and presents the people from whom email is most frequently received, and to whom email is most frequently sent, over the course of the date range of your choice. From here you can go on to view content details if you so choose.

Click here to see which email applications are recorded.

What is Recorded?

You can arrange the columns and sort the data based on any column as you choose. The following information is displayed: Rank - A number representing a placement of the recorded event within the range of 1 through 10, with 1 being the person most frequently communicated with. Email Address - The email address of each person who has sent or received a Top 10 message. If available, Spector Pro displays the friendly name rather than the address. If more than one friendly name is available, all are displayed. Total Emails Sent / Received - The number of email messages sent to or received from each person on the list, depending on which item was selected from the Show Top 10 dropdown list. Program Used - The program used to send or receive the conversation. View Details - Click this button next to a specific event, or double-click on the event to jump to the Email Activity event window within All Recordings and view more details. The event will appear in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Email Activity window.

Shortcuts The Top 10 Chat / IM Activity window contains the following shortcuts:

Show TOP 10 - Choose from: People Email Was Sent To - Use the dropdown list to select this if you want to view the Top 10 people to whom emails were sent.

People Email Was Received From - Use the dropdown list to select this if you want to view the Top 10 people from whom emails were received. All - Click to view all Top 10 recorded events available. Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days. Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice. a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar. b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

Top 10 Program Activity

What are they doing all of the time? The Top 10 Program Activity window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding program activity, and presents the program most frequently executed and the programs on which the most time is spent, over the course of the date range of your choice. From here you can go on to view more details if you so choose.

What is Recorded?

You may arrange columns and sort the data any way you like. The following information is displayed: Rank - A number representing a placement of the recorded event within the range of 1 through 10, with 1 being the most used. Programs - The name of each Top 10 program. Times Used / Time Spent - The number of times each program was opened, OR the amount of time spent on each program listed in HH:MM:SS format, depending on which item was selected from the Show Top 10 dropdown list. View Details - Click this button next to a specific event, or double-click on the event to jump to the Program Activity event window within All Recordings and view more details. The event will appear in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Program Activity window.

Shortcuts The Top 10 Program Activity window contains two shortcuts:

Show TOP 10 - Choose from: Programs Where the Most Time Was Spent - Use the dropdown list to select this if you want to view the Top 10 programs where the most amount of time was spent. Most Frequently Used Programs - Use the dropdown list to select this if you want to view the Top 10 programs most frequently opened. All - Click to view all Top 10 recorded events available. Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days.

Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice. a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar. b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

Top 10 Keywords Detected

You want to get a look at which keywords have been detected and when? The Top 10 Keywords Detected window allows you to quickly spot trends in this area. Spector Pro looks at the all of the recorded data regarding keywords detected, and presents the keywords most frequently detected, over the course of the date range of your choice. From here you can go on to view content details if you so choose.

What is Recorded?

You may arrange columns and sort data any way you wish. The following information is displayed: Rank - A number representing placement of the recorded event within the range of 1 through 10, with 1 being the keyword most frequently detected. Keyword Detected - The actual key word(s) most frequently detected in a chat / IM, email, URL, or web site. Total – The total number of times the keyword was detected. Chat – The number of times the keyword was detected in a chat / IM conversation, sent or received. Web Address – The number of times the keyword was detected in a web address (URL).

Web Site - The number of times the keyword was detected in a web page. Email - The number of times the keyword was detected in an email message, sent or received. Keystroke - The number of times the keyword was detected when it was typed into a document. View Details - Click this button next to a specific event, or double-click on the event to jump to the Keywords Detected event window within All Recordings and view more details. The event will appear in a Search Results window. Click Exit Search Results to leave the Search Results window and view all events in the Keywords Detected window.

Toolbar Shortcuts The Top 10 Keywords Detected window contains two shortcuts:

Show TOP 10 - Your only choice is to view Keywords Detected. All - Click to view all Top 10 recorded events available. Last 30 Days - Click to view the Top 10 recorded events from the previous 30 days. Last 7 Days - Click to view the Top 10 recorded events for the previous week. Last 2 Days - Click to view the Top 10 recorded events for the previous two days. Custom - Use this to enter the date range of your choice. a. Click Custom to display From and To fields, and a Calendar icon next to each field on the toolbar b. Click the Calendar icon to the right of From. A calendar for the current month appears with today's date circled in red at the bottom, and the earliest date for which activity has been recorded circled in solid blue. c. Navigate through the months using the left arrow to move to the previous month, and the right arrow to move to the next month. d. Click on a date in the calendar; the window closes and the newly selected date appears in the From field on the toolbar. e. Repeat the above steps for the To field. f. The new dates appear in the From and To fields on the toolbar, and the data displayed on the window changes to reflect the newly selected date range.

MySpace

MySpace Activity

The views provided under the MySpace Activity tab display information only about activity recorded at MySpace.com. A rage among computer users of all ages, the MySpace web site connects users with new contacts, promising to extend their network of "friends" to ever-widening circles. Select from the list below to learn more about each of the four views of MySpace activity.

Viewing MySpace Snapshots

Viewing the MySpace Report

Viewing MySpace Messages

Viewing MySpace Chat / IMs

The MySpace tab appears only if MySpace activity has been recorded. To view the MySpace panels at any time, open the Window menu and select MySpace Activity. See View Options for further information.

Viewing MySpace Snapshots

Want to see exactly what they see on MySpace? Spector Pro looks at all recorded snapshots and displays only MySpace snapshots on the MySpace Snapshots window. Use standard playback controls to view a detailed visual history of exactly what was on the screen when the snapshots were taken. This view is exactly the same as the Screen Snapshots view.

NOTE: Both Screen Snapshots and MySpace Snapshots maintain their own settings. For example, you can tag a range of snapshots in Screen Snapshots and select View > Show Tagged Snapshots. This does not affect the snapshots displayed in MySpace Snapshots.

Viewing Snapshots Filtering Snapshots Marking Snapshots Saving Snapshots Deleting Snapshots

The MySpace Snapshot window is also affected by Screen Snapshot Settings.

Viewing the MySpace Report

The MySpace Report window provides summary information about various MySpace activities. There are five sections, as shown below. Click a View button to open your browser and visit the relevant location on MySpace. For additional information on each section, visit:

MySpace Accounts Top 10 Messages Received Top 10 Messages Sent Top 10 Profiles Visited Summary

Report - MySpace Accounts

If there are multiple users on the computer, you may see more than one account displayed here. Or, a MySpace user may have more than one account on MySpace, perhaps each with a different "persona." Use the date range shortcut buttons to view account information for a specified time period. If one or more accounts were opened after the specified dates, or closed before the specified dates, they do not display. All - Click to view information for all available dates. Last 30 Days - Click to view information for the past 30 days. Last 7 Days - Click to view information for the past week. Last 2 Days- Click to view information for the previous two days. Custom - Click to display From and To fields and a calendar icon on the toolbar. Click the calendar icon to open the Custom Date Range window. Use the dropdown lists to access a calendar and select From and To dates. Click OK to close the window. The selected dates display in the From and To fields on the toolbar. Top 10 and Summary information in the other four sections of this Report window are totals for all MySpace accounts that are currently displayed in the MySpace Accounts section.

This section of the report contains the following information for each MySpace account: Email address and password used to create the account and with which the user identifies him / herself when logging in to MySpace. View Profile button opens your browser and brings you directly to the "home page" for the MySpace account holder, also known as the profile. The profile may include pictures of the account holder as well as information about him / her, pictures of the account holder's "friends" on MySpace which act as links to their profiles, links to MySpace chat rooms and blogs, comments from friends about the profile, and much more. Some of the links on the profile page will require that you are logged in. View Pictures button opens your browser and brings you directly to the Member Login window. Enter the password and click Login to access all pictures of the account holder that have been placed in MySpace.

View Blogs button opens your browser and brings you directly to a blog created by the account holder. View Friends button opens your browser and brings you directly to pictures of all designated MySpace"friends."

View Comments button opens your browser and brings you directly to the Member Login window. Enter the password and click Login to access all comments received from MySpace friends. View Mail button brings you directly to the MySpace Member Login window. Enter the appropriate password and click Login. You will enter the account holder's Mail Center Inbox, from which you can view all messages received. Click the various buttons in the window to view messages Sent, Saved, Address Book, and more. Login button brings you to the Login window. Enter the appropriate password and click Login to access MySpace as the account holder. From here you can function as if you were that account holder.

Report - Top 10 Messages Received

The Top 10 information in this section includes data from all accounts that may exist on MySpace. Use the date range shortcut buttons to view information for a specified time period.

This section of the report contains the following for the 10 MySpace friends from whom the most emails have been received: Received From lists the MySpace friend by profile "name." Click the View Messages button for a MySpace friend in the list to display a Search Results list in the MySpace Message window. All of the messages received from that friend are listed, along with other important information such as the date and time, and Subject line. Click Exit Search Results to view all events on the MySpace Messages window. Messages received from and messages sent to that particular MySpace friend appear at the top of the list. Click on any one to view the contents of the message in the lower pane. Click the View Profile button for a MySpace friend in the list to open your browser and jump directly to the "home page" for that account holder.

Report - Top 10 Messages Sent

The Top 10 information in this section includes data from all accounts that may exist on MySpace. Use the date range shortcut buttons to view information for a specified time period.

This section of the report contains the following for the 10 MySpace friends to whom the most email messages have been sent: Sent To lists the MySpace friend by profile "name." Click the View Messages button for a friend in the list to display a Search Results list in the MySpace Message window. All of the messages sent to that friend are listed, along with other important information such as the date and time, and Subject line. Click Exit Search Results to view all events on the MySpace Messages window. Messages sent to and received from that particular MySpace friend appear at the top of the list. Click on any one to view the contents of the message in the lower pane. Click the View Profile button for a MySpace friend in the list to open your browser and jump directly to the"home page" for that account holder.

Report - Top 10 Profiles Visited

The Top 10 information in this section includes data from all accounts that may exist on MySpace. Use the date range shortcut buttons to view information for a specified time period.

This section of the report contains the following information about the 10 profiles or "home pages" most frequently visited: Profile Visited lists the MySpace friend by profile "name." Time Visited lists the total hours, minutes and seconds spent visiting each friend's profile.

View Profile button for each MySpace friend in the Top 10 Profiles Visited list. Click a button to open your browser and access that friends' profile in MySpace.

Report - MySpace Summary

The Summary information in this section includes data from all accounts that may exist on MySpace. Use the date range shortcut buttons to view information for a specified time period.

This section of the report contains the following summary information: Total MySpace Time indicates the total hours, minutes and seconds spent in MySpace for the indicated date range. Invitations Sent indicates the total number of "invitations" to become a "friend" sent by the account holder. Invitations Accepted indicates the total number of invitations received by the account holder and accepted. Invitations Denied indicates the total number of invitations received and denied. Group Postings indicates the total number of postings to one of the MySpace groups. Blog Postings indicates the total number of posting to one of the MySpace blogs.

Viewing MySpace Messages

Want to see exactly who and what they're emailing on MySpace? Spector Pro looks at all recorded email data and presents only MySpace activity on the MySpace Messages window.

This window is very similar to the Email Activity window. It is also affected by Email Activity Settings.

What Is Recorded? The MySpace Messages window uses an Event pane / Content pane design.

Event Pane (upper) - Each email sent or received is listed as one recorded event.

Content Pane (lower) - The Content pane displays the actual email message for the event highlighted in the Event pane.

Event Pane

Recorded information is listed in the upper Event pane. You may arrange and sort the information in the columns. The following columns appear in the upper Event pane: Time - The date and time when Spector Pro recorded the email, NOT the date and time the email was sent or received on the monitored computer. Type - Includes Send Message, Incoming Web or Create Blog. In / Out - Indicates whether the email was incoming or outgoing from the monitored PC. From - The person who sent the email. Their email address is listed in the To column. To - The person to whom an outgoing email was addressed. Click on the Profile button or double-click anywhere on the event to open your browser and jump to this person's profile. Subject - The title (subject) of the email assigned by the sender.

Content Pane Content of the selected message appears in the lower pane.

Toolbar Shortcuts Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

MySpace Chat/IM

Want to see what's going on with all the chat on MySpace? Spector Pro looks at all recorded Chat/IM data and presents only MySpace activity on the MySpace Chat / IM Activity window. This window is exactly the same as the Chat/IM Activity event window. It is also affected by Chat/IM Activity Settings.

The Chat / IM Activity event window uses the Event pane / Content pane design.

Event Pane (upper) - Each chat / IM session is listed as one recorded event. Double-click on an event to open a Chat / IM Conversation window, which displays the actual conversation. From this window you can Print, Save, or Copy the information and use Back and Next to view the next conversations in the Events list. To save a conversation: a. Select File > Save As. On the Save As window that appears enter a path, file name and format (you can use rtf or txt) b. Click Save. If you save the event as an rtf file, a Word document is created. If you save the event as a .txt file, a text document is created, containing all event

data and the conversation.

Content Pane (lower) - The Content pane displays the actual chat or IM conversation for the event highlighted in the Event pane.

Event Pane

Recorded information is listed in the upper Event pane. You may arrange and sort the information in the columns. The following columns appear in the upper Event pane: Time - The date and time when the chat / IM was recorded. Sign On Name - How the user identifies him / herself in this chat or IM conversation. Chatted With - How the person chatted with identifies him / herself. Participants - Indicates the number of participants in the chat room when the conversation was recorded. Additional standard columns and the following data column are also available. Right-click the column headings to select these columns. Protocol - The underlying language used by the chat IM program to allow the session.

Content Pane Content of the conversation from all participants appears in the lower pane for the selected event.

Toolbar Shortcuts The MySpace Chat / IM Activity window contains the following shortcuts:

Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

Block Chat/IM - Use this button to block access to a particular person chatted with.

Search Chat / IM Activity - Use the Search shortcut to locate specific information quickly. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use the delete shortcut to delete one or more events.

Facebook

Facebook Activity

Facebook is a popular social networking web site initially used by students at universities and colleges. Now anyone 13 or older may join. Select Spector Pro's Facebook tab to open three views of activities taking place on the Facebook social networking site.

Viewing Facebook Snapshots

Viewing the Facebook Report

Viewing Facebook Messages

Viewing Facebook Chat/IM

The Facebook tab appears ONLY if Facebook activity has been recorded. To view the Facebook panels at any time, open the Window menu and select Facebook Activity. See View Options for further information.

Viewing Facebook Snapshots

Spector Pro lets you see exactly what has been happening on Facebook with snapshots on the Facebook Snapshots window. Use standard playback controls to view a detailed visual history of exactly what was on the screen when the snapshots were taken. This window is exactly the same as the Screen Snapshots window.

NOTE: Both Screen Snapshots and Facebook Snapshots maintain their own settings. For example, you can tag a range of 10 snapshots in Screen Snapshots and select View > Show Tagged Snapshots. This does not affect the snapshots displayed in Facebook Snapshots.

Viewing Snapshots

Filtering Snapshots

Marking Snapshots

Saving Snapshots

Deleting Snapshots

The Facebook Snapshot window is also affected by Screen Snapshot Settings.

Viewing the Facebook Report

The Facebook Report window provides summary information about various Facebook activities. There are five sections, as shown below. Click a View button to open your browser and visit the relevant location on Facebook. For additional information on each section, visit:

Facebook Accounts

Top 10 Messages Received

Top 10 Messages Sent

Top 10 Profiles Visited

Summary

Shortcuts The Facebook Report window contains the following shortcut:

Date Range Buttons - Click on the appropriate shortcut button to view information for the specified time period:

All - Click to select all available dates. Last 30 Days - Click to select the last 30 days. Last 7 Days - Click to select the past week. Today - Click to select today only. Custom - Click to display From and To fields where you can enter the date range of your choice. Click the Calendar icon to select any date from the Custom Date Range box.

NOTE: The date range defaults to All each time you open the Viewer. If you change it to one of the other selections, your new date range will persist as long s the Viewer is open.

Report - Facebook Accounts

The Facebook Report shows information about the user's Facebook account. If there are multiple users on the computer, or if a user has multiple Facebook accounts, more than one account will be displayed in this section. Other sections of the Report - Top 10 and Summary information - total the activity from all these accounts. Use the Date Range Buttons to view information for a specified time period. Accounts not accessed during the time period will not appear.

This section of the report contains the following information for each Facebook account: Login Email is the email used to create and to log in to the Facebook account. Password spells out the password used to log in to Facebook. Login button opens an Internet browser and logs into Facebook using the Facebook account information listed. From inside the Facebook account, you have access to all Facebook features, messages, pictures, friends, and everything else on Facebook.

Facebook Top 10 Messages Received

The Facebook Report displays the Top 10 Facebook friends from whom messages have been received. Use the Date Range Buttons to expand, narrow, or change the time period reported.

Received From lists each Facebook friend by profile name and account number. # of Messages shows how many messages were received from each Facebook friend. Click the View button in this column to automatically search Facebook Messages for this friend. All messages received from the friend are displayed in the Search Results under Facebook Messages, and you can read the contents of each message. Profile provides a column for a View button that you can click to open an Internet browser directly to the Profile page for that Facebook account holder.

Facebook Top 10 Messages Sent

The Facebook Report displays the Top 10 Facebook friends to whom messages were sent. Use the Date Range Buttons to expand, narrow, or change the time period reported.

The list may include up to 10 friends and includes: Sent To lists the Facebook friend by profile name and account number. # of Messages shows how many messages were sent to the Facebook friend. Click the View button in this column to automatically search Facebook Messages for this friend. All messages received from the friend are displayed in the Search Results under Facebook Messages, and you can read the contents of each message. Profile provides a View button that you can click to open an Internet browser directly to the Profile page for this Facebook account holder. This allows you to see all information at the friend's Facebook site.

Facebook Top 10 Profiles

A Facebook "profile" is a person's home page on Facebook. The Facebook Report displays the Top 10 profiles visited in Facebook. Use the Date Range Buttons to expand, narrow, or change the time period reported.

This section of the report lists up to 10 profiles visited, in order of time spent at each profile:

Profile Visited lists the Facebook friend by name and Facebook account ID. Time Visited lists the total hours, minutes and seconds spent visiting each friend's profile. This includes multiple visits to a profile. Profile provides a View button for each Facebook friend in the Top 10 Profiles Visited list. Click a button to open a browser to that friends' profile in Facebook.

Facebook Summary

The Facebook Report displays Summary information from all Facebook accounts that might have been accessed during the time period. Use the Date Range Buttons to change the time period.

The Summary section gives an overview of time spent on Facebook: Total Facebook Time totals the amount of time spent on Facebook by all listed accounts. Profiles Visited displays the number of Facebook Profiles the person you are monitoring visited during the selected time period.

Viewing Facebook Messages

Spector Pro captures all messages sent and received from Facebook. The Facebook Messages panel presents only communication happening on the Facebook social network. Facebook messages also appear in Email Activity, and the Facebook Messages panel is similar to Email Activity and is affected by Email Activity Settings.

What is Recorded? The Facebook Messages window uses an Event pane / Content pane design. Recorded information is listed in the upper Event pane. You can arrange and sort the columns as you wish.

Event Pane (upper) - Each email sent or received is listed as one recorded event.

Content Pane (lower) - The Content pane displays the actual email message for the event highlighted in the Event pane.

Event Pane By default the following columns are displayed in the upper Event pane. Time - The date and time when Spector Pro recorded the email, NOT the date and time the email was sent or received on the monitored computer. Type - Can be Incoming Web or Outgoing Web. In / Out - Indicates whether the email was incoming or outgoing from the monitored PC. From - The person who sent the message. Either the email address or the Facebook name is listed next to the Facebook ID number. To - The person who received the message. Either the email address or the Facebook name is listed next to the Facebook ID number. Subject - The message subject line.

Content Pane The lower pane displays contents of the selected message.

Options and Status Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

The menu bar is specifically customized for Facebook email activity. The status bar at the bottom of the Spector Pro window shows the total number of messages, the current user, the program being used and the date and time.

Viewing Facebook Chat/IM

Spector Pro presents only Facebook activity on the Facebook Chat / IM Activity view. This window is exactly the same as the Chat/IM Activity event window. It is also affected by Chat/IM Activity Settings.

What is Recorded? The Chat / IM Activity event window uses the Event pane / Content pane design.

Event Pane (upper) - Each chat / IM session is listed as one recorded event.

Double-click on an event to open a Chat / IM Conversation window which displays the actual conversation. From this window you can Print, Save, Copy the information or use the Back and Next buttons to review the next conversations in the Events list. To save a conversation: a. Click Save As. On the Save As window that appears enter a path, file name and format (you can use rtf or txt). Click Save. If you save the event as an .rtf file, you will be able to open the file in Microsoft Word.

Content Pane (lower) - The Content pane displays the actual chat or IM conversation for the event highlighted in the Event pane.

Event Pane

Recorded information is listed in the upper Event pane. You can arrange and sort the columns as you wish. The following columns display information: Time - The date and time when the chat / IM was recorded. Sign On Name - How the user identifies him / herself in this chat or IM conversation. Chatted With - How the person chatted with identifies him / herself. Participants - Indicates the number of participants in the chat room when the conversation was recorded. Standard columns, along with the following are available. Protocol - The underlying language used by the chat IM program to allow the session.

Content Pane Content displays in the lower pane for the event selected above.

Toolbar Shortcuts The Facebook Chat / IM Activity window contains the following shortcuts:

Jump to - Click to select a specific recorded event in the upper Event pane and then jump to Snapshots or Keystrokes.

Block Chat / IM - Use the Blocking shortcut to discontinue access to a particular person chatted with.

Search Chat / IM Activity - Use the Search shortcut to locate specific information quickly. Search works like a filter displaying only the data that matches the search criteria.

Delete - Use the Delete shortcut to delete one or more events.

Reporting and Managing Data

Filtering Data By User or Program

Normally, the Viewer loads all captured data (within the "Refresh" date range) from all users and all programs. It's possible to filter the data and decrease the amount of data that appears in every view of the Viewer. Without actually deleting data or turning off recording of data, you can work with a more manageable and meaningful amount of data. Spector Pro allows you to filter data viewed by User or by Program. For example, you can choose to "hide" the Notepad program. Any Keystrokes Typed in the Notepad will not appear. Filtering data is available on all event windows, although the options are only available if information was captured for more than one user name or more than one program.

To filter data:

1. Select Data > Filter > Users or Data > Filter > Programs from the menu bar. The Filter window opens, listing all users or program for which information was captured. In this case, we chose Programs.

By default, users / programs are listed in the Show column on the left, and all display on your Viewer.

You may choose not to display one or more users or programs by moving them to the Hide column on the right.

2. To hide a user / program currently displayed, in the Show column: Double-click on the item, OR Click to select the item and then click the right arrow, OR Click the right arrow ALL to move all users / programs. The selected item(s) moves to the Hide column. Repeat this step for each item you want to hide. 3. To display a user / program currently hidden, in the Hide column: Double-click the item, OR Click to select the item and then click the left arrow, OR Click the left arrow ALL to move all items. The selected item(s) moves to the Show column. Repeat this step for each hidden user you want to show. 4. Click OK to accept or Cancel to reject the moves. If you click OK, the item(s) you have elected to Hide no longer appear in the event windows, and the item(s) you have elected to display now appear in the event windows.

Arranging Columns and Sorting Data

One way to get a better view of recorded data is to arrange the data columns in an event. You can do this in any Events, Summary, or Details pane, as long as columns are shown. You have the choice to show or hide any column (some columns are hidden by default), and drag and drop a column to a new location. In addition, you can resort the data grid by clicking a column header.

To see which columns are available for a pane:

Right-click a column heading in an Events, Summary, or Details pane. A pop-up menu appears, listing the columns currently displayed (checked) and the columns available but hidden (not checked). You can click on an unchecked column to show it, or on a checked column to hide it.

To arrange the columns with more control:

Display the Arrange Columns box: 1. Select Arrange Columns at the bottom of the pop-up menu, OR Select View > Upper Pane (or Lower Pane) > Arrange Columns from the menu bar. The Arrange Columns option is available only for a pane with columns.

2. Select a column title under Available for Display.

3. Click Show. The column moves to the Currently Displayed list. 4. Select a column title under Currently Displayed and click Move Up or Move Down to change the order (left to right) in which columns are displayed.

5. Select a column title under Currently Displayed and click Hide to remove it from the pane. 6. Click OK.

To resort data in a column:

On any pane displaying columns, click a column header. This reverses the current sort order. For example, you can display all data by the Active time column, either from most to least or least to most active time. Other columns, such as Program Description are ordered alphabetically, so you could arrange the data alphabetically. An arrow in a column indicates which column the data is currently sorted by. An up arrow indicates the column currently is sorting data up (least to most or Z to A). A down arrow indicates the column currently is sorting data down (most to least or A-Z)

Grouping Recorded Events

The Group By feature allows you to customize how the Navigate pane displays its data hierarchy. You can do this quickly from the Group By button, or you can arrange a custom grouping.

To change the grouping:

Click the Group By button and select one of the data groups available in the menu. Each activity has categories you can select from the menu.

If you want to include categories not available in the default hierarchy, select Arrange Custom Grouping from the menu. Each activity type has a list of additional available categories to choose from.

Activity Categories for Grouping

Online Searches Date, Site, Computer, Month, Program, Protocol, Search Term, User, Week

Web Sites Visited Date, Domain, Computer, Day, Month, Program, Subdomain, Title, Type, Web Address, Week

Files Transferred Date, Domain, Computer, Media, Month, Protocol, Remote

Keystrokes Typed Program Window Title, Program Execution

Program Date, Program Description, Computer, File Path, Month, Program, Title, User, Week

User Date, User, Time by Month, Time by Week, Time by Day, Computer, Type

Network Date, Domain, Subdomain, Computer, IP, Month, Port, Program, Protocol, User, Week

Document Tracking Date, Drive, Program, Action, Computer, Drive Type, Media, Month, User, Week

Keywords Detected Date, Keyword, Computer, Month, Program, Type, User, Week

To arrange a custom grouping:

1. Click the Group By button and select Arrange Custom Grouping, or Select View > Upper Pane > Arrange Custom Grouping from the menu bar. The Arrange Custom Grouping window opens.

Available for Display (left side) - lists all the ways in which data can be grouped but which are not currently being used.

Currently Displayed (right side) - lists all the ways in which data is currently grouped.

2. Under Available for Display double-click on a group or highlight it and then click Show. The group now appears under Currently Displayed. Repeat this step for each group you want to show. 3. Under Currently Displayed double-click on a group or highlight it and then click Hide. The group now appears under Available for Display. Repeat this step for each group you want to hide. 4. Click OK to accept, or Cancel to discard the changes.

To rearrange the order of the groups in the hierarchical tree:

1. Click Move Up or Move Down to rearrange the order of the groups under Currently Displayed. The position of the groups from top to bottom will correspond with their position in the Navigate pane tree. 2. Click OK to accept, or Cancel to discard the changes.

To change how data is sorted within a group:

1. Under Available for Display click to select a group. Use the Ascending and Descending buttons to select the order in which events will sort. 2. Click OK to accept, or Cancel to discard the changes.

Deleting Recorded Events

You can remove individual events, a "group" of events" or all events. If disk storage space is an issue, consider backing up and deleting data files.

Once recorded events have been deleted, they cannot be retrieved. Make sure that when you tell Spector Pro to delete data, you no longer need it.

Deleting One Recorded Event

To delete one recorded event:

On any Event (upper) or Detail pane (lower): 1. Select the specific event you want to delete. Note that if you select a branch of the tree on a Navigate pane, or one item on a Summary pane, it may include more than one recorded event.

2. To delete the event:

Press Delete on the toolbar, OR

Right-click and select Delete from the dropdown list, OR

Select Edit > Delete from the menu bar. A confirmation message appears, asking you if you want to delete the selected item.

3. Click Yes to delete the event, or No to cancel the deletion and close the message.

Deleting More than One Recorded Event

To delete more than one recorded event:

On any window: 1. Select a branch of the tree on a Navigate pane (upper), an item on a Summary pane (lower), or a recorded event on the Detail pane (lower). Your selection may include one or multiple recorded events.

Example 1 On the Web Sites Visited Navigate pane you can select a date. That date might include one web site visited (domain), or many. If you select this date on the Navigate pane, all events for every domain recorded on that date will be deleted.

Example 2 On the Web Sites Visited Navigate pane you can open a date and select a domain. The domain might include visits to one subdomain, or many. If you select a subdomain on the Navigate pane, such as hotmail.com, all events recorded at that subdomain, on that one day, will be deleted.

Example 3 After selecting a date or any other item in the upper Navigate pane, you can click in the lower Summary pane to select items to delete. If you select one item on the Summary pane, all events for that domain or subdomain recorded on the date will be deleted.

Example 4 After making date and domain selections in the navigate pane, you can select the Details tab in the lower pane and select items to delete. If you select one item in the Details list, one recorded event will be deleted.

2. To delete the events:

Press Delete on the toolbar, OR

Right-click and select Del from the dropdown list, OR

Select Edit > Delete from the menu bar. A confirmation message appears, asking you if you want to delete the selected item(s). The message indicates exactly what is being deleted and how many items are included. 3. Click Yes to delete the events, or No to cancel the deletion and close the window.

Copying Data

It is possible to create reports in other formats from the data that Spector Pro captures. For example, a company may require a log of all email sent and received in a spreadsheet. To capture Spector Pro email data, they would simply select and copy the Event list for Email Activity and paste it directly in the spreadsheet document. Use Copy / Paste functions to copy the data from Spector Pro and paste it in another application. The Copy function is available in all Spector Pro views.

To copy and paste data:

1. Open both the Spector Pro Viewer and the document where you will paste the data. 2. Select the data to copy: In the upper Events List or lower Summary or Details list, select (highlight) the row you wish to copy. Multiple-select rows using the Shift or Ctrl key. In a lower Contents pane (such as Keystrokes), drag over text to select it. In either pane, Use Edit > Select All to select ALL data in the pane.

You cannot select or Copy from a Navigate pane (hierarchical tree).

3. Copy your selection: Use Edit > Copy or Ctrl+C. The selection is copied to the Clipboard. 4. Paste your selection: In the other application, use Edit > Paste or Ctrl+V to paste the selection in the document.

To copy User Activity or Snapshot graphics:

User Activity charts and Snapshots behave as graphics: 1. Open both Spector Pro and the document where you will paste the graphic. 2. Click directly on the User Activity chart or on the Screen Snapshot graphic.

3. Select Edit > Copy from the menu bar. 4. Paste your selection: In the other application, use Ctrl+V or Edit > Paste to paste the selection in the document.

Saving and Exporting Data

If you need to share recorded information with others or retain specific recorded events for future reference, you can Save events, lists of events, contents of events, or Data Files. For information on backing up ALL Data Files, see Backing up and Restoring Data Files.

Saving Events from a View Saving one or more recorded events allows you to export proof of a single activity, such as a list of Web Sites viewed on one day, to a file format that can be opened by a common application. Keep in mind that ONLY selected data is saved, and only the data currently shown in the view is saved. For more information on saving snapshots as graphics or video files, see Saving Recorded Snapshots.

To save recorded events:

1. Open an event window in the Viewer and click to select the information you want to save. 2. Select File > Save As from the menu bar, OR click the Save As button in a lower Content pane. The Save As window opens.

3. Navigate to the folder in which you want to store the information. 4. Type a name in the File name field.

5. Next to Save as type, select a file type. Different file types are available, depending on the view and in which pane you have made your selection. Available file types may be: Text File (.txt) HTML File (.htm, .html) RTF File (rtf) EML File (.eml) JPEG graphics file (.jpg) BMP graphics file (.bmp) AVI movie file (.avi) For example, if you select several lines from the Details pane of Web Sites Visited and select Save As, you get a tab-delimited text file readable by Notepad, MS Excel, and many other applications.

Saving Data Files from the Data Files View The Data Files view lists all SpectorSoft format files that can be read only by the Viewer. If you would like to save one of these files to another location, use File > Save As. If you would like to copy ALL files to another location, use Data > Backup.

To save a SpectorSoft data file:

1. Select Data > Show Data Files from the menu bar. 2. Select the file or files you wish to save (you can multiple select using Shift or Ctrl). 3. Select File > Save As from the menu bar (or right-click and select Save As).

4. Navigate to and select a folder, or choose Make New Folder, in the Browse For Folder window. Click OK. The selected file(s) are saved at that location. You cannot change the file type of a Spector Data File; these files are encrypted and can only be opened with a Spector Viewer. However, you can change the file name (without changing the file extension). It is always possible to direct a Viewer to the location of saved Data Files and select File > Open Data Files. The Viewer will open every valid SpectorSoft file in the folder, or give you a message if there are no valid files to open.

Printing

You can print the content of any Email, Chat/IM conversation or Keystroke activity. You can also print the list of Spector Pro data files on this computer.

To print:

1. Click in the Details area of Email Activity Chat/IM Activity Keystrokes Typed Or use Data > Show Data Files to display the list of Spector Pro data files. 2. Open the File menu and select Print. 3. On the Print box, select a printer (or PDF file) and Print. The entire message, conversation, or keystroke sequence is printed.

Show Data Files

When Spector Pro captures activity from a monitored computer, it stores the data as records (events) or chunks of information in different types of proprietary SpectorSoft files. These files are used by the Viewer to display activity in the various views; the files cannot be interpreted by any other application. Data Files are temporary - the oldest ones are deleted when the maximum size or time to keep is passed. Use Data File Settings to control how files are managed, and use the Backup function regularly if you need to archive all data.

To view the existing data files:

Select Data > Show Data Files from the menu bar. The Data File window opens. Each file is listed by: Filename - The drive, directory (in this case bitixdsk) and filename for each data file. Spector Pro randomly names the folders, file names and file extension all of which is accessible in the Data File Settings window. The location of the folder is based on the operating system you have installed. Date - Indicates when the file was created, EXCEPT for snapshots. The date and time for snapshot files indicates the time span during which snapshots were taken. As a result, each Snapshot data file contains many snapshots, all of which were recorded in that time span. For example, there may be 15 snapshots within a file, all of which were recorded on Monday, August 14 at 06:33 PM. Other file types (e.g., Users or Web) may list time as 09:43 AM - 09:43 AM, but the file includes data (while recording was on) for the whole day. Size - The size of the recorded data contained within that file, in megabytes. Deleting a data file frees up space on your hard drive. Event Count - The number of recorded events (or records) contained in the file. Type - Data file types include: Activity - All recorded keyword alerts. This is the data contained in the Keyword dropdown list in the Screen Snapshots window and the Top 10 Keywords Detected window.

Chat / IM - All recorded chat and instant messages. This is the data that displays in the Chat / IM Activity window, the Top 10 Chat / IM window, and the MySpace Chat / IM window. Keystrokes - All recorded keystrokes. This is the data that displays in the Keystrokes Typed window. Email - All recorded emails. This is the data that displays in the Email Activity window, the Top 10 Email Activity window, and the MySpace and Facebook Messages windows. Queue - All data that is waiting to be transmitted as Keyword Alerts. These data files are not seen unless Spector Pro is unable to transmit the email alerts. Web - All data that tracks the Internet web sites visited. This is the data contained in the Internet dropdown list in the Screen Snapshots window, and the Web Sites Visited activity window, and the Top 10 Web Sites Visited window. Snapshots - There will be many files of snapshot data; multiple files per day. Each file contains snapshots recorded during the time interval displayed. This is the data that displays in the Screen Snapshots window and in the MySpace Snapshots window.

Programs - All recorded applications / programs. This is the data that displays in the Program Activity window, and the Top 10 Program Activity window. Users - The data in this file tracks users that log on to the system, allowing Spector Pro to identify which user did what and for how long. The data is used for User Profiles and User data columns in the various views. Note that users can only be tracked if they log in to the computer with specific name and password (if any).

System Info - The data in this file tracks System settings and general information about your installation. Network - All recorded network information. This is the data that displays in the Network Activity window.

Drive - All recorded document tracking information. This is the data that displays in the Document Tracking window.

Toolbar Shortcuts The Data File window contains the following shortcuts:

Open Data Files - Open a Browse For Folder window and navigate to a folder to load a different set of data files. Refresh - Load the most current data, or to limit which recorded events are displayed by selecting a specific date range. Delete - Remove one or more Data Files. Be careful in deleting these files: for example, if you delete a Users or System Info file, you may lose settings and data that affects other views.

Status Bar The status bar contains customized items as described below: Total - Total number of data files.

User name:The name used to log in to an account. This only appears if more than one user has an account on this computer, and you click on a particular event in the Detail pane. Selected - Total number of bytes for the file(s) selected. Total Bytes - Total number of bytes for all files listed.

Backing up and Restoring Data Files

Spector automatically deletes data files according to the Data File Settings for snapshots and other data files . It is also possible to delete or save one or more events from a view. The Backup procedure described below automatically backs up ALL existing data files to a different location. A Backup copies files; if you want to remove all files after backing them up (to create a true archive) use File > Delete All Data Files. When you Restore a Backup, you are copying backed up Data Files to your current folder location and replacing any current recorded activity with the backup data.

Backing Up Data Files

To backup all existing data files:

1. From anywhere in the Viewer select Data > Backup from the menu bar. The Browse For Folder window opens.

2. Navigate to where you want to store the data files, and click Make New Folder. A New Folder appears. 3. Type a name that you will recognize, but which will not be obvious to the monitored users. 4. Click OK. The Browse For Folder window closes. A progress bar informs you that the data files are being copied, and a message appears letting you know that the backup is complete.

5. Click OK to close the message window.

Restoring Data Files

Once you have backed up one or more data files, the original files can be deleted . Your backed up files are safely stored and can be retrieved at any time for viewing in the Spector Pro Viewer.

To retrieve data files:

1. From anywhere in the Viewer select File > Open Data Files from the menu bar. The Browse For Folder window opens. 2. Navigate to the folder where you stored the data files you now want to retrieve, and click to select it. 3. Click Open. A progress bar informs you that the data is being loaded. 4. The data is now viewable from the appropriate event window in the Viewer.

Deleting Data Files

If you are running out of space on your computer, and there are data files that are no longer useful, you can delete one data file, multiple data files or all of them. If you want to keep all data but are running out of space, consider backing up data files and storing them elsewhere on your computer.

Once data files have been deleted, they cannot be retrieved. Make sure that when you tell Spector Pro to delete data files, you no longer need them. That information will no longer appear on the event windows.

Deleting a Data File Select Data > Show Data Files to view a list of all existing data files by filename, date and time recorded, size, and type.

To delete a data file:

From anywhere in the Viewer: 1. Select Data > Show Data Files. The Data File window opens. 2. Click to select a data file, being careful that it contains the data you no longer need. 3. To delete the file: Press Delete on the toolbar, OR Right-click and select Del from the dropdown list, OR Select Edit > Delete from the menu bar. A confirmation message appears, asking you if you want to delete the selected file. 4. Click Yes to delete the file, or No to cancel the deletion.

Deleting Multiple Data Files

To delete multiple data files:

From anywhere in the Viewer: 1. Select Data > Show Data Files. The Data File window opens. 2. Click to select a data file, being careful that it contains the data you no longer need.

Click to select one file, then hold the Shift key and click again to select a second file and all the files between, or

Click to select one file, then hold the Ctrl key and click again to select a second file without all the files between. This can be repeated as many times as needed. 3. To delete the file: Press Delete on the toolbar, OR Right-click and select Del from the dropdown list, OR Select Edit > Delete from the menu bar. A confirmation message appears, asking you if you want to delete the selected files.

4. Click Yes to delete the files, or No to cancel the deletion.

Deleting All Data Files

To delete all data files:

From anywhere in the Viewer:

1. Select File > Delete All Data Files from the menu bar. A confirmation message appears, asking you if you want to delete all data files and reminding you that once deleted, they cannot be recovered. 2. Click Yes to delete everything, and No to cancel the deletion.

Changing Settings

As soon as it is installed, Spector Pro begins recording activity. It automatically organizes recorded data to be displayed in the Spector Pro views. If you find that you are not viewing activity you expect to see, or if you are getting too much of a certain type of activity, you can change settings. By default, Spector Pro is set to record all activity types (except Network Activity). No Alerts on detection of keywords or Blocking of Internet access occurs by default. Spector Pro offers Profiles to set up monitoring and Settings to control the application. These buttons are at the top of the Viewer window.

User Profiles Profiles control Spector Pro recording tools and apply to either all users who use this computer or individual users who log in, if you have defined User Profiles.

To change Record, Alert, or Block settings for some or all users:

Click Profiles at the top left of the Spector Pro window. The Control Panel that appears allows you to define User Profiles and adjust Record, Block and Alert settings for a user profile or for "All Other Users." If you make no changes to profiles, Spector Pro will use the default profile for anyone who logs on to the computer. You can change a profile for any user to include more or less recording and keyword detection, or to block Internet access. See About User Profiles. Default settings for:

User Profiles - One profile exists - . This profile selection means settings apply to anyone who logs into the computer.

Record - All types of recording are on EXCEPT for Network Activity recording. Recording is always on (no schedule is set).

Alert - No keywords are defined, and no keyword detection or alerting takes place. As soon as you define a keyword, Spector Pro will watch for it in all possible keyword sources and trigger a snapshot every 5 seconds for 60 seconds.

Block - No blocking of Web Sites, Chat/IM or other Internet Access is on.

System Settings System Settings apply whenever Spector Pro is running on this computer.

To change System settings (affect all user profiles):

Click Settings at the top left of the Spector Pro window. A Control Panel with General Options appears, where you can set Security, manage Data Files, and specify Applications preferences for Spector Pro. If you do not change settings, Spector Pro manages itself as follows. You can change the level of security, how it handles data files, and adjust other Spector Pro application settings that will affect all profiles. See System Settings.

Default settings for:

Security - Spector Pro is set to stealth mode and requires a hotkey sequence to open.

Data Files - Data is stored in hidden files within a randomly named folder. By default, the folder is NOT shared and no password is set on the Data Files folder to access the data. Spector Pro starts deleting snapshot files after 30 days or when they take 500 MB of disk space. Spector Pro starts deleting other data files after 45 days or when the takes 30 MB of disk space.

Application - A hotkey sequence is required to open a Standard installation of the Viewer. The default is Ctrl + Alt + Shift + S. The default hotkey sequence for taking a snapshot at the computer is Ctrl + Alt + Shift + P. After 3 minutes of inactivity, Spector Pro will STOP recording. It starts again as soon as there is activity. Spector Pro monitors ALL programs on the computer.

Restoring Default Settings

At any time after you have altered the settings, you can always change them back to the default values. This may be helpful if you have adjusted a setting and Spector Pro is no longer functioning properly. Restoring default settings resets System and generally applied settings:

Security settings Data File settings Application settings Any Record settings as applied to Any Record System Settings that have been changed

It does not remove User Profiles or reset any User Profile Record / Alert / Block settings. It will remove your Viewer access password and return all hotkey sequences to their defaults.

To restore settings:

1. Select Help > Technical Support Diagnostics > Restore Default Settings on the menu bar. A confirmation message appears reminding you that settings will be restored to the factory-default values.

2. Click Yes to restore the settings to how they were when you purchased Spector Pro, or No to leave them as they currently are. If you select Yes, a message confirms the settings were successfully restored to their original defaults.

3. Click OK to close the window.

User Profiles

About User Profiles

Spector Pro records everyone and nearly everything by default. Profiles allow you to control who and what is recorded. User profiles are not required to record computer activity. If you never define a user profile, Spector Pro will still Record, Alert, and Block ALL users as set under the Profile for "". Anybody who is able to log in to the computer and does NOT have a Spector Pro user profile is included in "All Other Users." For example... Suppose you do add a profile for John and Mary, allowing them Chat/IM contact with ONLY known friends and teachers. If John logs out and another user named Sam logs in, the blocking will no longer be applied.

To change a profile

1. Click the Profiles button at the top of the Viewer. 2. At the top of the Profiles panel, select the profile to use. Click the down arrow next to "All Other Users" and make a selection. 3. Make changes to Record, Alert, and Block settings. The changes apply only to the currently selected profile. 4. Be sure to click OK to at the bottom of the panel to save all changes.

Users with different logins are defined in the Windows Control Panel > User Accounts settings. If the computer has not been configured for separate user logins - it just turns on without requiring a name selection or password entry - you will be able to adjust the profile, but other user profiles will have no effect.

Add a New User Profile

To assign settings to a specific user, add a user profile.

To add a User Profile:

1. Click Settings and select User settings. 2. At the top of the User Settings box, click Add a New Profile. 3. Choose Select from existing computer users to choose a user defined in your Window settings. Choose Enter user name manually to type in a user name.

If you haven't set up separate users in the Windows operating system but plan to, there's nothing to stop you from creating a profile for a user here. Be sure to use the exact same user name for the profile and for the Windows user. You can manage Windows users from the Control Panel > User Accounts.

4. Select an image to display with the user. 5. From Use Initial Values from, select which profile you will use as the base for settings in the new profile. The drop-down list shows only and any other User Profiles you have already defined. 6. Click OK. The Profile you just created is now selected, and any changes you make to these settings will apply to this user. To switch to another user profile, or to return to "All Other Users," Click the down arrow next to the current profile name.

Delete a User Profile

You can delete any User profile, but not the profile.

To delete a user profile:

1. Click Profiles to open the User Settings box. 2. From the Settings Profile for: drop-down list, select the profile to delete. 3. Click the Delete This Profile button. All settings are lost for this profile, but not for any other profiles or for the default profile. The user to whom the profile applied will now be part of the "All Other Users" group.

You cannot delete the profile.

Changing the Recording Profile

Screen Snapshot Settings

Spector Pro takes full-screen snapshots of each monitored computer, very much like a surveillance camera. You can playback a detailed visual history of what the user was doing when the snapshots were taken, as described in Viewing Snapshots. To turn snapshots off or change their system settings, select Profiles > Record > Screen Snapshots.

SpectorSoft recommends 500 MB of available hard disk space for a typical day of recording. If the person you are monitoring actively uses the computer more than 4 hours a day, or if you adjust the settings so that more snapshots are taken, you may require more disk space.

To turn Screen Snapshot recording off or on:

Click the green ON button in the left list of Record settings to toggle it to OFF, or Select OFF in the right side of the Snapshots profile panel.

This setting applies to the currently selected User Profile.

To change System Settings for Screen Snapshots:

Click the System Settings button. This is where you change the snapshot format (size, color), configure when Spector Pro takes snapshots, and how it captures the screen when it takes a snapshot. These settings

apply to ALL profiles and once you change them are changed when any other profile is selected. See Snapshots - System Settings.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Chat/IM Activity Settings

Spector Pro automatically records chat among many people in virtual "rooms" online, and both sides of private instant messaging conversations held in Yahoo Messenger, Windows Live Messenger, AIM, and other programs. Chat/IM Activity settings allow you to turn Chat/IM recording on or off for any user. You can also make adjustments to the way Spector Pro records chat. To turn Chat/IM recording off or change the Chat/IM system settings, select Profiles > Record > Chat/IM Activity.

Spector Pro allows you to block individual Chat/IM contact names. To do this, Chat/IM recording must be ON.

To turn Chat/IM recording off or on:

Click the green ON button in the left list of Record settings to toggle it to OFF, or Select OFF in the right side of the profile panel. This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile.

To change System Settings for Chat/IM recording:

Click the System Settings button. This is where you fine tune Chat/IM recording. Under normal circumstances, you will NEVER change these settings. SpectorSoft advises that only advanced users attempt to make changes so that recording is not compromised. These settings affect all user profiles. See Chat/IM System Settings.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Web Sites Visited Settings

Spector Pro automatically records every web site visited on the Internet, capturing the domain, subdomain, and amount and types of activity that took place at the web site. Web Sites Visited settings allow you to turn this recording on or off for any user. You can also make adjustments to the way Spector Pro records web sites. To turn Web Site recording off or change the system settings, select Profiles > Record > Web Sites Visited.

Spector Pro allows you to block web sites. To do this, Web Site recording must be ON.

To turn Web Sites Visited recording off or on:

To change System Settings for Web Sites Visited recording:

Click the System Settings button. This is where you fine tune recording. Under normal circumstances, you will NEVER change these settings. SpectorSoft advises that only advanced users attempt to make changes so that recording is not compromised. These settings affect all user profiles. See Web Sites Visited System Settings.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Email Activity Settings

Spector Pro automatically records both incoming and outgoing email from many of the most popular emailapplications, including webmail(email using Internet web sites). Email Activity settings allow you to turn email recording on or off, capture email attachments, limit attachment file size, filter email so that you only capture what is important, and fine tune recording of email. To adjust Email Activity settings, select Profiles > Record > Email Activity.

Email Activity settings affect the MySpace and Facebook email message information that you view.

To turn Email Activity recording off or on:

To record email attachments:

By default, any attachments are noted with an email, but the attachment itself is not recorded. Record Attachments - Check to capture all attachments up to the maximum file size. Clear to document but not actually capture attachment files.

Maximum Attachment Size - Files greater than this size are NOT captured when Record Attachments is enabled. if you want to capture any email attachment larger than 100 kilobytes in size, type a new number or use the up/down arrows to change the number. Enter a number from 0 to 32767 KB (3 MB). Use 0 for unlimited attachment size. Keep in mind that your mail server already may limit the size of attachments that come through to the computer. If an attachment exceeds the specified size limit, it is not recorded. The Viewer displays a flag and the INFO message: "Attachment(s) exceeded size limit - not recorded."

Spector Pro does NOT capture attachments sent through AOL or webmail. They must be sent through POP / SMTP email clients (e.g., MS Outlook, Outlook Express, Eudora, Incredimail, etc.) or Microsoft Exchange using MS Outlook.

To configure email filtering:

Click the Configure Filter button to open the Email Filter box. See Email Activity Filtering.

To change System Settings for email:

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Email Activity Filtering

You can reduce the quantity of email captured by using email filtering. This make it easier to find and focus on the information you need. A filter provides rules that tell Spector Pro whether to record or ignore an email based on criteria you specify. For example, you can instruct Spector Pro to ignore email from "My Favorite Store" and ignore anything sent by "me." By default, there are no filtering rules defined.

All of the criteria of a rule must be TRUE for each rule to apply. Make sure applications are closed and users logged off when you change settings to ensure the new settings will go into effect.

To set up email filtering:

1. Access the Email Filter box by selecting Profiles > Record > Email Activity and then click the Configure Filter button.

2. Click Add. The Email Rule box opens. Follow instructions in Creating an Email Filtering Rule. The rule provides conditions the email must meet in order to be recorded or ignored. You may need only one rule, or you may need to create a series of rules to create your filter. Click Add to define each rule. Each rule is added to the bottom of the Email Filtering Rules list, but rules are applied in the order they appear in this list. 3. Set priority and logic for the Email Rules. The first rule in the list is applied first and becomes an "exception" for lower rules. For example, you may place a rule to capture email TO "My Favorite Store" FROM your daughter above a rule that ignores all other email to and from "My Favorite Store." See other examples below. Use the buttons to arrange the rules and change the logic:

Edit - Select a rule and click Edit to open the Email Rule box and change the conditions for a rule.

Delete - Select a rule and click Delete to remove it.

Move Up - Select a rule and click Move Up to move it up the list of rules and change the filtering logic.

Move Down - Select a rule and click Move Down to move it down the list and change the filtering logic. 4. If NONE of the rules apply, decide whether you want the email to be recorded or ignored. The default is to record all email that does not match any rule conditions.

recorded – Spector Pro records all email and attachments where the rules do not apply.

ignored – Spector Pro ignores and does NOT record email where the rules do not apply. 5. Finally, click OK on the Email Filter box to set the rules and return to the Email Activity settings panel.

Example:

You want to capture only incoming Hotmail email, but you do NOT want to capture email you send or receive from your Hotmail account. You need two rules to do this. 1. Position the exception at the top of the list. Create a rule that specifies do NOT record Hotmail email to or from specifically "me" (in this case, [email protected]). Any email matching this condition should be ignored.

2. Create a second rule that captures all incoming Hotmail. Any email matching this condition should be recorded.

3. On the Email Filter box, select "If none of the rules apply, then the email should be ignored." The logic works to record ONLY incoming Hotmail, but to ignore the Hotmail sent to or from a specific email address: (a) Ignore email to or from "[email protected]." (b) Record email from any "hotmail.com" address. (c) All other email - Ignore, do NOT record.

Example:

Your company is recording a large amount of inhouse email, which could be ignored. However, you do not want to lose valuable tracking information about legal matters. 1. Position the exception at the top of the list. Create a rule to look for email with "legal" in the Subject or Body AND "MyCompany.com" in both the To and From addresses. Any email matching this condition should be recorded. 2. Create a second rule that ignores inhouse email. Look for SMTP/POP email type with "MyCompany.com" in either the To OR From addresses. Any email matching this condition (beyond the first exception) should be ignored. 3. On the Email Filter box, select "If none of the rules apply, then the email should be recorded." The logic works to record all email EXCEPT inhouse email that has to do with legal matters. (a) Record inhouse ("MyCompany.com") email with "legal" in the Subject or Body. (b) Ignore other inhouse ("MyCompany.com") email. (c) All other email - Record.

Creating an Email Filtering Rule

To create an Email Filter, define one or more rules for capturing (or ignoring) email. Whether or not a message is recorded depends on how you construct each rule. Access the Email Filter Rule box by selecting Profiles > Record > Email Activity > Configure Filter and then click Add or Edit.

All of the Email Rule criteria must be TRUE for the email to be recorded or ignored. Make sure applications are closed and users logged off when you change settings to ensure the new settings will go into effect.

To add a filtering rule:

1. On the Email Filter box, Click Add to open the Email Filter window. Enter a name for the rule. Check boxes that apply and clear those that do not. Set conditions for any portion of the email header and click OK to add the rule to the list in the Email Filter box. See below for a description of Rule Criteria choices. 2. Type an appropriate Rule Name for the rule you are creating. All alphanumeric characters and punctuation are permissible. 3. Make changes to the conditions as needed. By default, all items are checked and all email is included. See below for a description of each field.

4. Click OK on the Email Rule box to add the rule to the bottom of the list in the Email Filter box.

Conditions:

If the email was: Sent from This Computer - Check to include email sent from this computer; clear to exclude email sent from this computer. Received by This Computer - Check to include all email received by this computer; clear to exclude. If both items are checked, all email sent OR received by this computer is included. And the email: Has attachments - Check to include email with attachments; clear to exclude attachments. If "Has attachments" is checked, you can specify the size of the attachment using the drop-down list and entry field. Of any size - All attachments are included. Less than ... KB - Include only attachments smaller than the specified size. Type a number to represent the size in kilobytes.

Greater than ... KB - Include only attachments larger than the specified size. Type a number to represent the size in kilobytes.

Equal to ... KB - Include only attachments of an exact size. Type a number to represent the size in kilobytes. Does not have attachments - Check to include email with NO attachments; clear to exclude email without attachments. If both items are checked, email with OR without attachments is included.

If you create a rule specifying that email with attachments should be captured, Record Attachments must also be enabled in the Email Activity settings for the attachments to be recorded. Attachment rules do NOT apply to webmail.

And the email's format is

You can include or exclude email from capture by format in which it was sent. To include all email formats, leave all boxes checked. Plain Text (text only) - Check to include; clear to exclude. HTML (hypertext markup language - includes graphics and special fonts) - Check to include; clear to exclude. RTF (rich text format - includes graphics and special fonts) - Check to include; clear to exclude. If all items are checked, the email can be in any format. And the email comes from: Indicate the types of email that should be included in the rule. The default is to include all email sources: SMTP / POP, Webmail accounts, AOL accounts, Microsoft Exchange accounts and IMAP accounts. And the email's To / From / Subject / Body: For each part of the email header, you can create conditions based on what appears in the To address, the From address, the Subject, or the entire Body of the email. The email must match these conditions in order

to be recorded (or ignored). Use the dropdown list next to each field to select how to match, and type a word or characters to indicate what to match. is anything - All email is included, regardless of what is in the To line; leave the field next to it blank. This is the default. starts with - Include email where the beginning of the field matches what you type in the adjacent box. For example, you might look in the From field for mail from an address starting with "Robert": [email protected] or [email protected]. ends with - Include email where the end of the field matches what you type in the adjacent box. For example, you might look in the To field for matches ending with "TheirCompany.com" and capture email sent to [email protected] and [email protected]. contains - only those emails with this exact To line are included in the rule; type the exact word(s) in the field.

See Email Activity Filtering to learn about changing priority and logic of multiple rules.

Files Transferred Settings

Spector Pro automatically records the exchange of information between computers via HTTP upload or download, FTP upload or download, or Peer-to-Peer (P2P). Use Files Transferred settings to turn files recording on and off and adjust system settings, such as whether or not to capture HTTP uploads or change Gnutella and FTP ports. To adjust Files Transferred settings, select Profiles > Record > Files Transferred.

Close all applications that are running and log off all users to ensure that new settings affect these applications and users.

To turn capture of Files Transferred on or off:

Click the green ON button in the left list of Record settings to toggle it to OFF. Click OFF to turn it ON - OR- Select OFF in the right side of the profile panel. Select ON to turn on recording. This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile. When this recording is on, file transfers are listed and displayed in the Files Transferred view.

To change System Settings for Files Transferred:

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Keystrokes Typed Settings

Spector Pro logs every visible and non-visible keypress and provides clear proof of what was typed in any application or at any web site. Some non-Latin languages require more than one keystroke to create a character. For example, the user may type four keystrokes to create two characters. Use the Keystrokes Typed settings to instruct Spector Pro to capture characters in addition to keystrokes. To adjust Email Activity settings, select Profiles > Record > Keystrokes Typed.

Close all applications that are running and log off all users to ensure that new settings affect these applications and users.

To turn keystroke recording off or on:

Click the green ON button in the left list of Record settings to toggle it to OFF. Click the red OFF button to turn recording ON. Select OFF in the right side of the profile panel to discontinue recording. Select ON to start recording. By default, keystroke recording is ON. You will not be able to detect Keywords in keystrokes typed if you are not recording keystrokes. This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile. When this recording is on, recorded keystrokes are listed and displayed in the Keystrokes Typed view.

To "mask" passwords captured:

Check Do Not Capture Passwords. By default Spector Pro captures all keystrokes typed, including passwords used to log in to programs, email, web sites, and so on. Check this option if you prefer to "mask" passwords with asterisks (*) for security. With this option selected, a password typed as red123 will appear in Keystrokes Typed contents as ******. Clear this option to capture the keystrokes used for passwords.

To change System Settings for Keystrokes Typed:

Click the System Settings button. This is where you can turn on Record Characters, which is useful for monitoring computers being used in other languages, and causes a Character tab to appear in the

Keystrokes Typed lower pane. System settings affect all user profiles. See Keystroke System Settings.

To save your changes:

Click OK to save the changes you have made, or Cancel to discard them. The Profile settings window closes.

Program Activity Settings

Spector Pro records information about every program opened on the monitored computer - Outlook, Word, Games, Notepad, anything installed on the computer - and lets you know how long the user was engaged in activity: scrolling, typing, or using the mouse. Use Program Activity settings to turn this type of recording on or off, and to access the System Settings, which let you set the "inactivity timeout" duration. To adjust Program Activity settings, select Profiles > Record > Program Activity.

Close all applications that are running and log off all users to ensure that new settings affect these applications and users. Note that if System Settings > Application has been set to exclude programs from being recorded, these programs will not be recorded no matter what the settings are here.

To turn Program Activity recording off or on:

Click the green ON button in the left list of Record settings to toggle it to OFF, and click the red OFF button to toggle it to ON. -Or- Select OFF on the right side of the profile panel to turn off recording. Select ON to turn it on.

This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile. When this recording is on, any program started by the user is listed in the Program Activity view.

To change System Settings for Program Activity:

Click the System Settings button. This is where you can change the amount of time no activity occurs that defines inactivity timeout, when Spector Pro stops recording. System settings affect all user profiles. See Program System Settings.

To save your changes:

Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

User Activity Settings

Spector Pro records information about each user who logs in to the monitored computer - when they log in, when they log out, and whether or not they were actively working throughout the day. You can turn User Activity recording on or off from the User Activity Profile settings. To turn User Activity recording on or , select Profiles > Record > User Activity.

To turn User Activity recording off or on:

This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile. When this recording is ON, a chart of activity for the user appear in the User Activity view.

To save your changes:

Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

Network Activity Settings

Spector Pro captures network information that provides an overview of the quantity and type of activity taken place on your network. Find out what Internet sites are visited by which programs and how much data is transferred to and from those sites. By default Network Activity recording is OFF. Use Network Activity settings to turn on recording and to specify Network Activity recording by programs or by IP address and port. To change Network Activity settings, select Profiles > Record > Network Activity.

To turn Network Activity recording off or on:

Click the red OFF button in the left list of Record settings to toggle it to ON; click the green ON button to toggle it OFF. - Or-

Select ON in the right side of the profile panel to turn on Network Activity recording. Select OFF to ignore this activity. This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile. Record Network Activity must be ON to activate the following settings.

To limit programs where Network Activity is recorded:

Network Activity recording captures connections made by all programs, unless you specify programs to include or exclude. This can result in too much information, and you may wish to limit the programs recorded. For example, you might exclude Internet Explorer (Iexplore.exe) to avoid duplicating activity already captured by Web Sites Visited recording. 1. Choose whether you are including or excluding programs:

Record network activity for only these programs listed - ONLY record the listed programs.

Record network activity for all programs except these listed - EXCLUDE the listed programs from recording.

2. Click Add in the Programs area of the Network settings. The Select Program(s) to Exclude/Include box opens listing applications currently running on the computer. If the program you wish to include or exclude is in the list displayed, select it.

3. To find a program, click the Browse button. Navigate to a folder and select the executable program. For example, navigate to Program Files > Messenger and select msmsgs.exe to specify Windows Messenger. The folder path of the file name is NOT necessary. TIP: Start the start the application and click Refresh on the Select Programs box to see the program's executable name in this list and select it.

4. Click OK to close the add the program to the list of programs to include or exclude on the Network panel. The listed programs will be recorded (or excluded from recording) for the current user profile.

To limit ports where Network Activity is recorded:

Spector Pro can capture Network Activity happening at specific ports. By default, Spector Pro captures activity at ALL ports EXCEPT those listed. If you wish, you can change the ports to EXCLUDE, or choose to INCLUDE only specific ports for Network Activity recording. 10.*.*.*:* - Represents connections made at the local computer to itself 169.254.*.*:* - Represents local area network ranges commonly used by DHCP 192.168.*.*:* - Represents local area network ranges commonly used within a network

1. Choose whether you are including or excluding programs:

Capture network activity for these IP ports listed - Select this option to record connections made ONLY at the listed IP ports. Be sure remove the default ports and click Add to specify which ports to include. For example, if you ONLY wanted to capture web traffic, clear the existing IP ports and add port 80 (*.*.*.*:80).

Capture network activity for all IP ports except those listed - Select this option to record all connections EXCEPT those made at the listed IP ports. Click Add and select ports to exclude in addition to the default, or change the default ports. For example, port 25 is almost always used for SMTP email. You may want to exclude this kind of email activity if you get enough data from Email Activity recording by adding (*.*.*.*:25).

2. If you are INCLUDING ports to record, make sure you remove the existing ports, which are intended to be excluded. Select them and click the Delete button to remove them from the list. 3. Click the Add button to add new ports to EXCLUDE or INCLUDE. A box opens where you can specify the IP address and port value in the format ipaddress:port.

4. Type the IP address, or use * (asterisk) to specify ANY IP address or port value. All ports at a local computer might be entered as: 192.168.0.90:* Email at the standard SMTP port at any IP address would be: *.*.*.*:25. Click here for a list of standard IP ports.

5. If you don't know the IP address, under Computer and Domain Name Resolver enter the "friendly" computer name known on the network (such as OFFICE005) or a domain name (such as amazon.com) and click the Resolve button. If the name can be resolved to an IP address, it is displayed in the IP fields above. In the example above, activity at Amazon.com would be excluded (or included). 6. Click OK to accept the entry, or Cancel to reject it. The window closes. If the entry was accepted, the IP and Port is added to the IP:Ports list.

To change System Settings for Chat/IM recording:

Click the System Settings button. See Network System Settings.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Document Tracking Settings

Spector Pro records document activity at printers, on CD/DVD drives, on your local and mapped network drives (for example, G: or Z:), and on any "temporary" removable devices such as a USB storage drive or a camera connected to the computer. Use Document Tracking settings to turn this type of recording on and off, to configure where and what to track, and to specify particular files to track.

By default, Spector Pro tracks all documents printed and all CD/DVD burning activity. To adjust Document Tracking settings, select Profiles > Record > Document Tracking.

To turn Document Tracking off or on:

Click the green ON button in the left list of Record settings to toggle it to OFF. Click the red OFF button to turn recording ON. Select OFF in the right side of the profile panel to discontinue recording. Select ON to start recording. By default, Document Tracking is ON, but only for documents being printed and CD/DVD burning. You can apply different Document Tracking settings to different users. In the illustration above, the setting applies to any user who does not have a profile.

To change file tracking options:

Select one of the following file tracking options:

Do Not Track - (Default) Choose this option to turn off tracking of files and only track printed documents and CD/DVD burning. Use File Tracking Options based on Drive Type - Choose this option to select which types of drives (Local, Network, Removable, etc.) to track and what type of file activity to track. For example, you would choose this option to track anyone copying a file from a network drive to a removable device. When you select this option, a number of additional options appear. See below. Configure File Tracking Options for each Drive - Choose this option to select an actual drive known to the computer and set it to NOT track files, use the Default File Tracking, or use Custom File Tracking. For example, you would choose this option to watch a particular network drive, or to change the definition of Default File tracking for all drives. When you select this option, a list of all the currently mapped drives appears. See below for more explanation. Examples:

You want to turn off file tracking on the CD/DVD drive. 1. Leave Do NOT Track Files selected and clear Track WinXP CD/DVD Burning at the bottom of the panel. 2. If you want to track files, but not on this specific drive, select Configure File Tracking Options for each Drive. 3. Select the CD/DVD drive, from the list of drives; for example, D:\ CD/DVD. 4. Click the Edit button. 5. Select Do NOT Track Files on this drive.

You want to find out if files are being deleted from your P: network drive. 1. Select Configure File Tracking Options for each Drive. 2. From the list of drives, select the P:\ Network drive.

3. Click the Edit button. 4. Choose Use Custom File Tracking and then check Deleting a File (or check all activities).

An employee has quit and you want to watch ALL network drives for a few days. 1. Select Use File Tracking Options based on Drive Type. 2. Select ALL activity options under "Track if." 3. Select Network under "and the Drive Type is." Because tracking ALL network drives can generate a great deal of data, you may want to deselect the Network option when you are finished monitoring the user.

To use file tracking based on drive type:

You can set up general recording rules for types of drives. The advantage of this approach is that if a new network drive is mapped, or if a storage device takes a different drive letter, the system still recognizes a network drive type and a removable drive type. You will know the drive is being tracked as you wish. By default, NO file tracking options are selected.

1. Select Use File Tracking Options based on Drive Type. 2. Track if: Check an item to record this type of Document Activity. Clear an item to ignore the activity.

Creating New Files - Capture information every time a new file is created.

Opening to Write to Existing Files - Capture information every time an existing file is opened for writing. Just because you open a file does not mean you actually write to it. You may open a file and read it; you may copy or delete a portion of it, or you may save it to a new location with a new name.

Deleting Files - Capture information every time an existing file is deleted. This is useful if files are missing and you want to know who deleted them and when.

Renaming Files - Information is captured every time an existing file is renamed. This can be helpful if you are trying to track a file through the system. Many applications create temporary files while you are editing an original. When you are done editing, the original file is deleted and the temporary file is saved. 3. and the Drive Type is: Your computer automatically assigns different devices to different "types" of drives. Spector Pro recognizes four drive types and assigns ones it does not recognize to "Other."

For File Tracking based on drive type, Spector Pro considers files addressed by UNC names to be on a "Network" drive type.

CD / DVD - Includes all CD and DVD read and read/write drives. The application performing the activity must use the Windows IMAP interface (Image Mastering Applications Programming Interface). If Window’s Explorer is used to manage CD/DVD activity, logoff and then log back on for this setting to take effect.

Local - Includes your local hard drive (or drives). Be very careful choosing this setting. Windows generates a large number of file operations on local hard drives, and you probably don't want to record ALL activity. Use limited tracking or File Name Filtering if you plan to track local drives.

Network - Includes all drives accessible but not physically attached to your computer and includes any location accessed using a UNC specification.

Removable - Includes media that can be removed from the drive. This includes devices such as floppy drives, zip drives, USB storage devices, and memory sticks.

Other - Any device that does not fit into one of the above categories.

To configure file tracking for each drive:

You can specify exactly what is tracked on a specific drive. This works for any drive mapped to the drive letters A: through Z: on your computer or any location accessed using a Universal Naming Convention (UNC) specification (the last choice in the list of drives). If a new drive becomes active, it automatically appears on the list with its mapping. Spector Pro uses Default Tracking on all drives unless you specify otherwise. For a full explanation of Default Tracking, click here.

"Use Default" means that no file tracking is turned on unless you specifically turn it on. Use the Default Tracking button to change what "Use Default" means for all drives.

1. Select a drive from the list of drives. Scroll down to see all drives.

2. Click Edit to change the Tracking Settings for this particular drive. Your choices are:

Do NOT Track files on this drive - Turn off all file tracking on the drive.

Use Default File Tracking - Use Default File Tracking for this drive (the default).

Use Custom File Tracking, Track if... Creating a New File - Capture information when a new file is created. Writing to an Existing File - Capture information when an existing file is opened for writing. Deleting a File - Capture information when an existing file is deleted. Renaming a File - Capture information when a file is renamed.

3. Click OK on the Tracking Settings box to return to Document Tracking settings.

To change Default Tracking:

When Configure File Tracking Options for each Drive is selected, you can also change the tracking applied to all drives you do not specifically configure. Click the Default Tracking button.

To filter document tracking:

Spector Pro allows you to filter document tracking to record only file activity that you are interested in. You can configure the system to include or exclude specific files types (by indicating an extension), specific file or directory names (by indicating a word or words), files in a particular location (by indicating a path or drive), or any combination of these.

1. Select a type of filter: Include - Track ONLY the files specified. Exclude - (Default) Track all files EXCEPT those specified. 2. Click Add to add a file filter. The File Filter window opens.

3. Type in the filter rule. Use the format drive:\path\filename.filetype The filter allows the * and ? wildcards in drives, paths, and filenames. In the illustration above, Spector Pro will assume ALL drives, ALL paths, and ALL file types. Use * (asterisk) to match any characters. Use ? (question mark) to match a single character. For example, to specify:

All word documents *\*.doc

All documents in any directory with *\*private*.* the word "private" in the file name

All documents on the C: drive with the c:\*\*private*.* word "private" in the file name

All documents on the C: drive with the \\192.168.1.20\*\*\*.* word "private" in the file name

All Word documents at any UNC \\*\*\*\*.doc location

All Word documents on any lettered *:\*\*.doc drive

All documents with the file type "as" *.as? plus one additional letter (as in .asp)

4. Click OK to close the box add the rule to the filter list, or Cancel discard the filter. Click OK on the Profiles panel to save the change.

To track printing and burning:

By default, Spector Pro tracks all printed documents and Windows XP CD/DVD burning.

Track Printed Documents - Check to track all documents sent to a printer. Clear to disable the tracking of printed documents. Track WinXp CD / DVD Burning (IMAPI) - Check to record documents written to and burned on Windows XP CD/DVD devices using IMAPI. Clear to disable this tracking. Click OK to save the changes you have made, or click Cancel to discard them. The Settings window closes.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Changing Default Tracking

The Document Tracking profile settings allow you to adjust tracking for most needs, either by drive type or on a drive-by-drive basis. It is also possible to change the Default Tracking settings that apply to all drives you do not customize. The ability to change Default Tracking makes it possible to configure multiple devices at once instead of customizing every single drive.

To adjust default Document Tracking:

1. Select Profiles > Record > Document Tracking. 2. Select Configure File Tracking Options for each Drive. 3. Click the Default Tracking button. Default Tracking works according to drive type. A specific drive set to "Use Default" will use the default tracking for the drive type it is. This is significant because different devices can be mapped to the same drive at different times. As a result, the same drive letter may represent a different drive type at different times; for example, drive G: may be a network drive one day and a removable USB device another day.

It is recommended that you do not change the Default Tracking settings, or that you make changes with caution. Adding tracking for the C: drive, for example, could potentially create thousands of entries that would create an unmanageable amount of data.

To change the default tracking for all drives:

1. On the Document Tracking Profiles panel, select Configure File Tracking Options for each Drive and click on Default Tracking. The Default Document Tracking Settings window opens. 2. Check the Track if activities you want to watch by default.

Creating a New File - Capture information every time a new file is created.

Writing to an Existing File - Capture information every time an existing file is opened for writing. Just because you open a file does not mean you actually write to it. You may open a file and read it; you may copy or delete a portion of it, or you may save it to a new location with a new name.

Deleting a File - Capture information every time an existing file is deleted. This is useful if files are missing and you want to know who deleted them and when.

Renaming a File - Information is captured every time an existing file is renamed. This can be helpful if you are trying to track a file through the system. Many applications create temporary files while you are editing an original. When you are done editing, the original file is deleted and the temporary file is saved. 3. Check the Drive Type to which to apply this default tracking:

CD ROM - Includes all CD and DVD read and read/write drives. The application performing the activity must use the Windows IMAP interface (Image Mastering Applications Programming Interface). If Window’s Explorer is used to manage CD/DVD activity, logoff and then log back on for this setting to take effect.

Network - Includes all drives accessible but not physically attached to your computer and includes any location accessed using a UNC specification.

Removable - Includes media that can be removed from the drive. This includes devices such as floppy drives, zip drives, USB storage devices, and memory sticks.

Other - Any device that does not fit into one of the above categories.

4. Click OK to close this box and set the Default Tracking for the selected Drive Type(s) or Cancel to discard the changes.

Applications must be closed for this change to go into effect.

When to Record

If you don't change this setting, Spector Pro records (as requested) all the time the computer is on. However, there may be certain times of the day or certain days of the week when you do not want Spector Pro to record. For each user profile, you can set a recording schedule. For example, you may want to record activity only after school when the kids are doing their homework. Or, you may want to record specific employees only during working hours.

To turn on scheduled recording:

Click to mark the Record based on the following schedule checkbox. Now you can set a schedule, and Spector Pro will ONLY record when you tell it to. Clear the checkbox to disable scheduled recording and return to recording at all times.

To set a schedule:

The Record... checkbox must be checked. Click on the calendar grid and hold down the mouse button to drag green coloring over the time periods when you want to record. Green is "ON," and any green blocks of time on the grid show when recording is active. Click (or click and drag) on a green area to turn "OFF" recording (toggle it back to white). Cleared time periods are when recording does NOT occur.

To see exactly what you have scheduled:

Click the View Scheduled Times button below the calendar grid. A box opens, showing the exact record times for each day of the week. Click Close to close the box.

To clear the schedule and start over:

Click the Clear Entire Schedule button below the calendar grid. This clears all green from the schedule, making it easy to start a new schedule.

Changing the Alert Profile

Defining a Keyword Watch List

Spector Pro has the ability to immediately alert you when it encounters a keyword or phrase — typed in a document, in a web page or web URL, in an email or elsewhere. You can view the log of alerts in the Keywords Detected view. In addition, you can turn on Keyword Alert notification by email and take additional snapshots when a keyword is detected to obtain immediate and complete information. Initially, Spector Pro does NOT watch for keywords; you must supply a list of words or phrases. To set up your keywords, select Profiles > Alert > Keyword Watch List.

When you enable Keyword Alerts, Spector Pro scans Chat/IM, Email, Web Sites Visited, Keystrokes Typed, and File Transfer information, as you direct it to. Of course, you must have recording enabled for each activity type to get the full Keyword scan!

To turn alerting off or on:

Click the red OFF button in the left list of Record settings to toggle it to ON. Click the green ON button to toggle it OFF. - Or-

Select ON in the right side of the profile panel to turn on keyword recording. Select OFF to turn this recording off. You must define at least one keyword for any recording to occur. This setting applies to the currently selected profile. In the illustration above, the setting applies to any user who does not have a profile.

To add keywords to the watch list:

1. On the Keyword Watch List panel, enable Keywords Scanning. Select ON 2. Add keywords or phrases to the Keywords list.

Add words one at a time as described here or add Import multiple keywords from a text file list. If you need to save the Keywords list for another Spector Pro installation, use the Export option.

3. Click Add to add a keyword. In the box that appears, type a word or phrase. All characters, spaces, and punctuation are accepted. See Keyword Tips for ideas. Select Match whole word only if you want Spector Pro to find the word/phrase exactly as you enter it. If you do not select this option, Spector Pro will find any partial match, such as "girl" or "wild."

4. Click OK to accept the keyword or phrase and add it to the Keywords list.

To remove keywords:

Select a word in the Keywords list and click the Delete button.

To tell Spector Pro where to watch:

Under Keyword Sources, select activities you would like to watch for these Keywords.

Recording must be on for the activity type in order to scan data and detect keywords.

Scan Chat and Instant Messages - Check to scan the content of chat and IM conversations for a keyword match. Clear to skip Chat/IM conversations. Chat/IM recording must be ON. Scan Emails - Check to scan the content (body), subject, and To/From fields of sent and received email for a keyword match. Clear to skip email. Email recording must be ON. Scan Web Site Addresses - Check to scan web site URLs and domains for keywords. Clear to skip web site addresses. Web Sites Visited recording must be on. Scan Web Site Pages - Check to scan all content of web site pages for a keyword match. Clear to skip web page content. Scan Keystrokes - Check to scan the content of all keystrokes typed (following any edits or deletion) in any application. Clear to skip keystrokes. Scan File Transfer Information - Check to scan the file names and locations involved in uploads and downloads. Clear to skip File Transfers.

To tell Spector Pro to take extra snapshots:

You can direct Spector Pro to take additional snapshots when a keyword is detected. When you enable Record Keywords, this option is selected by default. The default setting is to take a snapshot every 5 seconds for a minute. This provides about a dozen extra snapshots of activity when a keyword is detected.

1. Check Trigger Snapshot Recording to take a snapshot when a keyword is detected. Clear this option if you prefer not to take extra snapshots when a keyword is detected. See Snapshots - When and How Often for other snapshot trigger settings. 2. Raise or lower the every... seconds number to specify how frequently to take a snapshot (1-999). Lower numbers provide more snapshots.

3. Raise or lower the for... seconds number to change the time period over which to take extra snapshots (1-999 seconds). Higher numbers provide a longer period of time for increased snapshots.

A long list of keywords could generate significant numbers of snapshots, which use up disk space. Be careful how you set up keyword detection and extra snapshots.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Importing Keywords

Instead of adding keywords and phrases one at a time in the Alert settings, you can import a ready-made list. To import a keyword list, you need either a list previously exported from Spector Pro or a list in a text file that you create. To import a list of keywords, select Profiles > Alert > Keyword Watch List. You can import more than one keyword list. You can add to a keyword list and re-import it. Each import adds to the keywords already listed. Any new words are added, and any repeated words are ignored. To remove keywords from the Alert panel, select and Delete them explicitly.

To import an exported list:

If you are about to upgrade Spector Pro, or if you have multiple licenses and plan to install it on another computer, you may want to export a keyword list you've already created to a text file. You can then import this text file for the new installation.

1. First, Export the keywords you want to use at the recorded computer where the keywords are listed. 2. Then, open Spector Pro at the recorded computer where you want to import the list and select Profiles. 3. Select the Alert settings.

4. Turn ON Keyword scanning. 5. Click the Import button. 6. Use the Import From dialog box to navigate to the exported keywords file. Select it and click Open. The list loads into the Alert settings panel.

To create the text file:

You can create a text file similar to the one Spector Pro automatically creates when it exports keywords. Use any text editor, word processor or spreadsheet application that supports text (.TXT) output. Then, simply Import the list into Alert settings. 1. Open a text editor, such as Microsoft Word or Notepad. 2. Enter each keyword or phrase on a separate line. 3. Save the file as a text (.txt) file. Follow these guidelines: Enter one keyword or phrase per line separated by (line feed or carriage return). Use 0 (zero) following a keyword to find a partial word within other words. Use 1 (one) following a keyword to Match whole word only and find the exact phrase.

Use # (number sign) at the beginning of the line to indicate a comment. This line will be ignored when the list is imported. Save the keyword list as a text (.txt) file.

To import the text file:

1. Open Spector Pro Profiles and select the Alert panel. 2. Click the Import button next to the Keywords list box. 3. Use the Import From dialog box to navigate to your .txt keyword list. Select it and click Open. The list loads into the Alert settings panel.

Exporting Keywords

You may want to export your Keyword list before upgrading eBlaster, or to repeat the keywords on another eBlaster installation. It's possible to create several lists and import them as needed for different purposes. For example, you might find separate uses for drug-related keywords, porn-related keywords, and purchase-related keywords. To export keywords, select Profiles > Alert > Keyword Watch List and click Export.

The Export feature for keywords is available ONLY from the local Viewer at the recorded computer.

To export Keywords:

1. At the recorded computer where you want to export keywords, open Spector Pro, to the Keyword Watch List profile panel.

2. Edit the list if necessary, and when the list is ready, click the Export button. 3. In the Export to box, navigate to a folder and type in a file name. You don't need to specify a file extension, but a text file will be created. Click Save to save the export file.

The file you create can now be imported to a new installation or to an upgraded installation. If you've saved the file on the recorded computer, be sure to move the export file to media and delete it from the hard drive of the recorded computer to maintain security.

Setting up Alert Notification

You can request that Spector Pro send you an email immediately when a keyword is detected. While you're at work and the kids are home alone, you are not in the dark regarding what they're doing on the computer. Use the Alert Notification settings to turn on email notification, define how often to repeat notification, select a mail server through which to secretly send notification, and specify the email address where you want to receive notification. To set up alert notification, select Profiles > Alert > Alert Notification.

The monitored computer must have direct access to the Internet for Spector Pro to generate an alert notification email.

To turn on email notification:

Check Send Email Notification at the top of the Alert Notification panel. This activates the following options. Clear to skip email notification. You can still view a log of Keywords Detected in under All Recordings in the Viewer.

To set the email frequency:

Once Every . . . Mins - Use the up or down arrows to select the frequency with which you want to receive email notification alerts. Spector Pro can send you an alert each time it detects a new keyword (this does not include multiple instances in a single location). However, to ensure that you are not flooded by emails, you can set the notification interval. Spector Pro sends an alert only once, for any given keyword, during the specified interval. It will NOT send subsequent alerts until the configured number of minutes has passed. The default interval is 5 minutes.

To set the mail server and address:

1. First choose the email Server Type from the drop-down list through which to send the alert notification. See below. 2. Then, enter the Email Address where you want to receive email notification alerts. 3. Finally, if you are using Direct SMTP or Relay SMTP, click Advanced to set up the email delivery server name, account, etc.

If you do not have experience with email servers, you may wish to keep the default setting or consult SpectorSoft Technical Support before making changes.

SpectorSoft Server - Select to send email alerts through the SpectorSoft email server. This is the default and easiest method, requiring no Advanced settings. The SpectorSoft server ensures privacy and is only a temporary relay to your designated email address; email does not reside on the SpectorSoft server once it is forwarded to you. If a computer does not have access to the Internet, or if you are using a proxy server to relay information to the Internet, you should use the SpectorSoft Server, because this delivery method allows you to configure a Web (HTML) proxy server to deliver the email. See Advanced Email Alert Settings. Direct SMTP - Select to send email alerts directly to an SMTP mail server. For example, if the monitored computer is behind a firewall that blocks access to the SpectorSoft server, you can send it directly to your network mail server via Direct SMTP. For example, if you want to receive the email at me@mycompanycom, the email would be routed directly to the mycompany.com email server. Many Internet mail servers will not approve Direct SMTP mail requests, and Relay SMTP may be required. See Advanced Email Alert Settings. Relay SMTP - If you don't want to use the SpectorSoft Server to deliver the email, you can relay it to another SMTP mail server. Relay SMTP delivery provides the same credentials to the server that you would provide to a normal email client (such as Outlook or Thunderbird). Use this method if you want to bypass your work or the SpectorSoft server and use a known account on an email server. See Advanced Email Alert Settings. Exchange Folder - Select this if the monitored computer is connected to a Microsoft Exchange public folder. If you are monitoring several computers on a corporate network, it's possible to send all alert notification email to a Microsoft Exchange public folder for management purposes. The recorded computers must be on the Exchange network or the reports will not be delivered. If selected, the Email Address field is replaced with a Folder Path field. Type the public folder name of your Exchange server. Include the folder to which you will direct the alert email. No changes on the Email Settings window are required, although you may go there to change Optional Email Settings. See Advanced Email Alert Settings.

To test the email

Test Email - Click this button ensure that email notification alerts can be sent. Note that you MUST first set up DIRECT and RELAY SMTP servers using the Advanced button to have success with these methods of delivery. A message appears telling you that this action will save the current settings, and asking if you wish to continue. Click Yes to register the email address, or No to stop the process. If you select Yes and the test is successful, you will receive an email message stating that you can start receiving email notification alerts. In addition, a message appears informing you that the test email message has been successfully sent.

To set additional, advanced options:

Click Advanced. The Advanced Alert Notification Settings allow you to Set up Direct SMTP email Set up Relay SMTP email Change the encryption setting (TLS) Set up a "friendly" from address and subject for discretion Configure a Proxy Server (must use the SpectorSoft Server)

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Advanced Alert Notification Settings

Advanced email alert settings only need to be adjusted if you are using the Email Notification Alerts feature. Use Advanced Email Settings to:

Configure a Direct SMTP

Configure a Relay SMTP server Configure TLS (encryption) - You may need to obtain some of this information from your network administrator

"Friendly From" settings - Make alert email appear as if it does NOT come from Spector Pro

Configure a web proxy server To access advanced settings, select Profiles > Alert > Alert Notification and click the Advanced button.

To configure Direct SMTP delivery:

If you have selected Direct SMTP on the Alert Notification panel, you have only one field to enter in the Advanced Email Information section: the Domain of the server. Use either the server's domain name or the server's IP address.

Test Email - Click this button to test Direct SMTP to the server.

The Direct SMTP method of delivery can be inconsistent. You are sending this mail directly from the computer to the server, and many mail servers now deal with the problem of Spam by refusing to accept Direct SMTP from a computer (rather than from an ISP). Be sure to test the email delivery before settling on this choice. You're likely to have better luck with Relay SMTP.

To configure a Relay SMTP:

If you have selected Relay SMTP on the Alert Notification panel, fill in the following fields on the Advanced Alert Notification Settings box:

Mail Server - Enter the name or IP address of a remote SMTP mail server (not a webmail server). SMTP Port - Enter the port used by the SMTP server. The default port for most SMTP outgoing mail is 25. Be sure to check your actual email client setup to find out which is the preferred port for outgoing mail. The email test will fail if the wrong port is used. Authentication - Change the selection from None to POP or ESMTP if the mail server requires authentication — a login — for outgoing mail (most do). This activates the next fields.

Account Name - Enter a valid account name for the email server (same as you would enter for an email client). Password - Enter the valid password for the account name. TLS - Select Do Not Use (default), Use if Available (encrypt the email if possible), or Required (TLS encryption is required). Transport Layer Security (TLS) encrypts communication to block outside parties from viewing the data during transmission. This is an extra security measure. Validate Server's Certificate - If you are using TLS, you can select this option for extra security. A certificate verifies the identify of a web site thereby providing a secure communications channel.

To configure optional email settings:

Use these settings if you want Spector Pro to make keyword alerts appear as if they are coming from a source other than Spector Pro. Friendly From - Type a name which identifies the sender as something other than an email address. From Address - Type the email address that you want Spector Pro to use. The default is noreplyspectorsoft.com. Subject - This is what appears in the Subject line when you receive an alert. If Spector Pro is installed on multiple computers, you should supply each one with a different Subject so you can immediately tell from which computer the alert is coming. The default is Spector Alert on Computername, where Computername is the actual name of the computer where the keyword was found (the computer on which Spector Pro is installed).

If anyone replies to an email alert, they are replying to the email address typed in this field.

To configure a proxy server:

If you have selected the SpectorSoft server type on the Alert Notification panel, you can configure a proxy server. You may need a proxy server if the recorded computer is behind a firewall or part of a corporate network and you need Spector Pro to contact the SpectorSoft mail server directory through a different server. The proxy server must be a web proxy server (HTML proxy). Computer Uses Proxy Server - Click to enable this option if your company has a proxy server setup to relay information, so that Spector Pro can contact the SpectorSoft mail server directory through it. If you enable proxy server support you will most likely keep the Mail Server entries blank.

Address - Identify the computer you will be using as a proxy server by IP address or domain name. Next to Address, type the computer's IP address or a name that can be resolved on the network. HTTP Port - If your company uses a different port, enter it here. The default is 8000.

Keyword Tips

Defining keywords takes practice. If you are not specific enough, you will get a flood of Alert email; if you are too specific, you will not receive an Alert when you expect one. Avoid smaller, common words. "Job" will be found in too many cases. "HeadHunter," "New Job," or "Job Hunt" will have better results. When a web site where you want to watch activity comes to your attention, use the domain name or URL itself as a keyword. For example, "monster.com" will be matched whenever someone goes to or types the URL for the web site. Take advantage of the option setting to Match the whole word only. This matches the keyword standing by itself and not the keyword as part of another word or as a partial word: "Head Hunter" and NOT "Head." A keyword is NOT recorded when it is located in: a snapshot event a program event an email attachment an encrypted web site (accessed through SSL protocol and typically addressed with https:\\ ) a compressed web site (such as Yahoo)

Define your keywords one at a time in the Keyword Watch List or create a list of keywords to import into the Keyword Alert Settings. The following lists are examples that may provide ideas.

Gambling Keyword List Job Search Keyword List

casino Resume betting Recruiter gaming Employment agencies blackjack www.monster.com poker www.hotjobs.com roulette www.brainbuzz.com wagering usajobs.gov horse races www.careerbuilder.com video poker www.job-hunt.org online betting www.ajb.dni.us online gambling www.job.com horse racing computerjobs.com www.gaming.com www.employmentguide.com www.gambling.com www.888.com

Shopping Keyword List Sexual Activity Keyword List

www.amazon.com porn www.ebay.com sex www.barnesandnoble.com nude target.com Britney Spears Shopzilla.com Pam Anderson Shopping.com Paris Hilton PriceGrabber.com Jennifer Lopez Froogle.com Angelina Jolie Brilliantshopper.com erotic shoplocal.com maximonline walmart.com AdultFriendFinder www.samsclub.com goto.adultcinema shopping.com playboy shopping.msn.com playgirl www.bizrate.com www.hsn.com shopper.cnet.com

Changing the Block Profile

Blocking Access

Spector Pro allows you to control who access what on the Internet. The Blocking feature assists parents or employers who want to proactively filter inappropriate or unauthorized material before it is viewed on the computer, or who want to prevent access to one or more sites and applications in response to those sites or applications being visited. No access is blocked until you (a) change the Profile settings or (b) click a Block button on the toolbar while viewing activity. For each User Profile you can block:

Web Sites - All or ones that you name. Chat / IM Contacts - All or ones that you name. Internet access - By function or port; for example, block Kazaa communication. Schedule blocking - You can schedule when blocking occurs.

From a Viewer Only installation you cannot block web sites or Chat/IM while viewing activity.

What Blocking Does When Spector Pro is configured to block a web site, the user will not be able to access the web site. Different web browsers handle this in different ways. Some return a Page Not Found error; others may delay loading for a long period of time and eventually return a timeout error. When Spector Pro is configured to block a Chat/IM contact, the user can attempt to start a conversation, but messages are never sent, and messages from the blocked contact are never received. Spector Pro will record the messages the person tries to send, but the connection to the contact cannot be made. When Spector Pro is configured to block an Internet function and the user attempts to access it, the user will most likely get an error message of some kind when their selected application cannot reach the Internet.

Blocking will not take effect until the user restarts or logs out and back into an application. Make sure all web browsers and Chat / IM windows are closed and users are signed out when you set up blocking.

Does Blocking Apply to All Users?

Blocking applies to User Profiles. If you block a web site or Chat / IM contact while viewing activity, by default you block ALL OTHER USERS, but if you have selected a different user profile, blocking applies to that profile. Use the Profiles button to access the Block panel and specify exactly what should be blocked from whom.

Example The monitored computer is used by 13-year-old Raphael and 8-year-old Michael, yourself and your husband. You want to block the boys from accessing AOL Instant Messenger. Select Raphael's user profile and set up blocking. Then select Michael's user profile and set up blocking.

Example Because Michael is much younger, you decide to allow him to visit only a select few web sites. Open Profiles, select Michael's profile and Block. Select Allow access ONLY to web sites in list and specify the child-friendly sites that you would like to allow him to visit.

Example You later learn that Raphael has been visiting www.badsite.com, and you decide to block it. Add the web site to the list in Block Web Sites for Raphael's profile.

How Does Blocking Work with Recording? Block and Record settings give you maximum control over the twin capabilities: what can be accessed by the user and what is recorded by Spector Pro. It is important to understand that you cannot block anything that is not being recorded. Whenever you exclude an activity or a program from being recorded, you eliminate the possibility of blocking it.

Example - Only Outlook Express is being recorded You have decided that Outlook Express is the ONLY program you want to record, and you have chosen to block ALL Internet access. Since it is the only program recorded, Outlook Express is the only program blocked.

Example - All programs EXCEPT Outlook Express are being recorded You have decided to record all programs EXCEPT Outlook Express, and you have chosen to block ALL Internet access. Since it is the only program not recorded, Outlook Express is the only program not blocked.

Example - Recording is on a schedule You have blocked a number of web sites, but Spector Pro is set only to record a few hours in the afternoon. The web sites will NOT be blocked while recording is NOT taking place. For effective blocking, leave Spector Pro recording on all the time.

Block Web Sites While Viewing Activity As you view recorded events, you can immediately block a web site. The blocking will apply to the User Profile currently active under Profiles.

To block web sites while viewing activity:

1. While viewing Web Sites Visited, select the domain, subdomain, or a specific web page and click the Block Web Site button on the toolbar.

2. A message appears asking you to confirm how much to block. If you selected a page, you have the option of blocking either the entire web site (facebook.com) or just the area selected (upload.facebook.com). If you selected just the domain from the Navigate pane, the entire web site will be blocked.

3. Click OK to accept the block, or Cancel to discard it. You can always change blocking by opening the Profile settings.

Block Chat/IM While Viewing Activity Spector Pro allows you to block a contact name from any Chat/IM Activity view, including MySpace or Facebook Chat/IM. The blocking will apply to the User Profile currently active under Profiles.

To block Chat/IM while viewing activity:

1. Locate a particular event (contact name) in the Event pane that you want to block, and click to select it. 2. Click Block Chat / IM in the toolbar. The Block Chat / IM Access window opens and the required contact information appears in the window. Information is different depending on the type of chat / IM. See Blocking Chat / IM

Sometimes, the program cannot capture the contact name, and you receive a message telling you to manually enter the name. Click OK and the appropriate Block Chat / IM Access window opens. Type in the required information and click OK.

3. Click OK to accept the block, or Cancel to discard it.

Blocking Web Sites

Spector Pro gives you the flexibility to block ALL web sites, block specific web sites, or allow access to specific web sites. Initially, Spector Pro does NOT block web sites; you must supply a list of sites to block or allow. To set up web site blocking for all or specific users, select Profiles > Block > Web Sites Visited.

Web Sites Visited recording must be ON in order for access to web sites to be blocked. Note that you can also block web sites using the toolbar button in the Web Sites Visited view.

Examples Thirteen-year-old Gabriel is a great kid but has a penchant for illegally downloading music. You do not want it to happen, so you conduct an online search on "download music" and you block the web sites that provide free downloads. Sixteen-year-old Bobby has gone too far and his consequence is to take away the Internet for a while. Block access to all web sites until next Thursday. Eight-year-old Miranda only needs to access a couple of fun web sites that you have found for her. Add these to the list and stop worrying.

To turn web site blocking off or on:

Click the red OFF button in the left list of Block settings to toggle it to ON. Click the green ON button to toggle it OFF. - Or- Select ON in the right side of the profile panel to turn on keyword recording. Select OFF to turn this recording off. If you turn ON web site blocking but do not specify any web sites to block, Spector Pro will assume you wish to block ALL web sites.

To add web sites to your block (or allow) list:

1. Turn ON Block Websites. 2. Decide whether you will block or allow specific web sites:

Block web sites in list- Select to block ONLY the web sites in this list.

Allow access ONLY to web sites in list - Select to allow access ONLY to the web sites in the list.

Using "Allow access ONLY" may have unintended consequences. For example, if you allow access only to www.cnn.com, you might expect that the user will be able to browse anything on the CNN web site. For the most part this is true, but because the web site automatically loads pages and information from other domains to provide content, some content otherwise available from CNN would be blocked.

3. Add web sites to block or allow. See Importing Web Sites to block if you have a list of known sites to block (or allow). Click Add to add web sites one at a time. The Web Site Access window opens.

4. Enter a web site domain (such as yahoo.com). Entering the domain name blocks all access to the web site. For example, if you enter "yahoo.com" as the domain name, then mail.yahoo.com, new.yahoo.com, and weather.yahoo.com are blocked, along with anything else that has xxx.yahoo.com in the URL. If you enter a specific name such as "mail.yahoo.com," then only web pages whose address begins with mail.yahoo.com are blocked. For example, mail.yahoo.com/us/florida/visit.htm would be blocked. 5. Click OK to accept the entry, or Cancel to reject it. The window closes and if the selection was accepted, the program is added to the Block (or Allow) list. 6. Add all web sites to block or to allow.

There are potential performance issues when you have large lists of web sites to block. The limit for the number of URLs you can block is 1000 entries.

To delete an entry in the Block Access list, click to select it and then click Delete. A confirmation message appears asking if you are sure you want to delete the selected web site. Click Yes to accept the deletion, and the entry is removed. 7. Click OK to save the changes you have made, or Cancel to remove them. The Settings window closes.

To block all web sites:

1. If you have determined that you want to block access to all web sites, from the Block Web Sites pane click Block Web Site Access. 2. Click Allow access ONLY to web sites in list. 3. Do not add any web sites to the list. 4. Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

Blocking If You Use a Proxy Server If you are using a proxy server and the server does not use a standard port for HTTP (port 80) and / or secure HTTPS (port 433), you must enter the proxy server port(s) in the Advanced Web Site Settings window before you can block any web sites. For example: Your proxy server address for HTTP traffic is 192.168.1.100:2280 (with 2280 being the port number). Enter 2280 in the HTTP field.

To locate the port number(s):

1. In Internet Explorer, select Control Panel > Internet Options, and then click the Connections tab. 2. Click the LAN Settings button to open the LAN Settings window. If a proxy server is used, Use a proxy server for your LAN is checked off.

3. Click Advanced to open the Proxy Settings window. 4. Record the port number(s) appearing in the HTTP and Secure fields.

NOTE: If the proxy server is configured to use the same port for HTTP and HTTPS, an IP address and port are displayed only in the HTTP field. Record the port number.

To enter the port number(s) in Spector Pro:

1. Click the Settings button to open the Settings window. 2. Locate Web Sites Visited and click to open the Web Sites Visited pane. 3. Click Advanced. A warning appears. Click Yes to proceed. The Advanced Web Sites Settings window opens.

4. Enter the appropriate port number(s):

If there are two ports associated with the proxy sever, enter the HTTP port number in the HTTP Ports field, and enter the Secure port number in the HTTPS Ports fields.

If there is one port associated with the proxy server, enter the port number in the HTTP field.

Importing / Exporting Web Site Lists The Import / Export feature allows you to save a list of web sites that has already been constructed in Spector Pro, so that you can import it to other networked computers. This is especially useful if you have multiple installations of Spector Pro. See:

Importing Web Sites to Block Exporting Web Sites to Block

NOTE: An exported file is not hidden or protected by our stealth technology. Anyone with access to the directory where you save it, can view it.

Importing Web Sites to Block

Instead of adding web site domains one at a time in the Block Web Sites Visited settings, you can import a ready-made list of web site domains. To import a list of domains, you need either a list previously exported from Spector Pro or a list in a text file that you create.

The Import feature for web site blocking is available ONLY from the local Viewer at the recorded computer.

You can import more than one list of web sites. You can add to a text file (or export) of web sites and re-import it. Each import adds to the web sites already listed. Any new domains are added, and any repeated domains are ignored.

Import an Exported List If you are about to upgrade Spector Pro, or if you have multiple licenses and plan to install it on another computer, you may want to export a list of blocked web sites from an existing installation and import it for use in a new installation.

To import an exported list:

1. First, Export the list of web sites you want to use.

2. Then, access the Settings for the computer where you want to import the list. Select Block.

3. Turn ON Web Sites Visited blocking. 4. Click the Import button. 5. Use the Import From dialog box to navigate to the exported keywords file. Select it and click Open. The list loads into the Alert settings panel.

Import a Text File List of Web Sites If you wish, you can create a text file similar to the one Spector Pro automatically creates when it exports web sites. Use any text editor, word processor or spreadsheet application that supports text (.TXT) output. Then, simply Import the list into Alert settings.

To create a list of web sites:

1. Open a text editor, such as Microsoft Word or Notepad. 2. Enter each web site domain on a separate line. 3. Save the file as a text (.txt) file. Follow these guidelines: Enter one domain per line separated by (line feed or carriage return). Use # (number sign) at the beginning of the line to indicate a comment. This line will be ignored when the list is imported.

To import a list of web sites:

1. Open Spector Pro Profile, select the Block panel and Web Sites Visited. 2. Click the Import button next to the web sites list box. 3. Use the Import From dialog box to navigate to your .txt list of domains. Select it and click Open. The list loads into the Block Web Sites settings panel.

Exporting Web Sites to Block

You may want to export your list of blocked web sites before upgrading Spector Pro, or to reuse them in another Spector Pro installation. It's possible to create several lists of web site domains and import them as needed for different purposes. For example, you might maintain one "Blacklist" of sites to BLOCK that no one should go to, and a "Whitelist" of sites to ALLOW that are the only ones young children should go to.

The Export feature for web site blocking is available ONLY from the local Viewer at the recorded computer.

To export a web site list:

1. Open Profiles and select Block and Web Sites Visited. The web site domains listed on this panel will be exported. 2. Click the Export button. 3. In the Export to box, navigate to a folder and type in a file name. You don't need to specify a file extension, but a text file will be created. Click Save to save the export file.

The text file list of web sites can now be imported on another computer, or after you upgrade Spector Pro. If you've saved the file on the recorded computer, be sure to move the export file to media and delete it to maintain security.

Blocking Chat / IM

When it comes to chat and instant messaging (IM), the concern is usually who, rather than what or when. Spector Pro gives you the ability to block incoming and outgoing chat / IM communications with specific people, when the chat or messaging used is AOL/ICQ, Yahoo Messenger, Windows Live Messenger, or MySpace. When Spector Pro is configured to block a contact name, the user cannot tell a chat / IM was not sent. Spector Pro still records the data of the blocked conversation and you can still see it in the various chat / IM tabs in the Viewer (as long as recording for chat / IM is turned on).

Before turning on blocking, close all applications and log off all users to ensure that the new settings take effect immediately.

Examples Fifteen-year-old Michael has struck up an instant messaging relationship with someone who you don't know and the conversations don't sound right. Your instincts tell you to put a stop to it, without arguing. Block the other person's contact name and the conversations will come to an end.

Twelve-year-old Oliver has been told over and over again to stop spending so much time "talking" to his new girlfriend. He spends every waking moment instant messaging her, even when he is supposed to be doing his homework. When the warnings aren't heeded, you can take steps to block her contact name, or his - or both. You notice that fourteen-year-old Melissa is spending time in a chat room and you aren't happy with the subject matter. Block a contact name or block an entire Yahoo chat room so that she cannot access it.

To block a Chat/IM contact while viewing activity:

1. Make sure the profile you want to affect is selected under Profiles.

2. Select the Chat/IM Activity view under All Recordings. Select a conversation in the upper Events list where the person you are monitoring "Chatted With" the contact you wish to block. 3. Click Block Chat/IM on the toolbar. 4. A Block Access window appears for the program that was used. Verify that the contact (email address, sign-on name, etc.) is the one you wish to block. Click OK. Note that the contact's account does not necessarily have to be "in network" for the application being used. For example, a Yahoo contact can communicate with a Windows Live Messenger user. Block Chat/IM Access for the current Profile is automatically enabled, and this account is added to the list of contact names to block.

To block a Chat/IM contact from Top 10:

5. Make sure the profile you want to affect is selected under Profiles.

6. Select the Chat/IM Activity view from under the Top 10 tab. 7. Find the "Chatted With" contact you wish to block and click the Block Chat/IM button for that contact. If the contact can be blocked, the button turns pink and is labelled "UnBlock Chat/IM." Block Chat/IM Access in Settings is automatically enabled, and this account is added to the list of contact names to block.

To block Chat/IM access in Profile settings:

Select Profiles > Block > Chat/IM Activity. Click the red OFF button in the left list of Block settings to toggle it to ON. Click the green ON button to toggle it OFF. - Or- Select ON in the right side of the profile panel to turn on keyword recording. Select OFF to turn this recording off.

To add contacts to the block (or allow) list:

1. Turn ON Block Chat/IM Access. 2. Decide whether you will block or allow specific web sites:

Block contact names in list- Select to block ONLY the contacts in this list.

Allow access ONLY to contact names in list - Select to allow access ONLY to contacts listed here. If you select this option, but do not specify any contacts to allow, Spector Pro will assume you wish to block ALL AOL, Yahoo, and MSN contacts. 3. Click Add. The Chat / IM blocking window opens.

4. Use the dropdown list to select the type of Chat/IM account or application being used for conversations. Even if the contact you wish to block is using a different type of Chat/IM, select the type of Chat/IM the local user logs in to.

AOL/ICQ - Select if the person you are monitoring uses AOL, AIM, AIM Express, Dead AIM, ICQ 2002, ICQ 2003 or ICQ Lite. Enter the Screen Name of the contact you want to block. For ICQ, enter the User Identification Number (UIN).

Yahoo - Select if the person you are monitoring uses Yahoo Messenger, Yahoo Chat 2.0, or an online Yahoo chat room. A Yahoo ID might be friend88; the ID of another contact participating in these Yahoo sessions might be a full email address, [email protected]. To block access

to a Yahoo Chat Room (available from Yahoo Messenger), enter the name of the Chat Room; for example: Gardening:6. You can get the name of Yahoo contacts and the Chat Rooms being used from the Chat/IM Activity view.

MSN - Select if the person you are monitoring uses MSN Messenger, Windows Live Messenger, or MSN Exchange Client. Next to Email Address, enter the full email address of the contact you wish to block (or allow), such as [email protected] or [email protected]. Blocking an internal MSN Chat/IM contact is not supported.

MySpace - Select if the person you are monitoring uses MySpace Instant Message or Myspace Beta to chat with contacts. Enter the Display Name and the User Profile ID you want to block. Both the Display Name and the numeric User-Profile ID appear in the Chatted with column in the Chat / IM Activity view.

5. Click OK to accept the information, or Cancel to reject it. The window closes and if the information was accepted, it is added to the Block Contacts list. 6. Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

To delete an entry in the Block Contacts list:

Select the name and then click Delete. A confirmation message appears asking if you want to delete the contact name. Click Yes to accept the deletion, and the entry is removed.

To block ALL contacts (AOL / Yahoo / MSN only):

1. Turn ON Block Chat/IM Access. 2. Click Allow access ONLY to contact names in list. 3. Do not add contact names to the list. 4. Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

Blocking Internet Access

You have the option to block ALL Internet access or specific Internet applications such as AOL, file transfers via FTP, Kazaa or Yahoo Messenger, or specific Internet functions such as web sites. You can also create a customized blocking schedule from this pane. To set up web site blocking for all or specific users, select Profiles > Block > Internet Access.

Every Internet application communicates using a specific Internet port number. Most of these port numbers are not widely known by consumers, so SpectorSoft has provided a list of Internet applications for you to

select from. Selecting an Internet application simply blocks the port numbers that the application is known to use. For example, access to web sites is often accomplished through Internet ports 80 and 443. Selecting Web Sites via HTTP / HTTPS puts ports 80 and 443 on the list of ports for Spector Pro to block. What happens when Spector Pro is configured to block an Internet function and the user attempts to access it? The behavior of a blocked application varies depending on which one you have selected. Users will most likely get an error message of some kind when their selected application cannot reach the Internet.

Recording of relevant applications must be ON in order for this blocking to take effect. Make sure that all applications on the desktop are CLOSED. Otherwise, changes to the settings will not take effect.

To turn Internet Access blocking off or on:

To block all Internet access:

Turn ON Block Internet Access, and select Block All Internet Access. Click OK to save the changes you have made.

To block selected Internet access:

1. Turn ON Block Internet Access, and select Block Selected Internet Access. 2. Select Block Selected Internet Access (see list below) to activate the list of Internet functions and ports to block. Check the items you want to block. Use up/down scrollbar to see all items; and use the left/right scrollbar to see all ports affected.

Web Sites via HTTP/HTTPS - Check to block all Internet access to normal and secure Internet sites via the http and https protocols; this include most web sites, but not local network or FTP addresses. Clear this option to allow normal Internet access. Blocks outgoing ports 80, 443, 8008, 8080, and 8088.

SMTP/POP/IMAP Email - Check this option to block standard email activity (MS Outlook, etc.) on the recorded computer. Clear to allow SMTP/POP/IMAP email activity. Blocks outgoing ports: 25, 100, 109, 110, 465, 587, 993 and 995.

File Transfer via FTP - Check to block file transfers using FTP (File Transfer Protocol). Clear this option to allow FTP uploading and downloading. Blocks outgoing ports 20, 21, 989, and 990.

AOL and HTTP/HTTPS - Check to block America Online sites, and normal and secure web sites that might not be covered by the first option. Clear to allow access. Blocks outgoing ports 80, 443, 4000, 5190-5193, 8008, 8080, 8088 and 11523.

AOL Instant Messenger (AIM) - Check to block instant messaging using AIM. Clear to allow access. Blocks all outgoing and incoming ports used by an AIM client.

ICQ - Check to block any chat communication using the full-version, standard ICQ Chat protocol, such as through older AOL clients. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol.

ICQ Lite - Check to block any chat communication using the stripped down Lite version of ICQ messaging. Blocks all outgoing and incoming ports used by the protocol.

MSN Messenger - Check to block MSN instant messaging. Clear to allow access. Blocks all outgoing and incoming ports used by the MSN client application.

Trillian - Check to block instant messaging that uses the Trillian protocol to communicate on major chat networks. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol.

Windows Messenger - Check to block instant messaging of this type. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol.

XMPP (Jabber) - Check to block instant messaging that uses the XMPP or Jabber protocol. Clear to allow access. Blocks outgoing port 5222.

Yahoo Messenger - Check to block instant messaging via Yahoo. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol.

Other Chat/IM and HTTP/HTTPS - Check to block other Chat and Instant Messaging communication plus web sites. Clear to allow access. Blocks outgoing ports 80, 443, 1863, 4000, 5190, 6660-6669, 8008, 8080, and 8088.

Kazaa - Check to block peer-to-peer communication via Kazaa, a file-sharing application commonly used to download MP3 and video files. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol.

Kazaa Lite - Check to block the Lite version of Kazaa, a modification of the original using the same protocol. Clear to allow access. Blocks all outgoing and incoming ports used by the protocol. 3. Click OK to save the changes you have made, or Cancel to remove them. The Profiles window closes.

To block additional Internet functions not listed:

If you want to block an Internet function that is not listed, or if you want to block a single port without blocking others, use the Additional Outgoing/Incoming Ports areas.

1. Turn ON Block Internet Access, and select Block Selected Internet Access. 2. In the Additional Outgoing Ports box, or in the Incoming Ports box, type the number of the port you wish to block. You can either specify a single port on each line, separate them by commas, or specify a range of ports, as shown below: Use a comma to separate ports, for example 80,443 Use a hyphen to specify a range of ports, for example 200-299 3. Click OK to save the changes you have made, or Cancel to discard them. The Profiles window closes.

To set a blocking schedule:

This schedule affects only the blocking on the Internet Access panel. Click Blocking Schedule at the bottom of the panel.

When to Block - Setting Up a Schedule

Spector Pro allows you to set specific times when Internet access is blocked. This is especially helpful for parents who want to limit their child's use of the Internet during unsupervised times, but not necessarily all the time. You may block all Internet access or select specific functions which are listed. Do not set up a schedule if you want to blocking to apply 24 hours a day, seven days a week.

Example You use the computer at certain times of the day and you do not want to block your access to the Internet, but you do want 10-year-Sally to have access to the Internet while she's at home with the babysitter and you're at work. Make sure that all applications on the desktop are CLOSED. Otherwise, changes to the settings will not take effect.

To set up a blocking schedule:

1. Click the Blocking Schedule button. The When to Block Internet Access window opens. 2. Click to check Block based on the following schedule (otherwise all times). A white grid indicates that no blocking has been scheduled. As you proceed, you are adding blocking intervals. 3. Click and drag over the grid to color in red, blocked periods of time. You can click on any red area to turn it white (unblocked) again. 4. Click OK to set the Internet Blocking schedule or Cancel to leave it as it was.

To clear all red and start over:

Click the Clear Entire Schedule button. This clears the grid of all blocking.

To verify the scheduled times:

Click the View Scheduled Times button. A box displays a list of all blocked days and times. In the example below, Sunday and Saturday are NOT blocked. Monday through Friday is blocked from 8 AM to 11:30, and from 1 PM to 6 PM. Click Close to close this box and return to the When to Block grid.

Changing System Settings

About System Settings

System Settings allow you to adjust how Spector Pro operates in general on a computer, no matter who is logged in. System settings are provided under Settings on the General panel. Some advanced Profile settings take effect on a system level. That is, if you change them the change will affect ALL users, because the setting has to do with how Spector Pro records. The General Options panel presents:

Security Settings

Data File Settings

Application Settings Advanced recording settings also affect all profiles and are considered "System Settings." Generally you do not change these settings unless you are having a problem with the default recording methods:

Snapshots - System Settings

Snapshots - When and How Often

Chat/IM - System Settings

Web Sites Visited - System Settings

Files Transferred System Settings

Email System Settings

Keystroke System Settings

Security Settings

Security Settings manage access to Spector Pro (the hotkey sequence and password) and allow you to increase or decrease stealth and security. Access this panel by selecting Settings > Security. See Security Considerations for an overview of all settings that affect security and stealth.

To change the password:

During installation you were prompted to supply a password. If you did, you must type it after pressing hotkey sequence to open the Viewer. After installation, you can add or reset the password at any time. The password is not visible but can be changed from the Security Settings panel: Password - Type over the existing password. Asterisks appear instead of characters. Confirm Password - Type the password again, exactly the same. A message appears if there is not a match, and the password will not be changed. Be sure to click OK on the Settings panel to save your change.

WARNING: If you do not supply a password for Spector Pro, any user who knows the hotkey sequence is able to gain access to Spector Pro.

To change the hotkey sequence:

During installation you either kept the default hotkey sequence, or you defined a new one. Hotkey - Displays the current hotkey sequence. The default is Control + Alt + Shift + S.

Change - Click this button to open the Hotkey box and change the hotkeys. Check the special keys you want to use, and then type the key to press with this sequence. Click OK to accept the new sequence and view it in the Security panel, or Cancel to return to the old sequence.

To switch from Stealth to Visible mode:

By default, Spector Pro is installed in Stealth Mode. It is not visible on the desktop or anywhere in Windows and you must open Spector Pro Pro using the hotkey sequence. Set to Stealth Mode - Uncheck to make Spector Pro visible as an application after you save the settings and close Spector Pro. A red square appears in the Windows system tray to show you that Spector Pro is recording and that you can click to open the application. Check this field to make Spector Pro invisible. If it has been visible, when you save changes and close Spector Pro, all traces of the application will be removed from the Windows system tray, Start list of Programs, and Windows Explorer folders.

To configure advanced settings:

Click the Advanced button. Most users will NOT change these settings. See Advanced Security.

Data File Settings

The Data Files panel allows you to adjust settings that regulate where and how data files are stored, whether they are shared for remote viewing, and how Screen Snapshot and other Spector Pro data files are managed to maximize disk space. These settings affect all data recorded on this computer. Access this panel by selecting Settings > Data Files.

From this panel, you can control:

Data File storage location, password, and sharing Screen snapshot file storage limits All other data file storage limits Click OK at the bottom of the Settings window to save the changes you have made

A data file contains chunks of information or recorded events that have been captured by Spector Pro from a monitored computer. The Viewer uses data in these files to display the various views of activity. Data is automatically deleted after the time period or size settings on this panel. To save ALL data, use the Backup function.

To change the data file folder settings:

You can view the secret, randomly named folder where Spector Pro saves its files, change the folder, share the folder for remote viewing change file extensions. Folder - Indicates the location and name of the folder where Data Files are stored. The folder name is randomly generated during installation. The location of the folder is based on the operating system you have installed. Browse - Click to navigate to and choose a new folder in which to store Data Files.

Avoid storing data in a network folder (not on the local hard drive). Spector Pro cannot recover information if a communications error occurs while sending data to a network folder, or if the network location is not available to receive information. It is better to share the folder and access it from a remote Viewer.

Enable Remote Access to Data Files Folder - Check to automatically share the folder listed in the Folder field. Network Share Name - Tells you the share name automatically created. You will enter this name when you want to open the data at a remote Viewer. Extension - Shows you the randomly generated filename extension assigned during installation. You can change the extension. As data files are created, file names are also randomly generated and can be altered. Hide Data Files in Windows Explorer - When this is selected, system folders and data files are hidden from view in Internet Explorer (IE). You can go into Windows and instruct it to show all hidden files and folders, and these files and folders will then be visible. The default is to hide Spector Pro files and folders. Password - By default there is no password [None] required to open data files. This password adds a layer of security to prevent unauthorized access to the data files. While the Spector Pro hotkey sequence and password protect access to opening the Spector Pro Viewer, this password restricts opening the data files from this particular data file folder. It is a good strategy to apply a password BEFORE beginning to record/review data, or after changing the data files folder to a new location.

Set - Click to enter and verify a new password. Type the password in the Enter Password field, and type it again next to Verify Password. Click OK to set the password or Cancel to return to the previous password (or no password).

A message appears after you click OK: "Your data files will no longer be accessible with your new password. Do you want to delete your existing data files?" Choose No if you want to access all files.

You will be prompted to enter your old password for old data and the new password for the new data. Click Yes if you want to delete data files that did not have this password protection.

If you assign this password and then change it, the changed password applies to all data files created after the change. The old password will be required for the old data, and the new password will be required for the new data.

To change snapshot data file storage limits:

These settings control snapshot data files. By default, snapshots are deleted after 30 days or when the snapshot data reaches 500 MB in size. The oldest files will be deleted first to keep the data just under both maximum limits. The Delete Data setting has an impact on disk storage requirements.

Delete Data After . . . Days - Spector Pro automatically starts deleting snapshots after a specified number of days, (or when the Maximum Data Size is reached, whichever occurs first). The oldest recordings are always removed first. Use the arrows or type a number to indicate how many days must elapse prior to deletion. The available range is 0 - 999 days. The default interval is 30 days.

If you do not want Spector Pro to delete snapshots after a certain number of days and you ONLY want to delete snapshots after the maximum disk storage space is exceeded, then enter 0 days. The system will keep the data until disk space runs out.

Maximum Data Size - Spector Pro automatically starts deleting snapshots after the specified disk storage space has been exceeded, (or when the specified number of days is reached, whichever occurs first). Use the arrows or type a number to indicate the maximum data size for snapshots. The available range is 0 to 4000 megabytes. The default is 500 megabytes. A setting of 0 means "unlimited." Spector Pro continues to store data as long as there is disk space.

Calculate Usage - Click to open the Average Daily Usage window, which enables you to monitor how much disk space is being used for snapshots over a period of time. Click OK to close the window.

Total Data Recorded - The total disk storage space currently being used for snapshots. Total Recording Time - The total amount of active recording time since recording began. This statistic readjusts after you delete all snapshots. Data recorded per hr (Avg) - The average amount of disk storage space used per hour of active recording time. Estimated Daily Usage - An estimate of the amount of disk storage space used on a daily basis.

To change other data file storage limits:

Spector Pro automatically starts deleting data files other than snapshot files, after a specified number of days or when the Maximum Data Size is reached, whichever occurs first. Spector Pro always deletes the oldest recordings first.

Delete Data After . . . Days - Use the arrows or type a number to indicate how many days must elapse prior to deletion. The available range is 0 to 999 days. The default interval is 45 days. If you do not want Spector Pro to delete data after a certain number of days and you ONLY want to delete data after the maximum disk storage space is exceeded, then enter 0 days. The system will keep the data until disk space runs out. Maximum Data Size - Use the arrows or type a number to indicate the maximum data size for snapshots. The available range is 0 to 999 megabytes. The default is 500 megabytes. A setting of 0 means "unlimited." Spector Pro continues to store data as long as there is disk space.

Set Delete Data After and Maximum Data Size to 0 to keep data forever.

Click OK at the bottom of the Settings window to save the changes you have made.

Application Settings

The Application panel allows you to control the Spector Pro application. You can set hotkey combinations to operate Spector Pro, change the Inactivity Timeout setting after which Spector Pro stops recording, and define exactly which programs Spector Pro records or does not record. This panel also provides advanced settings that fine tune how the Spector Pro runs. Access the Application panel by selecting Settings >Application.

Be sure to click OK at the bottom of the System Settings window to save changes. To ensure that new settings affect all applications and users, restart the computer after changing these settings.

Hotkeys You can define hotkey sequences that (a) open the Viewer, (b) start and stop recording at the computer, and (c) take a Screen Snapshot. A hotkey sequence is a series of keys pressed and held down simultaneously that provide a "stealthy," non-visible way to operate the application.

To set application hotkeys:

1. Click the Change button next to the hotkey you wish to set.

Viewer Hotkey - Opens the Viewer. The default combination is Ctrl+Alt+Shift+S. You may have changed this sequence when installing Spector Pro. The Viewer hotkey sequence can also be changed in Security Settings. Remember this sequence!

Recording Hotkey - Stops and starts recording at the computer. Initially there are no recording hotkeys defined. If you define recording hotkeys, you can use them to temporarily stop and restart recording at the monitored computer without opening the Spector Pro Viewer.

Snapshot Hotkey - Takes an immediate snapshot at the recorded computer. The default combination is Ctrl+Alt+Shift+P. No matter what your Screen Snapshot settings are, this hotkey sequence takes an immediate snapshot of the computer screen. You would need to open the Viewer to view the snapshot. 2. In the Hotkey box, check each modifier key (Ctrl, Shift, Alt, Windows) to press in the combination. Click to clear a check. You must select at least 2 modifier keys for a valid combination.

3. Type a regular key to press with the combination. 4. Click OK to accept the changes you have made, or Cancel to reject them. The Hotkey box closes and the new sequence appears in the Application panel.

WARNING: Be careful not to set hotkey sequences that are the same as keyboard shortcuts used by anyone at this computer!

Inactivity Timeout Spector Pro stops recording data from the computer when there is no activity at the computer. The default "Timeout" period is 3 minutes. After 3 minutes of no mouse or keyboard activity, Spector Pro stops recording and alerting. It starts again immediately when a key is pressed or a mouse action is performed. You may want to increase the period to capture more data, or decrease the period to time-out sooner and save disk space.

To change the timeout period:

Type a new number in the Inactivity Timeout field, or use the arrows to increment or decrement the number from 0-999 minutes. Use 0 (zero) for no timeout period; Spector Pro never stops recording.

Programs to Monitor Spector Pro automatically monitors all programs (applications) that run on the computer, but gives you the flexibility to limit monitoring, if you wish. Turning off monitoring of a program turns OFF recording, blocking and alerting within that program. This setting also interacts with other settings. Keep in mind that the most "conservative" setting wins. Other places where you can limit program recording are:

Network Activity - You can choose to record or not record network activity of specific programs. If you turn off recording of a program here in Application settings, any Network Activity setting for that program has no effect.

Chat/IM Activity - You can choose to record or not record certain types of Chat/IM in Chat/IM System Settings. If you exclude a Chat/IM program from monitoring here in Application settings, it will not be recorded even if Chat/IM is set to record that application. The reverse is also true.

Program Activity - You can choose to turn OFF recording of Program Activity all together. If programs are not being recorded, any program settings on this panel will have no effect.

Use this setting carefully: Example 1 You may ONLY want to record a specific application. Perhaps your single concern is a certain video game that you don't want the youngest child to use. You can tell Spector Pro to record activity only for this particular program. Example 2 You may want to record lots of programs, but not all of them. Perhaps you do not want to take up valuable disk space recording the activity on approved company programs, but you want to see everything else that's going on. You can tell Spector Pro which applications you don't want to record.

To limit programs recorded:

1. Check to enable Only monitor, record/alert/block, the following programs (otherwise all). The following choices are activated.

2. Choose to include or exclude recording of programs:

Monitor only programs listed - Select this if you want to create an Include Programs list and monitor activity only for the program(s) listed here.

Monitor all programs except these listed - Select this if you want to create an Exclude Programs list and record activity for all programs, except for those listed here. This is the default. 3. Click Add. The Select Program(s) to Include/Exclude box opens. All programs currently running appear in the list. Select one or more programs to add to your Include or Exclude Programs list.

4. If the program you want to select is not listed:

Open the program now and click Refresh on the Select Program(s) box. This causes the program to appear in the list. - OR -

Click Browse. Navigate to and select any program executable file that is installed.

5. Click OK. The Select Program(s) box closes and program(s) are added to the list

To remove a program from the list:

Select the program in and then click Delete. The entry is removed.

Advanced Options Changing the Advanced options could have an adverse effect on Spector Pro's ability to record. Do not modify these settings unless you are instructed to do so by SpectorSoft Technical Support staff. See Advanced Application Options.

Snapshot System Settings

Snapshot System Settings allow you to change the format and frequency of Screen Snapshots. These settings will affect all user profiles. Access the Snapshot System Settings from Profiles > Record > Screen Snapshots and click the System Settings button.

Before making changes, close all applications and log off all users to ensure that any new settings will take effect when you save settings (click OK) and exit the Viewer.

To change the Snapshot Format:

Spector Pro can take color, grayscale, and black-and-white snapshots. This setting affects what the captured screen snapshots look like, as well as how much disk space is used on a daily basis. If you change the format to increase the color depth captured, you may have to increase the maximum Screen Snapshot data storage so that snapshots are not deleted right away. Click the Snapshot Format drop-down list and select from the following formats:

Format Description

1 Bit Black-and-white graphic - Creates the smallest file (approximately Monochrome 50% of what is required by 4-bit grayscale), but the image may not be readable.

4 Bit GrayScale 16 shades of gray - The default and recommended setting, providing a viewable grayscale image that maximizes disk space

4 Bit Color 16 colors - The graphic is indexed and reduced to the fewest colors, which may not provide a readable image

8 Bit Color 256 colors - The graphic is indexed and stored in 256 colors, providing a readable color image

16 Bit Color 65,536 colors - The graphic is stored in hi-color format

24 Bit Color 16,777,216 colors - The graphic is stored in true-color format

32 Bit Color 16,777,216 colors - The graphic is stored in true-color with an additional alpha channel. Allows for greatest accuracy and optimizations but also takes the most storage space (not recommended)

You can take a readable grayscale Screen Snapshot of a computer display is set at a much higher resolution. However, if the computer is set to lesser color depth and lower resolution (256 colors) there is no point in setting Screen Snapshots to a higher level of capture (16-bit Color).

To configure when snapshots are taken:

Click the Configure Snapshot Recording button. You can select events that trigger a snapshot or adjust how often Spector Pro takes timed snapshots. See Snapshot Recording Events.

If Record Screen Snapshots is OFF, these settings will have no effect.

To save your changes and close the Settings window:

Click OK at the bottom of the panel to save your changes, or Cancel to remove them. The Settings window closes.

Snapshots - When and How Often

You can decide which events will trigger a snapshot and how often snapshots will be taken. These settings affect all user profiles. Access the Snapshot Recording Events Settings from Profiles > Record > Screen Snapshots > System Settings and click the Configure Snapshot Recording button. By default Spector Pro takes a snapshot on all the possible "trigger" events and once every 30 seconds (provided the user is "active"). To focus on meaningful snapshots or conserve disk space, you may want to adjust the settings.

Keyword Watch settings can also trigger a snapshot and temporarily increase the snapshot frequency.

To take a snapshot when events occur:

Check an event to take a snapshot when it occurs. Clear it to turn OFF the snapshot "trigger."

Heavy computer usage with all the triggers activated could result in large amounts of recorded data.

Website Page is loaded - Take a snapshot when an Internet browser is open and a page load event occurs. This happens whenever a user clicks a link at a web site. Website form is submitted - Take a snapshot when an online form is submitted. This could be a user login form, a banking money-transfer form, a registration form, an e-commerce order form, and so on. Show me... or example, when you click the "Sign in" button for this form, a snapshot is taken.

Program is loaded - Take a snapshot when an application is opened. Clear to turn OFF this option. This is useful if you want a picture of programs a user launches in a day. Window title changes - Take a snapshot when the text in the window title bar changes. This could happen when you load a new document into an application, select Save As to change the document name, or load a new web site page in a browser window. Note that this option has redundancy with the "Website Page is loaded" option, which may cause excessive snapshots. If you select this option, you may not need the first option. Show me... For example, an MS Word window title displays the document name. When you open another document, a snapshot is taken.

Window Contents are scrolled - Take a snapshot when the user scrolls the contents of any window in any application. Only one line of scrolling is needed to trigger the snapshot. If you are concerned about seeing everything on a window the user is viewing, you might use this setting. Left mouse button is clicked - Take a snapshot whenever the user depresses the primary mouse button (usually the left button). This includes selecting a hyperlink, placing the cursor to begin typing, or selecting a menu and menu item. Left mouse button is double-clicked - Take a snapshot when the user clicks the primary button twice in rapid succession. A double-click is used to run an application from a Windows program icon or take action as programmed within an application. Right mouse button is clicked - Take a snapshot when the user clicks the secondary mouse button, which usually displays a menu of shortcut actions or "what's this" help. Enter key is pressed - Take a snapshot whenever the Enter key is pressed. This includes pressing enter to submit a form, add a paragraph break in a document, and execute a selected item.

To take a snapshot when specified keys are pressed:

You can cause single keystrokes to trigger a snapshot. For example, you may want to take a snapshot when the user presses the Ctrl key, as part of a Save (Ctrl+S) or Print (Ctrl+P) operation 1. Click Add. The following message appears.

2. While the message is displayed click any key on your keyboard. The message box closes and the key appears under Key Name column

Repeat these steps for each key you want to add. To remove a key from the list, click to highlight it and then click Delete.

To set snapshot frequency:

1. Check Take Snapshot Every... Seconds to turn on timed snapshots. Clear to turn OFF timed snapshots. 2. Set the frequency for taking Snapshots. Type a number from 1 - 600, or use the up and down arrows to set the number of seconds between snapshots.

Every 30 seconds (default) provides a compromise between detail of information and use of disk space.

Increasing the time (for example, raising the interval to 90 seconds) causes fewer snapshots to be taken. You may compromise the snapshot view of the user's activity.

Decreasing the time (for example, lowering the interval to 4 seconds) causes more snapshots to be taken. More snapshots provide greater detail, but use up disk space and slow the computer. Note that Keyword Watch Settings provide an option to trigger and increase snapshot frequency if a keyword is detected.

If the user is inactive (not typing or using the mouse) for 3 minutes, snapshots are stopped until activity begins again.

To save your changes:

1. Click OK to accept the changes you have made, or Cancel to reject them. The Snapshot Recording box closes. 2. Click OK on the Snapshot System Settings box. 3. Click OK on the Profiles panel to save your changes. Changes go into effect when you close Spector Pro.

Chat/IM System Settings

Chat/IM System Settings allow you to control how and where Spector Pro listens for chat. These settings will affect ALL user profiles. Access the Chat/IM System Settings from Profiles > Record > Chat/IM Activity and click the System Settings button. Here, you can add a non-standard port to watch or change the method of capture for a particular type of chat. Under normal circumstances, you will NEVER change these settings. SpectorSoft advises that only advanced users attempt to make changes so that recording is not compromised.

Before making changes, find out which Chat/IM types are recorded by Spector Pro . If you do need to make changes to System Settings, close all applications and log off all users to ensure that any new settings will take effect when you save settings (click OK) and exit the Viewer.

To change Chat/IM ports:

Spector Pro monitors the known communications ports used by Chat/IM protocols. You would add a port if your Internet Service Provider (ISP) forwarded a standard port used for this purpose (such as MSN 5060) to a different port number, causing Spector Pro to miss MSN or Windows Messenger conversations. 1. Determine which Chat/IM protocol you need to record:

Standard Chat/IM uses the IRC, MSN, AOL / ICQ, Yahoo, or XMPP protocol. Next to each protocol is a list of ports commonly used for communication, where Spector Pro watches for activity.

2. Find out at which port the communication is really taking place: Add the non-standard port to the list of ports. Type a space after the last number and type the port number. Do not delete a port unless problems occur on the network.

To change level of recording:

Spector Pro records the IRC, MSN, AIM / ICQ, AOL, Yahoo, and XMPP protocols using a High-Level, Low-Level, or Auto method of capture. The default settings provide nearly complete coverage. You would change the level of capture to disable types of chat or to attempt to capture encrypted or unusual forms of chat. Use the drop-down list to select a recording method: Low-Level - Low-level record directly captures the communication by using the standard protocol. Low-level recording is preferable because it does not depend on the application version where chat takes place, but it cannot capture encrypted communication or non-standard protocols. High-Level - High-level record "scrapes" the conversations directly from the application window. This method is used as a backup to the low-level method for vendors who frequently release new versions (MSN, AOL, Yahoo). The high-level method is most useful for recording communication that is encrypted or uses custom protocols, such as Windows Messenger configured for a Microsoft Exchange account. Auto - Auto record allows Spector Pro to determine whether to use low- or high-Level recording. Usually, Spector Pro detects a conversation using the low-level method first. If the protocol detected is not monitored by Spector Pro , or the communication is encrypted, Spector Pro uses the High-Level protocol. Disabled - Select this option to turn off recording of a type of Chat/IM. For example, if you would like to record all Chat/IM EXCEPT those using MSN (MSN Messenger, online MSN chat), select Disabled next to MSN Record.

To turn on/off other types of Chat/IM recording:

By default Spector Pro captures all Web IMs (IM accessed at a web site rather than from a local client), OSCAR80 (an AOL protocol), MySpace443 (MySpace messaging), MSN Exchange (MSN Messenger operating on an Exchange Server), and Skype (messaging or group text chat) conversations. If you do not want to capture any one of them, click to remove the checkmark.

To enable a time stamp:

Check Enable Time Stamp if you want to add a time stamp to each line of the conversation when Low- level capture is used. For example: <10:15:22> BlueSuede> How are you <10:16:30> RedPatent> Fine <10:17:00> BlueSuede> Good to hear

To save your changes and close the Settings window:

1. Click OK on the Chat System Settings box to save your changes. 2. Click OK on save all profile settings and close the Profiles box.

Web Sites Visited System Settings

Web Sites Visited System Settings allow you to control where and which browsers Spector Pro will record. These settings will affect ALL user profiles. Access the Web Sites Visited System Settings from Profiles > Record > Web Sites Visited and then click the System Settings button. Under normal circumstances, you will NEVER change these settings. SpectorSoft advises that only advanced users attempt to make changes so that recording is not compromised.

To change Chat/IM ports:

Spector Pro monitors the TCP/IP ports commonly used to access web sites on the Internet. You would add a port if your web server was configured to use a non-standard port, causing Spector Pro to miss web site activity. Find out at which port the communication is actually taking place. Type a space after the last number and type the port number. Do not delete a port unless problems occur on the network. HTTP Ports - These are the TCP / IP ports commonly used to access the Internet. It is possible that the web server is configured to use non-standard ports. If this is the case, add the alternative port to conform to the server. HTTPS Port - This is the TCP / IP port commonly used to access the Internet with SSL security. It is possible that the server is configured to use a non-standard port. If this is the case, add the alternative port to conform to the server. To find out how to locate the non-standard port number(s), click here.

To turn record options on or off:

Disable the capture of these browsers if instructed to do so by SpectorSoft Technical Support.

Capture Mozilla Browsers (i.e., Firefox) - This box is checked to enable the capture of activity on Firefox, Netscape, and other Mozilla-based web browsers. Check to record activity; clear to skip recording these types of browsers. Capture AOL Security Edition - This box is checked to enable the capture of AOL Security Edition. Check to record activity; clear to skip recording these types of browsers.

To save your changes and close the Settings window:

1. Click OK on the Web Sites Visited System Settings box to save your changes. 2. Click OK on save all profile settings and close the Profiles box.

Files Transferred System Settings

Files Transferred System Settings allow you to control where Spector Pro watches for connections, and whether or not HTTP uploads are recorded. These settings will affect ALL user profiles. Access the Files Transferred Visited System Settings from Profiles > Record > Files Transferred, and then click the System Settings button. Under normal circumstances, you will NEVER change these settings. SpectorSoft advises that only advanced users attempt to make changes so that recording is not compromised.

To change file transfer ports:

If your web server is configured to use non-standard ports, you may not be properly capturing certain types of file transfers. Do not change these settings unless you are an advanced user.

Gnutella Ports - These are the ports commonly used for Gnutella activity. It is possible that the server is configured to use non-standard ports. If this occurs you need to change these ports to conform to the server.

FTP Ports - This is the port commonly used for FTP activity. It is possible that the server is configured to use a non-standard port. If this occurs, change this port to conform to the server.

If a Gnutella or FTP exchange happens on a non-standard port, you will NOT see the activity in the Files Transferred view. However, you will see evidence of the exchange in the Network Activity view.

To record HTTP uploads:

By default, Spector Pro captures files uploaded from your computer to web sites via the HTTP protocol, which may include web activity already captured by the Web Sites Visited recording tool. Clear this option to limit the recorded upload activity to FTP and other protocols. Spector Pro will still capture HTTP downloads. Keep this item checked for a complete record of all uploads and downloads.

To save your changes and close the Settings window:

1. Click OK on the Files Transferred System Settings box to save your changes. 2. Click OK on save all profile settings and close the Profiles box.

Email System Settings

Email System Settings allow you to control which types of email to record and where to listen for email activity. These settings will affect ALL user profiles. Access the Email System Settings from Profiles > Record > Email Activity Settings and click the System Settings button.

Here is where you can add Exchange or MAPI email recording and recording of Internal Webmail on private web sites. Most users will not need to change these settings.

If you do need to make changes to System Settings, close all applications and log off all users to ensure that any new settings will take effect when you save settings and exit the Viewer.

To select types of email to record:

By default, when email recording is ON Spector Pro captures IMAP, Web Email (webmail), AOL email, and SMTP/POP email. This covers most types of email used at home or in small businesses. Check boxes to turn ON recording; clear boxes to turn OFF recording of a type of email. IMAP Email - Check to record incoming IMAP email. Programs using IMAP for incoming email usually use SMTP for outgoing email (see below). Clear the checkbox to omit recording of IMAP email. AOL Email - Check to enable recording of AOL email composed or opened using the proprietary AOL Internet interface. Clear the checkbox to omit recording of AOL Email. AOL email can only be recorded if the user logs into AOL and opens a received email or composes an email. If the email is listed in AOL, but is not opened by the user, it is not recorded. AOL email that is sent and received through the web email interface at www.aol.com is also captured. SMTP / POP Email - Check to enable recording of email sent using SMTP or received using POP. Many standard mail programs, Microsoft Outlook, Outlook Express, Incredimail, and Eudora, use SMTP and POP protocols. Clear the checkbox to omit recording of SMTP/POP email. Web Email - Check to record email messages sent and received through a Web browser (Webmail) using Hotmail, Yahoo, AOL, Gmail, or other services. Clear the checkbox to omit recording of Webmail. Exchange / MAPI Email - Check to record Microsoft Exchange or any MAPI email. Clear the checkbox to omit recording of MS Exchange email. Any Windows application incorporating MAPI functionality can become "mail-enabled." Microsoft Office Suite is MAPI enabled. Scan ONLY Inbox for pre-existing new email - Check to capture unread Exchange/MAPI email only in the user's Inbox folder. Clear the checkbox to capture unread messages in ALL folders in the user's Exchange mailbox. The Exchange / MAPI Email option must be checked to activate this option, and any time you change this option you must log out and log back for the change to take effect.

If your organization uses Microsoft Outlook to connect to a Microsoft Exchange server, check Exchange/MAPI recording in order to record this email.

To check for duplicate emails:

By default Spector Pro will Check for Duplicate Emails and ignore duplicate email messages. Clear the checkbox to record all email sent and received. By Omitting duplicate email is useful when an anti-virus or other third party program has sent email duplicates. Spector Pro keeps a list of the last 100 email messages received. If an exact duplicate is received and this option is set, the duplicate is ignored. This list restarts when you turn off the computer.

To set up recording of internal webmail sites:

An internal web email site is internal to an organization and hosted on a private web site, as opposed to external webmail offered by providers such as MSN Hotmail or Yahoo. Spector Pro will NOT record internal webmail unless it is configured with a Host location and/or IP address. 1. Click the Add button to open the Enter Host box. 2. Under Select Internal Webmail Type, use the drop-down list to select the type of webmail host you wish to record:

Exchange-Web(2000) - The user logs into Ms Exchange Webmail 2003 for email.

Exchange-Web(2003) - The user logs into MS Exchange Webmail 2000 for email.

OpenWebmail - The user logs into Open WebMail for email.

SqWebMail - The user logs into SqWebMail for email.

3. Type the host location in the first field. This is the URL of the mail server, which usually starts with "mail" instead of "www," such as "mail.school.edu." 4. If you wish, check the "Host might be accessed by the following IP address" and enter the IP address of the webmail host. If you don't know the IP address, click the Resolve button. The IP address is optional. 5. Click OK to return to the Advanced Email Settings. The webmail site now lists a host and is configured to record.

To add mail server ports:

If your service provider or network server uses different ports for email, you can add these ports. Type a space following the default port, then type the port number. Spector Pro will monitor all specified ports. Click OK to set the changes.

SMTP Ports: Spector Pro monitors port 25 to capture outgoing SMTP email, such as that sent by MS Outlook.

POP Ports: Spector Pro monitors ports 109 and 100 to capture incoming POP email, such as that received by MS Outlook.

IMAP Ports: Spector Pro monitors port 143 to capture incoming IMAP email received via a remote server.

Keystroke System Settings

Access the Keystroke System Settings from Profiles > Record > Keystrokes Typed Settings and click the System Settings button. The Record Characters option useful when you are using a language that requires more than one keystroke to create a character (for example, Japanese). When this box is checked, Spector Pro displays the characters resulting from keystroke combinations in the Keystrokes Typed event window. Characters will also appear in Email and Chat / IM event windows IF the application used supports the particular language. By default, Spector Pro does NOT to capture character information, unless you are using an operating system designed for an international character set.

Record Characters

To turn capture of characters on or off:

Check Record Characters to enable the recording of keystrokes that combine to create characters. Clear to capture only individual keystrokes typed. When this option is ON, a Characters tab appears in the Keystrokes Typed view, displaying the characters resulting from keystrokes.

More About Keystrokes vs. Characters Keystrokes are the physical keys you press on your keyboard. Pressing keys on the keyboard may or may not generate a character. For example, to generate capital A, you would type the SHIFT key (which does not generate a character) and the A key. The first keystroke is a dead key because it does not produce any characters by itself. Characters are the glyphs (the pictures of characters) displayed as a result of the keystrokes. The dollar sign glyph $ on a standard western keyboard is generated by pressing the SHIFT key and the 4 key. Many languages (like German) require multiple keystrokes to generate common characters, and the keyboard used may be substantially different. To create the â character on a German keyboard, a user presses our ~ key (which has a different picture on the German keyboard) and the A key. Some languages (like Japanese) have too many characters for a normal keyboard to accommodate. For these languages, an

Input Method Editor (IME) helps users enter characters. For example, the Japanese IME converts the keystrokes nihongo into these three characters:

When Spector Pro is set to Record Characters, it uses the local Windows OS information to capture both the keystrokes typed by the user and the characters (double-byte if necessary) that Windows created from those keystrokes. For languages like German, Hebrew, or Japanese, the Viewer provides the Keystrokes view (which doesn't make much sense) and a formatted Characters view (which shows the characters as the user meant to display them). See Viewing Keystrokes Typed.

Program System Settings

Access the Program System Settings from Profiles > Record > Program Activity Settings and click the System Settings button. Here, you can change the timeout period for program "activity" recording. The Capture Program Activity box must be checked for this setting to be effective.

This setting affects all user profiles.

To change the inactivity timeout duration:

Next to Inactivity Timeout click the up or down arrow or type a number to change the Inactivity Timeout interval. The available range is 0 to 999 minutes. The default interval is 3 minutes. Zero (0) specifies "no timeout." Click OK to save your change and return to Program Activity settings. The program is considered inactive once all mouse and keyboard activity has ceased for a specified period of time. When this occurs, program recording for that application stops and is in "timeout." For example, if a user is typing, clicking the mouse, or moving the mouse within a program window, the program is "active." When the user stops, Spector Pro continues to record until 3 minutes have passed. After 3 minutes, Spector Pro marks the program as "inactive" and stops recording. It subtracts the 3 minutes from the "active" time period displayed. As soon as the mouse is moved or clicked, or a key is pressed, recording resumes.

Advanced Security

Advanced Security allows options for stealth and access to Spector Pro. Under normal circumstances, you will not need to change these settings. To access this panel, from the Viewer toolbar, select Settings > Security. Click the Advanced button on the Security panel. Click Yes at the warning message to continue to the Advanced Security Settings panel.

To enable a Windows logon warning:

Spector Pro provides an option to display a warning message each time someone either restarts Windows or a new user logs on to the computer. This warning message informs the user that their computer activity is being monitored. The default is NOT to display the warning. Enable Logon Warning - Clear this option to keep Spector Pro stealthy. Check this option to display a warning message. The change goes into effect when you click OK twice and close Spector Pro.

Set Warning Text - A default warning message is provided. Click Set Warning Text to change the message. Select the existing text and type over it, or press the Delete key to remove text. Click OK when you are finished. Enable Logon Warning must be checked for a user to see this message.

To change SpectorSoft file security:

Do not change this setting unless you are requested to do so by SpectorSoft. Block - Default security for SpectorSoft files. Stealth None

To set Service Monitoring Credentials:

Sometimes additional information is required to record certain applications or Windows services. You may need to provide Spector Pro with Administrator-level login credentials to give it the access it needs to continue recording when a non-Administrator is logged in to the computer. For example, this is sometimes needed to capture AOL chat. By providing credentials here, Spector Pro can continue recording seamlessly. Admin Username - Enter the user name of any Windows administrator in the Admin group on the monitored computer. Admin Password - Enter the administrator's password. Click OK to accept the changes you have made or Cancel to reject them. The Advanced Settings window closes.

Advanced Application Options

Advanced Application options allow you to fine-tune control of the Spector Pro application. Do not change these settings you are an advanced user or unless instructed to do so by SpectorSoft Technical Support. Access the Advanced Application settings by selecting Settings > Application and clicking Advanced.

To set Application Options

Allow Limited Users UI Access - When this is selected, users who do NOT have administrator privileges are able to open the Spector Pro Viewer and monitor recorded events. They will not, however, be able to change any settings. The default is to deny access to "limited users." Click this box to allow "limited users" or non-administrators access to the Viewer. Assuming that one adult in the household or one employer in the office is the administrator, selecting this option allows: a. Any adult to monitor the children from their local computer, without signing on as an administrator. This may be important if time is an issue. b. Any non-administrator parent or employer to monitor a PC from a remote location, while signed on as a non-administrator. Enable Spector when Windows starts - By default, Spector Pro automatically starts recording whenever Windows is started. In most cases, this is preferred. Occasionally, however, if you are using Spector Pro in an unconventional way, you might want to manually start recording. To do so, click to turn this feature off, and use Recording Hotkey Sequence to manually start and top Spector Pro. When the Enable Spector when Windows starts feature is turned off, you will still get the question "Do you want to start recording?" when you close the Viewer and you can still select Yes and begin recording.

Capture Console Applications - When selected, Spector Pro captures keystroke activity in the Windows Command (Cmd) window or in DOS. Automatically turn off Work Offline - Enables Spector Pro to work around communication problems when a computer is set to "Work Offline." Capture Elevated Applications - Allows capture of processes in Vista that are running under Elevated (Administrator) privileges. This generally only applies to a small subset of applications – Setup Applications, Control Panel Applets, etc. However, any application can be run with these elevated privileges by right-clicking on it and choosing “Run as administrator.” Change this setting only if directed to do so by Technical Support staff. Include 32-bit Applications (64-bit OSes only) - Applies to computers running a Windows 64-bit operating system. Enables an extra feature of the “Capture Elevated Applications” option so that 32-bit Elevated Applications are also captured. Change this setting only if directed to do so by Technical Support staff.

To set Network options:

Network Initialization Delay - This setting increases the number of seconds to delay initialization of Spector Pro modules used to capture Internet information, and may prevent Spector Pro from conflicting with programs that may be competing for the same Windows resources. The default is 0. Click the arrows to change this setting only if requested to do so by a SpectorSoft engineering staff.

To set Troubleshooting options:

Enable Automatic Error Transmissions - Spector Pro traps internal program errors and stores them in a log file. When this option is turned on, program errors may be automatically transmitted to SpectorSoft so that Technical Support may find the cause of the errors. The default is not to enable automatic transmission. Turn this on only if requested to do so by a SpectorSoft engineer. Enable Log File - Spector Pro maintains a log of its own activity that is useful for Troubleshooting. You can view the Log File by selecting Help > Technical Support Diagnostics > View Log File. The log provides a date-time stamp of sessions and settings changes, but only records as much as specified in the Detail Level or under the Configure Log File settings. If you contact Technical Support, you may be asked to send us your log file for troubleshooting purposes. Log File Detail Level - The default level of logging is zero (0), which provides a minimal number of log entries. Other levels are 1 and 2. Normally there is no need to change this level. However, if you are having a problem and a SpectorSoft Technical Support representative asks you to increase the level, this setting will provide more detailed information about internal Spector Pro activities (creating a larger Log File on the computer). To raise the Log File Level, click on the arrows.

Configure Log File - Click this button to display a box of Log File options. Click the appropriate activity, as advised by Technical Support. This increases data collection only for a specific component(s), as needed.

Network Activity System Settings

Under normal circumstances, you will not need to change advanced settings. SpectorSoft advises that only advanced users change these settings, as this could affect Spector Pro 's ability to reliably capture data. This setting affects all profiles.

To change Network System Settings:

1. Open Profiles > Record > Network Activity. 2. Click Advanced. A warning appears reminding you that changing the advanced settings could have an adverse effect on Spector Pro 's ability to record. Click Yes to proceed. The Advanced Network Settings window opens.

3. Flush After ... Minutes of Inactivity - Enter the number of inactivity minutes that should pass before a Network event ends. "Inactivity" is the number of minutes that should transpire between network connections before recording of an event. The default inactivity time is 10 minutes. The available range is 0 to 9999999 minutes. If more than one connection is made by the same program to the same network address/port within a period of activity, Spector Pro will not "start" a new event, it will add the connection to the current event. If the inactivity time period passes without any new connections being made, Spector Pro records the activity as an "event," including the count of connections made during the event. Reducing the minutes in this setting generates more events. Raising the minutes in this setting generates fewer events with more connections.

For example: If you browse CNN in the morning for 5 minutes and again at lunch for 15 minutes two separate network events involving cnn.com are recorded (inactivity was detected between morning and lunch). If you are browsing CNN in the morning and continue to browse continuously until lunch, a single event with many connections would be recorded (no inactivity detected). A connection to the same network IP address but at a different port is always recorded as a separate network event.

4. Click OK to accept the change you have made, or Cancel to reject it. The Network Activity System Settings window closes. 5. Click OK to save the changes you have made to the Profile settings.

Installing, Sharing, Updating

Installation

Options for Installation

Spector Pro captures and records all the activity that occurs on the computer where it is installed. To record activity on a computer, perform a Standard (complete) Spector Pro installation. As soon as the installation is complete and the computer restarts, all activity is captured. Each Standard installation includes a Viewer that allows you then to load and view the recorded activity.

You must own the computer. Install Spector Pro ONLY on a computer that you own. The SpectorSoft software license agreement requires that you inform anyone you monitor with SpectorSoft products.

Monitor One Computer To record activity on one computer in your home or office: Licensing - Purchase one Spector Pro license. For example, suppose you are the parent of 12-year-old Michael. He has a computer in his bedroom, and you plan to monitor the activity on it.

Standard installation - Perform a Standard installation of Spector Pro on the computer you wish to monitor (on Michael's computer). Once the installation is complete and the computer restarts, Spector Pro automatically begins recording. Monitor activity - At an opportune time, you will return sit down to the computer (in Michael's room), press a sequence of keys that opens the Spector Pro Viewer (your hotkey combination) and enter the password you defined during installation. This opens the Spector Pro Viewer and automatically loads the activity recorded on the computer. You can block web sites, set up alerts, and change recording settings as described in this guide. While the Viewer is open, recording stops. When you close the Viewer, Spector Pro gives you the choice to go right back to recording.

You must have a license for each Spector Pro installation. If your product serial number is not enabled for the proper number of licenses, your software will cease to function. Use the Spector Pro Viewer Help menu or call SpectorSoft Sales toll free at 1-888-598-2788 to purchase additional licenses at a reduced price.

Monitor Two or More Computers To record activity on two or more computers in your home or office: Licensing: Purchase one Spector Pro license for each computer you plan to record. For example, suppose you are the owner of a small travel agency with two employees, Jack and Jill. Each employee has a computer in his cubicle, and you plan to monitor both of them. You would purchase two licenses.

Standard installation - Perform a Standard installation on each computer you wish to monitor (on Jack's computer and on Jill's computer). You can use the same serial number, as long as you are licensed for the number of computers you install on. As soon as the installation is complete, Spector Pro begins recording activity.

Monitor Activity at the recorded computer - If the computers are not on a network, you can return to each computer and use the Spector Pro Viewer to view activity. For example, at an opportune time, sit down at the computer in Jill's cubicle, press a sequence of keys that opens the Spector Pro Viewer, and review the activity recorded on her computer. Then, go to the computer in Jack's cubicle, press a sequence of keys that opens the Spector Pro Viewer, and review the activity recorded on his computer. While the Viewer is open, recording stops. When you close the Viewer, Spector Pro gives you the choice to go right back to recording. Monitor Activity from another computer - If the computers are on a network and set up for sharing data, you can use the Viewer on one computer to monitor activity on the other computers (see Remote Viewing Across a Network).

Performing a Standard Installation

To install Spector Pro , download the software from the SpectorSoft web site or insert the CD-ROM from your Spector Pro package into the CD-ROM drive. You need one license for each Standard installation on each computer.

Install Spector Pro ONLY on computers that you own. The SpectorSoft software license agreement requires that you inform anyone you monitor with SpectorSoft products.

When installing Spector Pro on a computer with a Windows XP or 2000 operating system, you must use an account that has administrator privileges. Without those privileges, you will not be able to complete the installation.

To perform a standard installation:

1. Disable all anti-virus software prior to installation. You can enable the anti-virus software after the installation is complete. Visit our KnowledgeBase to learn more about Spector Pro and various antivirus and anti-spyware programs. 2. Begin the installation at the first Setup panel.

3. Read and accept the User Agreement by clicking I Agree. 4. Read and accept the License Agreement. Click Yes. 5. Enter a valid serial number (you can copy and paste it from the email you received from SpectorSoft confirming your purchase) and your email address. Click OK.

6. On the Options panel, leave Standard selected. You want a complete Spector Pro installation on the computer you wish to monitor. Click Start.

7. If you are installing from a CD you may see the following prompt. Click Yes if you are connected to the Internet; there may be an updated version available at the SpectorSoft web site.

Protect this person's privacy! SpectorSoft strongly recommends setting a password at this time. Without a password, anyone who discovers the hotkey combination will be able to view activity. You may add or change the password at any time after installation. Make sure no unauthorized person is able to gain access and view the data, change configurations, delete information, or uninstall the program.

8. The Spector Installation Options window opens. Enter a password for security, select the hotkey combination that will open Spector Pro , and click Continue.

Password - Enter a password to use when you open Spector Pro and use the Viewer on this computer.

Confirm Password - Type the same password again.

Hotkey Sequence - Select the hotkey sequence (keys you press at the same time) to access Spector Pro . You may change the default of Ctrl + Alt + Shift + S to a unique sequence. To change the sequence Click Change. The Hotkey window opens. Check the keys you wish to use and enter a character to type in the bottom box. Click OK to set the new hotkey sequence.

Visible - Select Visible to make Spector Pro visible to the user. Spector Pro appears (and may be opened from) a red square in the system tray and in the Windows Programs list.

Stealth Setup - Stealth is selected by default to provide optimal security. When operating in the Stealth mode (recommended), Spector Pro does not appear in the system tray or in any Windows Programs list. The Viewer can only be accessed through the hotkey sequence. 9. Wait as the program is installed. 10. If you selected the Stealth Setup, the following message appears. Click Yes to remove the installation file or No to keep the installation on the hard drive.

11. Once the installation is complete, the Release Notes window opens. After reading the notes, click the X at the top right to close the window. 12. The Spector Setup Complete window opens indicating that the installation is complete. By default, the window also indicates that the program will delete all references to Spector Pro from Internet Explorer.

It is recommended that you clear all references to the SpectorSoft web site.

Yes, I want to restart my computer now - To start recording activity with Spector Pro , you must restart the computer. This option restarts the computer when you click Finish.

No, I will restart my computer later - Postpone the restart if you have other work in progress. When the computer is restarted, SpectorPro will begin recording activity.

Clear references to Spector from Internet Explorer - Your browser (e.g., Firefox, Netscape, Internet Explorer) automatically saves information about each web site visited, including the SpectorSoft web site. If you are using Internet Explorer (IE), Spector Pro can remove these references, providing an extra measure of stealth and security. This feature does NOT work with any other browser. Check this option to eliminate all references to the SpectorSoft web site, OR click to uncheck the option and leave the browser as is. (This feature can be adjusted on the View Options window at any time. For further details on what information is cleared and how the feature works, see Clearing References from Internet Explorer.) 13. Remove any disks from their drives and click Finish.

As soon as the computer is restarted, Spector Pro automatically begins recording all computer activity. To view the activity, see Opening the Viewer.

Performing a Viewer Only Installation

Spector Pro allows you to record activity on one computer and view it remotely from another computer on the network. Perform a Standard installation of Spector Pro on the computer you wish to monitor, and perform a Viewer Only installation on the computer from which you want to view the recorded data. Installing a Viewer Only does NOT require an additional software license. Remote viewing works only if:

The computers are networked as a workgroup or as a domain. A domain network is a group of computers in an interconnecting Windows network that share a common directory database, security policies and relationships with other domains. Functions are controlled by a System Administrator (Admin) who has administrative privileges for all computers in the domain. The Admin may install, change, open or delete anything in the network (files, programs, settings) from a central location (server). A workgroup is two or more home or business computers sharing an Internet connection, printers or files. This peer-to-peer network has no central control. Settings and local administrator permissions are changed at each computer. File sharing (and File and Printer Sharing) is enabled and the appropriate folder on the recorded computer(s) has been shared.

Spector Pro does not capture information on the computer with a Viewer Only installation.

To perform the setup:

You may have downloaded Spector Pro from the web site, or you may have received a CD in the mail. In either case, the first window you see when you begin the installation is the Spector Pro Setup window. You must accept User Agreement and Spector Software License Agreement to use this product. After reading the agreements and indicating that you accept: 1. The Serial Number window opens. Enter a valid serial number (you can copy and paste it from the email you received from SpectorSoft confirming your purchase) and your email address. Click OK.

2. On the next installation panel, select Viewer Only. Click Start.

3. The following message appears. Click Yes to confirm the Viewer Only installation.

4. A Progress bar indicates that the program is successfully installing.

5. Once the installation is complete, the Release Notes window opens. 6. After reading the notes, click the X at the top right to close the window. The Spector Setup Complete window opens indicating that the Spector Pro Viewer has installed successfully. Click Finish.

To load data and verify the recording:

The next step is to load data from the monitored computer, and verify the recording: Use the Windows Start menu to open the Viewer. You will need to select the Data Files to view. Follow the instructions in Remote Viewing Across a Network. Once you locate Data Files to view, add them to your Favorites to make loading the data easier next time. When loading is complete, you can see the activity and verify recording of the computer. Use File > Open Data Files to view activity from recorded computer on the network.

NOTE: Loading files over a network is always "slower" than viewing them directly on the monitored computer.

Uninstalling Spector Pro

To uninstall Spector Pro:

1. Open the Spector Pro Viewer. 2. Select File > Uninstall from the menu bar. A confirmation message appears asking if you are sure you want to remove Spector Pro from your computer. 3. Click Yes to uninstall the program or No to cancel the uninstall.

Sharing for Remote Viewing

Preparing Computers for Remote Viewing

If you want to view data from a remote computer, you need to (a) share the Spector Pro Data Files folder and (b) make sure all computers are present on the network. The checklist below will help you prepare for remote viewing.

To ensure all computers are ready:

If you are on a domain network... A domain network is a group of computers in an interconnecting Windows network that share a common directory database, security policies and relationships with other domains. Domain networks are used in larger businesses and schools. Functions are controlled by a System Administrator (Admin) who has administrative privileges for all computers in the domain. The Admin may install, change, open or delete anything in the network (files, programs, settings) from a central location (server).

Computers are probably already visible to you on the network. All you need to do is set up sharing, and check the operating system notes below to see if other changes are needed on a particular computer.

Customers with domain networks should consider Spector Corporate Network Edition (CNE), a robust network-based version of Spector Pro. Spector CNE allows you to install and monitor SpectorSoft recording on any or all PCs in your network, from one Control Centerl location.

If you do not have a domain network, use a Windows Workgroup... A workgroup is two or more home or business computers sharing an Internet connection, printers or files. This peer-to-peer network has no central control. Settings and local administrator permissions are changed at each computer. All you need is a cable or wireless connection directly between computers or to a central router or hub. To get started, use Windows Start > Help and Support Center. Search for Windows Workgroup or answers to other questions you have. If you do not have a domain network set up, you will probably view other computers in a workgroup (the default is "Workgroup"). To find out which network (if any) a computer is currently on, right-click My Computer and select Properties > Computer Name. Here you find the exact name of the computer, its network, and you can join or change the network if you wish. To make sure all computers are visible on the same network, use Start > My Network Places > Entire Network and look for computers under the workgroup you are using.

Am I logged in as an Administrator? Explain... Some computers are set up for different user accounts, and the accounts may have different permission settings. For example, a child's computer may be logged in and running under a limited permissions account. You need to be logged on to Windows as an Administrator user on this computer (or, in a domain network, as Domain Administrator) to install the Spector Pro software and change operating system settings.

If you do not know: If necessary, use Ctrl+Alt+Del to get the current logon information, then click Cancel. Check the Windows User Accounts for this computer (Start > Control Panel > User Accounts) and make sure the current logon belongs to the Administrators group. If it does not, you'll need to obtain a user name and password and log on as an Administrator user for this computer. Which operating system does the computer use? If you do not know: From the desktop, right-click the My Computer icon and select Properties to open the System Properties window. The Windows operating system, version, and Service Pack information are listed under "System." If the computer uses Vista... Make sure File and Printer Sharing is enabled. Follow instructions in Data File Sharing to allow access to the Spector Pro data. If the computer uses XP Professional...

Follow instructions in Data File Sharing to allow access to the Spector Pro data. If you are on a Windows Workgroup, you may need to disable simple file sharing. If the computer uses XP Home...

Make sure file sharing is enabled. Make sure File and Printer Sharing is enabled. Set up Data File Sharing to allow access to the Spector Pro data. If you are on a Windows Workgroup, you may need to disable simple file sharing. If you have trouble, consult Windows Help to set up your network. If the computer is a Macintosh... Follow the instructions provided in the Spector Pro | Mac 2009 Online Help guide to share the Spector Pro Data Files. Begin using Spector Pro as soon as it is installed on all computers, data files have been shared, and you can "see" the shared folders from My Network Places on your Viewer computer.

Sharing for Remote Viewing

As Spector Pro records activity, it stores data in hidden data files. If you plan to view data across a network, the computers must be "visible" on the network (see Preparing Computers to Share Data) and the folder storing Spector Pro data files must be shared. Spector Pro provides an easy way to "share" its data file folder directly from the System Settings > Data Files panel. The procedure automatically keeps the shared folder concealed from view. Follow this procedure for all Windows operating systems.

To create a share for the data file folder:

1. On the monitored computer, use your hotkey combination and password to open the Viewer. 2. Click Settings.

3. Select Data Files on the left side of the General Options panel. Here you see the randomly assigned Data Files Folder. 4. Check Enable Remote Access to Data Files Folder. The folder is automatically shared. The Network Share Name field changes from [Not Shared] to the name of the hidden share for this computer. The path includes the computer name (\\JOHN), the share name (\SPX), and a dollar sign ($). 5. Copy down the entire path \\computer\share$. You will use this share path from your Viewer-only installation to access the recorded data on this computer. 6. Click OK. You are asked to confirm creating the share. Click Yes to create the share, or No to cancel this setting.

Further steps may be required for successful sharing. See Preparing Computers for Remote Viewing. You may need to configure the operating system in the following ways:

Enable Data File Sharing Enable File and Printer Sharing Disable Simple File Sharing

To delete a share:

Open the System Settings to Data Files and simply uncheck the Enable Remote Access to Data Files Folder. Click OK on the Data Files panel. A message asks you to confirm the deletion. Click Yes to delete the share.

For instructions on sharing Spector Pro data on a Macintosh 10.4 or 10.5 system, refer to the Spector Pro | Mac 2009 Help guide.

Opening "Favorites"

This step is optional, and only applies if you are viewing data remotely across a network. Bookmarking a hidden share allows you to load and view recorded data for a particular monitored computer much more quickly. You do not have to manually navigate to find the appropriate folder every time you want to display recorded activity. Instead, you ask for a list of favorites which should have easily identifiable names assigned to the hidden shares, and click on the one you want. The requested data is loaded onto the Viewer. If you did not bookmark a hidden share when you were setting up data file sharing, you can do so at any time, as described below.

To bookmark data file folders:

1. From the Viewer click File > Open Data Files in the menu bar. The Browse For Folder window opens.

2. Type in the complete path that you copied down for a hidden share, including two back slashes, computer name, back slash, share name, and dollar sign (\\computer name\share name$), OR navigate to a hidden share and click to highlight it. The location of the share depends on the operating system you are using: Windows XP Home and XP Pro - data folder path is: C:\WINDOWS\system32\* Windows 2000 - data folder path is: C:\winnt\system32\*

3. Click Add to Favorites at the bottom of the window. The Add to Favorites window opens.

4. In the Name field, type a simple name to identify the particular data file folder.

5. Click OK to accept the name assigned or Cancel to reject it. The window closes. 6. Repeat this procedure for the hidden share assigned to each monitored computer.

To access a "Favorite" folder:

From the Viewer: 1. Select File > Open Data Files in the menu bar. The Browse For Folder window opens. 2. Click Favorites. The Select Favorites window opens with a list of folders that have been bookmarked.

3. Click to highlight the appropriate folder and click OK. The favorite location appears in the Browse For Folder window. 4. Click Open to load data into the Viewer. You can now access and view recorded data for the selected computer.

To edit a favorite:

From the Viewer: 1. Select File > Open Data Files in the menu bar. The Browse For Folder window opens. 2. Click Edit Favorites. The Edit Favorites window opens with a list of folders that have been bookmarked.

3. To rename a folder: click to highlight the folder and click Rename. Type a new name and click OK. To delete a folder: click to highlight the folder and click Delete. A warning message appears asking if you are sure you want to delete the item. Click OK and the item is removed from the Edit Favorites list. 4. Click Close to close the Edit Favorites window. Click OK to close the Browse For Folder window.

Data File Sharing with Windows XP Home

Before you can monitor activity on a Windows XP Home computer from a remote computer you must (a) enable file sharing and (b) enable File and Printer Sharing. Use the steps below to make sure the computer is set up for data file sharing.

Windows, tabs and field names in these instructions may vary as a result of different versions. On your system, make selections that best match what is described here.

To ensure file sharing is enabled:

1. On the monitored computer, right-click in any non-system folder and select Properties. 2. Click the Sharing tab. The Shared Documents Properties window opens. If file sharing has been enabled, the window looks like this:

Share this folder on the network is checked. A Share name has been entered. If file sharing has NOT been enabled, the window looks like this:

3. Click If you understand the security risks but want to share files without running the wizard, click here. The Enable File Sharing window opens. Click to select Just enable file sharing and click OK.

To ensure that File and Printer Sharing is enabled:

1. Open the Control Panel and double-click on Network Connections. The Network Connections window opens.

2. On the left panel, near the top, click Change Windows Firewall settings. The Windows Firewall opens. Click on the Exceptions tab.

3. Scroll down until you can see File and Printer Sharing and verify that this box is checked. If it is not, check it. 4. Click OK to close this window. Close the Network Connections window. 5. Repeat this procedure for each XP Home computer you wish to monitor.

Disabling Simple File Sharing

If you are using XP Pro or XP Home with a workgroup, the following window may appear when you type in the path of a share (directly after performing a Viewer Only installation). This may indicate that you disabled the Guest Account, while retaining simple file sharing. You will not be able to proceed until you disable simple file sharing.

To turn off simple file sharing:

1. Open the Windows Start menu and select My Computer. 2. Open the Tools menu and select Folder Options. 3. Click the View tab. 4. Under Advanced Settings, scroll down to locate Use simple file sharing. Clear (uncheck) this option. 5. Click OK.

Updates

Checking for Updates

SpectorSoft works continually to update and improve its products. All customers are notified by email whenever a major product release is scheduled. Minor updates are available, free of charge, between major releases to ensure support for recording all types of activity and to improve functionality. Spector Pro automatically checks for updates each time you open the Viewer, if Notify me of Updates is checked under Help in the menu bar. By default, this feature is ON.

To download an update:

1. If an update is available, the following window opens:

You can always download the latest version by going to the SpectorSoft web site; all you need is your serial number.

2. To download the update, click Download Now. The Technical Support Downloads page on the SpectorSoft web site opens. The Download Now! button appears in the middle of the page.

Click Remind Me Again Later, and this window will reappear the next time you attempt to open the Viewer. OR,

Click Don't Remind Me Again, and download the file from the menu bar when you are ready.

3. Click this button. The File Download - Security Warning window opens.

4. To continue with the download now, click Run. (If a second security warning opens, click Run again). The Spector Pro Setup window opens.

Click Save if you want to download and transfer the file to a CD-R, memory stick, or other storage device in order to install Spector Pro on another computer for which you have a license.

5. Proceed through the installation as you would with any Standard installation.

6. Restart your computer. Recording ceases until you do.

To turn off automatic notification of updates:

Open the Help menu and select Notify me of updates. This removes the checkmark.

To view your current version and build:

Select Help > About from the menu bar.

To check for updates manually:

If the automatic download feature has been turned off, you can check for updates when you choose. If you are not currently connected to the Internet, a connection is attempted and you can download the most recent update. 1. Select Help > Check for Updates from the menu bar. The Support - Download Software web page opens with information regarding the current build.

2. If you do not have the latest build, click the Download Now button. Follow the instructions above for running the Setup program.

3. Restart your computer to complete the installation.

Adding Licenses

SpectorSoft requires one license for each computer you are recording. You can purchase additional licenses to record additional computers. Use the Help menu to directly access the SpectorSoft Upgrades/Additional Licenses page and find out if you qualify for upgrades and the number of computers on which you currently may install Spector Pro.

To purchase additional licenses:

1. Open the Help menu and select Upgrades/Additional Licenses. An Internet browser opens to the Upgrades/Additional Licenses page. 2. Click the Click here link next to Additional licenses. This takes you directly to the online purchase procedure. 3. Make selections, fill in your billing information on the secure page, and verify and submit the order. 4. When the purchase is complete, you can immediately download the Spector Pro Setup program and install on the additional computer(s).

Troubleshooting

Introduction to Troubleshooting

SpectorSoft is committed to providing you with the best overall product experience. Our products are designed with superior quality and ease of use in mind, but we understand that issues do arise from time to time that require outside help. Consult this Troubleshooting section when difficulties arise. There are lots of places to look if and when trouble arises . . .

Check for Updates SpectorSoft supplies minor maintenance updates to the application, free of charge, between the major releases to provide continuous support for the ever changing computer environment which affects the email, instant message, and web browser programs Spector Pro records. These updates may also contain minor functionality improvements and software bug fixes. If you haven't done so lately, check for updates.

Help Online Help is your first source of assistance. Read the topics in this Troubleshooting section, and consult other sections of the Help from the Contents, Index, or Search to the left. NOTE: Press F1 to access context-sensitive Help.

Support FAQs Visit Technical Support's Online FAQs (Frequently Asked Questions) to view the most common and easiest to resolve support requests. Click here and browse through the questions and answers to see if any address your issue.

Check Your System Improper recording may result when there are underlying issues, such as unwanted viruses, software conflicts, or an out-of-date Windows program, on your computer. Follow these general steps to ensure you are working in the best possible computing environment.

1. Make sure your antivirus / antispyware software is not removing SpectorSoft files. You may need to specifically exclude SpectorSoft from scans. The Knowledge Base includes instructions for configuring several major antivirus programs. 2. Update your antivirus program. If you do not have the latest definition files, your antivirus program may not be detecting infected files that affect SpectorSoft recording. 3. Use a program that removes adware and marketing spyware. These files run automatically when the computer is used, consuming system resources and potentially interfering with computing processes. They may interfere with Spectorsoft recording. 4. Check for conflicts on your computer. Your operating system may provide tools to help you do this. For example, Windows XP provides the MSconfig utility that helps you see what is running. 5. Make sure you are running an up-to-date Windows operating system with the latest service pack.

Knowledge Base Consult the SpectorSoft Knowledge Base, a powerful web-based source of up-to-the-minute information where you can access articles on product functionality, third party program compatibility, and known bugs / fixes to help you solve technical issues. Articles are grouped into categories and include recording issues, third-party software issues, and topics such as lost serial numbers and forgotten passwords or hotkeys. To access the Knowledge Base... 1. Select Help > Access Knowledge Base from the menu bar. The Knowledge Base Search window opens. 2. Search for information by: browsing through the subject categories at the left typing keywords in the search field clicking on Top 10 Frequently Asked Questions

You must be connected to the Internet to access Knowledge Base.

Technical Support When all else fails, feel free to contact Technical Support. Select Help > Contact Technical Support from the menu bar to contact Tech Support via email. SpectorSoft makes every attempt to respond within one hour, but many people are pleased to find that SpectorSoft responds within a few minutes! Enter the information requested and click Submit. Technical Support may ask you to send settings or the log file. Always be ready to provide the following information: Windows version - The operating system version that is running on the recorded computer. Click Start > Control Panel > System to find this information. Spector Pro version and build - Select Help > About from the menu bar to find this information.

Technical Support Diagnostics

If you have a problem that requires the help of SpectorSoft Technical Support, it may be beneficial to share information about your Spector Pro information, at their request. Spector Pro provides options on the Help menu that make this easy to do. You may be asked to: Send your settings configuration View the log file Increase logged information Send the log file Restore default settings

Send Your Settings Configuration If you have altered one or more settings and Technical Support believes that this may be the source of your trouble, they will ask you to send your Profiles/Settings configuration, and possibly restore the default settings.

To share your settings configuration:

Select Help > Technical Support Diagnostics > Send Settings Configuration from the menu bar. The settings are sent.

View the Log File If the nature of your problem requires that Technical Support view your log files, they will ask you to send them. But first, you need to capture more of the data that will help solve your problem.

Increase Log File Information

To capture more relevant data:

1. Open Settings and select Application.

2. Click the Advanced button to open Advanced Application Settings. A warning appears reminding you that changing advanced settings could have an adverse effect on Spector Pro 's ability to record. Click Yes to proceed. 3. At the bottom of the box, make sure Enable Log File is checked. 4. Locate Configure security under Security in the Navigate pane at left. 5. Increase the Detail Level of the Log File to 1. This ensures that as much logging information as possible is recorded. 6. If you are requested to do so, click Configure Log File. The Log File window opens. Click the appropriate activities, as advised by Technical Support. This increases data collection only for a specific component(s, as needed. 7. Click OK to accept the changes you have made. The Log File window closes.

New settings are not activated until you click OK on the Settings window. If you click Cancel, none of the changes entered will take effect.

8. Restart your computer. 9. Try to recreate the problem (e.g., participate in some chat / IM sessions, type some keystrokes, or send a couple of test emails, depending on what the problem is), or wait until the person you are monitoring recreates the activity.

To send the log file:

1. Select Help > Technical Support Diagnostics > Send Log File on the menu bar. The Send Log File window opens.

2. Enter the password given to you by Technical Support at the bottom of the window. 3. Click OK and the log file is sent.

To restore the default settings:

If you are having trouble recording, it may be helpful to return all settings to what they were initially. Restoring default settings resets: Security settings Data Files settings Application settings Record settings as applied to Any Record System Settings that have been changed It does not remove User Profiles or User Profile settings. Note that the Security hotkey sequences return to the default and any password protection is removed. To restore settings, select Help > Technical Support Diagnostics > Restore Default Settings on the menu bar. Click Yes and OK to continue. See Restoring Default Settings.

Trouble with Screen Snapshots

If you are having trouble capturing snapshots, refer to the introduction for general troubleshooting procedures, then continue with some simple steps below.

Simple troubleshooting steps:

1. Verify that Capture Screen Snapshots is turned on in Screen Snapshots settings. 2. Older Snapshots are Missing - If the storage required for the snapshots exceeds the maximum data size configured for storage, it is possible that the oldest snapshots are being deleted before they are reviewed. As a rule of thumb, consider the following settings: length of storage (Delete Data After) size of storage (Maximum Data Size) the format in which the snapshots are stored (snapshot format) how often snapshots are taken (Take snapshots every . . . Seconds and the triggers selected) Options for managing disk space are provided in Data File Settings.

When All Else Fails . . . If, after completing all of the suggestions listed above, you are still unable to capture screen snapshots, contact Technical Support. Be sure to provide the following information to Technical Support: Clear description of the problem - Are you having trouble recording only snapshots? Are any snapshots recorded at all? History - Have snapshots ever been recorded? Windows version - What operating system and version do you have? Click Start > Control Panel > System to find this information. Spector Pro version and build information - Select Help > About in Spector Pro to find this information.

Trouble with Chat / IM

If you are having trouble recording chat / IM activity, refer to the introduction for general troubleshooting procedures, then continue with some simple steps below.

Simple troubleshooting steps:

1. Verify that Capture Chat and Instant Message Activity is turned on in Chat/IM Activity settings.

2. Verify that SpectorSoft records the type of Chat/IM you wan to capture. There are programs and protocols that Spector Pro does not record. 3. Reboot the computer. In many cases, a simple rebooting of the computer causes Spector Pro to resume recording chat / IM conversations. Try this to see if the problem is eliminated. 4. Check for Spector Pro Updates. SpectorSoft actively monitors changes and updates to all of the chat / IM programs that Spector Pro supports. If a change has been made to one of these programs that adversely effects the recording of online conversations, SpectorSoft makes the appropriate changes to its products. These changes are incorporated into a maintenance release and are available at no cost. To access an update, select Help > Check for Updates from the menu bar.

Knowledge Base Articles

Access the relevant Knowledge Base articles by clicking here and selecting the category Chat / IM at the left.

When All Else Fails . . . If, after completing all of the suggestions listed above, you are still unable to capture chat / IM conversations, contact Technical Support. Be sure to provide the following information to Tech Support: Chat / IM program(s) - Identify which program(s) is not being captured. Version - The version of each chat / IM program giving you trouble. Select Help > About in the chat / IM program to find this information. Windows version - What operating system and version do you have? Click Start > Control Panel > System to find this information. Spector Pro version and build information - Select Help > About in Spector Pro to find this information.

Trouble with Web Sites

If you are having trouble recording web sites visited, refer to the introduction for general troubleshooting procedures, then continue with some simple steps below.

Simple troubleshooting steps:

1. Verify that Capture Web Sites Visited is turned on in Web Sites Visited settings. 2. Web Browser is NOT Supported - Spector Pro records web sites visited using Internet Explorer, MS Explorer, AOL, Netscape, Firefox and MSN Explorer. Other web browsers, such as Opera, are not supported by Spector Pro. 3. No longer recording web sites visited with MSN Explorer - If Spector Pro was previously recording web sites visited using MSN Explorer and suddenly stops recording, it is possible that the MSN Explorer programs have been upgraded to a version no longer supported by Spector Pro. Contact SpectorSoft about a Spector Pro update. 4. Determine whether another application is interfering with recording web sites visited- If you are having trouble recording web sites, it is possible that there is another application running on the monitored computer that interferes with Spector Pro 's ability to capture web sites. The most likely suspects are the so-called "spyware" applications that are secretly downloaded on a user's computer when installing free software from the Internet. These "spyware" applications are often poorly written and interfere with the internal workings of Windows and consider downloading an ad-ware removal program.

5. Proxy server port needs to be added to Web Site settings - If you are having trouble recording web sites, it may be that you need to add one or more proxy ports to your Web Site settings. To locate the port number(s) used: a. In Internet Explorer, select Tools > Internet Options, and then click the Connections tab b. Click the LAN Settings button. If a proxy server is being used, you will see that Use a proxy server for your LAN is checked. c. Click Advanced to open the Proxy Settings window. d. Record the port number(s) appearing in the HTTP and Secure fields. NOTE: If the proxy server is configured to use the same port for HTTP and HTTPS, an IP address and port are displayed only in the HTTP field. Record the port number.

e. Add the port(s) to those listed in the Web Sites Visited System Settings.

When All Else Fails . . . If, after completing all of the suggestions listed above, you are still unable to record web sites visited, contact Technical Support. Be sure to provide the following information to Tech Support along with the log file: Clear description of the problem - Are you having trouble recording only web sites? Are any web sites recorded at all? History - Have web sites ever been recorded? Web browser - What web browser is being used to access web sites on the monitored computer?

Web browser version - What is the version of the web browser being used? Windows version - What operating system and version do you have? Click Start > Control Panel > System to find this information. Spector Pro version and build information - Select Help > About from the menu bar to find this information.

Trouble with Email

If you are having trouble recording email activity, refer to the introduction for general troubleshooting procedures, then continue with some simple steps below.

Simple troubleshooting steps:

1. Verify that Capture Email Activity is turned on in Email Activity settings. 2. Application not supported - Spector Pro captures the most popular email programs. However, there are email programs that Spector Pro does not record, including some webmail applications (web- based email programs). If this is the case, you can still see snapshots of these conversations, but you cannot read the email from the Email Activity event window. 3. Reboot the computer - In many cases, simply rebooting the computer causes Spector Pro to resume recording email activity. Try this to see if the problem is eliminated.

4. Check for Spector Pro Updates - SpectorSoft actively monitors changes and updates to all email programs that Spector Pro supports. If a change has been made to one of these programs that adversely effects the recording of email activity, SpectorSoft makes the appropriate changes to its products. These changes are incorporated into a maintenance release and are available to you for free. To access any new updates, select Help > Check for Updates from the menu bar.

Corrupt Data Files Data files that store email conversations can, on occasion, be corrupted. To remedy this problem, delete the email data files. This deletes all recorded email conversations. Backup any conversations you wish to keep before deleting the files.

To delete email files:

1. Select Data > Show Data Files from the menu bar. Look for rows in which the Type is Email.

2. Click to select a row.

3. Click the Delete button on the tool bar. A warning appears asking if you want to delete the selected file. Click Yes to delete it, or No to cancel. If you select Yes, the file is deleted. 4. Restart your computer and test email capture.

Using Another Monitoring Product SpectorSoft has found that problems may arise on occasion when SpectorSoft products are used in conjunction with other monitoring products. If this happens, uninstall the other monitoring product to determine if the problems are resolved.

Knowledge Base Articles

Check the Knowledge Base for any additional information.

When All Else Fails . . . If, after completing all of the suggestions listed above, you are still unable to capture email conversations, contact Technical Support. Be sure to provide the following information to Tech Support: Email program(s) - Identify which program(s) is not being captured. Email version - The version of each email program giving you trouble. Select Help > About in the menu bar of the email program to find this information. Web-based email - If it is this kind of account, send the URL (web address) account, along with the version of the web browser you are using. Windows version - What operating system and version do you have? Click Start > Control Panel > System to find this information. Spector Pro version and build information - Select Help > About in Spector Pro to find this information.

Trouble with Keystrokes

If you are having trouble recording keystrokes, refer to the introduction for general troubleshooting procedures, then continue with some simple steps below.

Simple troubleshooting steps:

1. Verify that Capture Keystrokes Typed is turned on in Keystrokes Typed settings. 2. Determine whether another application is interfering with recording keystrokes - If you are having trouble recording keystrokes, it is possible that there is another application running on the monitored computer that interferes with Spector Pro's ability to intercept keystrokes. The most likely suspects are the so-called "spyware" applications that are secretly downloaded on a user's computer when installing free software from the Internet. These "spyware" applications are often poorly written and interfere with the internal workings of Windows. Follow the procedure outlined in the General Troubleshooting Guide, and consider downloading an ad-ware removal program.

Knowledge Base Articles

Access the relevant Knowledge Base articles by clicking here, and selecting the category Keystrokes at the left.

When All Else Fails . . .

If, after completing all of the suggestions listed above, you are still unable to capture keystrokes, contact Technical Support. Be sure to provide the following information to Tech Support: Clear description of the problem - Are you having trouble recording only keystrokes? Are keystrokes recorded at all in some applications? History - Were keystrokes previously recorded? Language used - Are non-U.S. keyboards being used? Windows version - What operating system and version do you have? Click Start > Control Panel > System to find this information. Spector Pro version and build information - Select Help > About in Spector Pro to find this information.

SpectorSoft Information

General SpectorSoft Corporation 1555 Indian River Blvd., B-210 Vero Beach, FL 32960 USA Web Site: www.spectorsoft.com U.S. & Canada: 888-598-2788 International: 772-770-5670

Sales Contact the SpectorSoft sales staff for pre-sales questions, upgrade options, and information about the latest SpectorSoft products. Monday - Friday 9:00 AM to 10:00 PM EST Saturday & Sunday 10:00 AM to 6:00 PM EST

Web: Product Inquiry by Email Email: [email protected] Sales Fax: 772-770-3442

Technical Support Contact SpectorSoft engineers if you have any difficulties at all, 24 hours a day, seven days a week.

Web: Tech Support by Email Email: [email protected]

Suggestions and Comments SpectorSoft is always interested in hearing from its customers. If you would like to make a suggestion that would improve this product or the Online Help, do not hesitate to contact us. Select Help > Give us your Suggestions on the menu bar. The Your Opinion Counts window on our web site opens. Answer the survey questions and / or enter comments on how we can improve.

Company Profile

SpectorSoft develops, markets, and supports computer and Internet monitoring products (for Windows and Macintosh) for both consumers and businesses. Recognizing that families and corporations need to know what their family members / employees are doing on the Internet, SpectorSoft was founded to provide the first useful and intuitive recording and playback products for Windows computers (running Windows XP, Windows Me, Windows 98 and Windows 2000) and Macintosh (OS X and OS 9).

Our Goals Our company goal is a simple one: to provide truly useful Internet tools for parents, employers, educators, and government offices concerned about inappropriate use of the web; to make these tools powerful, yet simple to use; and to provide these tools at an affordable price, backed by top-notch support, 24 hours a day, seven days a week.

Product Line Spector Spector records everything anyone does on the Internet by automatically taking hundreds of snapshots every hour, very much like a surveillance camera. Spector also records web site activity and every keystroke typed, so you can see exactly what your kids and employees have been doing online and offline. Spector Pro Spector Pro tracks every detail of what has transpired on your computers including email messages (SMTP and web-based services such as Hotmail), chat / IM conversations, online searches and web sites visited. It provides a thorough presentation of all computer activity, but you can also access Top 10 reports, and a quick view of MySpace activity. Spector Pro also includes a flexible screen snapshot capability and the best keystroke logger available anywhere! eBlaster eBlaster is the ONLY software that captures a user's incoming and outgoing emails, as well as chat and instant messages, and IMMEDIATELY forwards them to any email address you choose. eBlaster also creates an hourly Activity Report detailing all emails sent and received, chats, IMs, keystrokes typed, web sites visited, logon / logoff information, programs launched and peer-to-peer (P2P) files downloaded - and then sends it directly to YOUR email address. It can also send Instant Notification of Keyword Alerts. Spector Corporate Network Edition (CNE)

Spector CNE combines Spector Pro, winner of the prestigious PC Magazine Editors’ Choice award, with your corporate network capabilities. Spector CNE features automated deployment and remote management tools, and records a wide range of PC activity including email, chat / IM, web surfing, keystrokes and programs used. Spector CNE also includes SpectorSoft's award-winning snapshot recordings with easy playback controls. Spector 360 for Networks

This product brings the review of your recorded PC data to a new level. Harnessing the power and flexibility of a relational database, the Spector 360 Dashboard enables you to search, filter, and consolidate

recorded activities to produce charts, grids, and reports. With the Dashboard, you can visualize trends, make comparisons at a glance, and at any time navigate into the details for a single event. Spector for Mac Spector for Mac automatically takes hundreds of screen snapshots every hour, up to once a second, very much like a surveillance camera.

SpectorSoft Corporation is located in Vero Beach, Florida. For more information, visit our web site.

Copyrights and Trademarks

SpectorSoft Copyrights and Trademarks Spector is a copyright 1998 - 2009 of SpectorSoft Corporation. Spector, Spector Pro and SpectorSoft are Registered Trademarks of SpectorSoft Corporation. eBlaster is a Registered Trademark of SpectorSoft Corporation. This software includes code under license from Microsoft Corporation. © 1995-2004 Microsoft Corporation. All rights reserved.

Copyright Notice All materials appearing anywhere within SpectorSoft’s Help file are protected by worldwide copyright laws and treaty provisions. The copyright on such materials is held by SpectorSoft Corporation or its subsidiaries (collectively, "SpectorSoft"), or by the original creator of the materials. None of the materials may be copied (other than for personal use), reproduced (other than for personal use), displayed, modified, published, uploaded, posted, transmitted, or distributed in any form or by any means without SpectorSoft’s prior written permission. All rights not expressly granted herein are reserved. Any unauthorized use of the materials appearing on SpectorSoft’s Help Files may violate copyright, trademark, and other applicable laws and could result in criminal or civil penalties. Your use of SpectorSoft’s Help Files constitutes your acknowledgment and acceptance of SpectorSoft’s terms of use. If you do not agree with these terms of use, please do not use SpectorSoft’s Help Files.

Trademarks for Other Companies Hotmail, Outlook, Microsoft, Microsoft Internet Explorer logo, Microsoft Office Compatible logo, Explorer, Windows, Windows logo, Windows XP, Windows 98, Windows ME, Windows 2000, and / or other Microsoft products referenced herein are either registered trademarks or trademarks of Microsoft Corporation in the U.S. and / or other countries. Macintosh and Mac are trademarks of and copyrighted by Apple, Inc. AOL and AOL Instant Messenger are trademarks of America Online, Inc. Yahoo! Brand Features are copyright of Yahoo! Inc. Google is a trademark of Google, Inc. MySpace is a registered trademark of MySpace, Inc. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation IrCQ-Net is a trademark of ICQ Inc.

Trillian is a trademark of Cerulean Studios These Help Files may contain other names and phrases (marks) that may or may not be trademarks of other organizations. All other trademarks and service marks are the property of their respective owners.

Glossary

AOL America Online an Internet service provider, bulletin board system, and media company operated by Time Warner. AOL offers products and services, such as AOL Mail and AOL ® Instant Messenger, using a number of well-known communication protocols. Most of these services are recorded.

Administrator User A user who belongs to the Administrators group (unlike a STANDARD or LIMITED user) has all privileges to control files on the computer. If you are logged in as Administrator, you're able to right-click the date in the Windows notification area and change the system date and time. See Windows Start > Control Panel > Users (or User Accounts). For more information about Administrator users, consult the Control Panel's Help.

Chat Chat conversations occur in a virtual online room that multiple users "enter" in order to exchange ideas on a particular topic in real time.

FTP File Transfer Protocol (FTP) uses the Internet's TCP/IP protocols to enable data transfer. FTP is most commonly used to download or upload files from servers on the Internet.

Gnutella Gnutella is a file sharing network protocol used primarily to exchange files. Applications use it to allow a user to connect directly to another connected user (computer) and transfer a file via HTTP.

HTTP HyperText Transfer Protocol (HTTP) is the primary method used to convey information on the World Wide Web. HTTP is a request/response protocol between clients and servers. An HTTP client, such as a web browser, typically initiates a request by establishing a TCP/IP connection to a particular port on a remote host (port :80 by default).

HTTPS HTTP is a request/response protocol between clients and servers. HTTPS adds security.

Hotkey Sequence A series of keys you press simultaneously to execute a command. Hotkeys provide a "stealthy" way to operate Spector Pro. The default combination to open the Viewer is Ctrl+Alt+Shift+S. Hold each key down as you type the next. You can also define hotkeys to start/stop recording and take a snapshot. See Application Settings.

ICQ The "I-Seek-You" protocol has been around for about 10 years. Starting as an instant messaging service, it now supports multi-user chat rooms and computer games, file transfers, greeting cards, Video, VoIP, and other transactions. An ICQ client program allows users to find and maintain a contact list of others using the ICQ client.

IMAP Internet Message Access Protocol is a protocol for retrieving email messages. IMAP allows a local client email application to download email from a remote server without deleting messages from the server. Nearly all email clients (MS Outlook, Outlook Express, Thunderbird, and Eudora) will receive email via IMAP in addition to POP. IMAP is often used in large networks, such as a college campus mail system. IMAP allows users to access new messages instantly on their computers, since the mail is stored on the network.

IMAPI Windows XP manages CD/DVD recording using Image Mastering Applications Programming Interface (IMAPI).

Instant Messaging Instant Messaging (IM) is real-time communication between two or more people. Each person uses the same "Messenger" application to send and receive messages over a network or the Internet.

IP Address An IP address (Internet Protocol address) is a unique number assigned to a device for communication purposes. A computer's IP address can be assigned randomly by DHCP (different every time) or it can be a static address (always the same for this device). Usually a 32-bit numeric address, it is written as four numbers separated by periods, for example: 162.142.55.0.

IRC Internet Relay Chat (IRC) enables people connected anywhere on the Internet to join in live discussions that are not limited to just two participants. To join an IRC discussion, you use a local IRC client to send and receive messages to and from an IRC Internet server. The IRC server broadcasts the messages to everyone participating in a discussion. There can be many discussions going on at once; each one is assigned a unique channel.

Internet Service Provider (ISP) An ISP is a company that provides access to the Internet.

Jabber Jabber an "open" ad-free Instant Messaging application offered as an alternative to services like AIM, ICQ, MSN, and Yahoo. Jabber is a set of streaming XML protocols including XMPP that enable any two entities on the Internet to exchange messages, presence, and other structured information in close to real time.

Kazaa A peer-to-peer file sharing application. Users connect to each other directly, without need for a central point of management. If Kazaa is on computer A and on computer B, a user on computer A can search for a file on computer B and download the file directly. Kazaa is used most often to exchange music, video, pictures, and software files. The Kazaa client can be downloaded free of charge and is susceptible to bundling with adware and spyware.

MAPI Messaging Application Programming Interface is a Microsoft protocol that enables different email applications to work together to distribute mail. As long as both applications are MAPI-enabled, they can share mail messages with each other. MS Outlook and MS Exchange communicate via MAPI.

Microsoft Exchange Exchange is a messaging platform that provides email, scheduling, online forms, and the tools for custom collaboration and messaging-service applications.

MSN Microsoft Network (MSN) provides MSN Chat, MSN Messenger, Windows Live Messenger, and other forms of communication to anyone with a registered Microsoft Passport (or Hotmail or MSN email address). MSN maintains its own messaging and chat protocols.

Peer to Peer Peer-to-Peer (P2P) refers to software programs that allow two computers to connect over the Internet in order to exchange files.

POP Post Office Protocol, a protocol used to retrieve e-mail from a mail server. Most e-mail applications (e-mail clients) use the POP protocol, although some can use the newer IMAP (Internet Message Access Protocol). There are two versions of POP. The first, called POP2, became a standard in the mid-80's and requires SMTP to send messages. The newer version, POP3, can be used with or without SMTP.

Port In the Internet/network context, a port provides a destination for a particular type of data. For example, HTTP (web site) traffic normally occurs on port 80. SMTP email is usually sent using port 25, and POP email is frequently received at port 110. Spector Pro listens for activity at all standard communication ports.

Protocol A protocol is a standard that controls the connection, communication, and data transfer between two endpoints.

Skype Skype is a software program that allows users to make telephone calls from their computer to other Skype users. Although eBlaster does not record Skype telephone calls, it does record the Skype instant messaging and file transfer features.

SMTP Simple Mail Transfer Protocol is the standard for email transmission across the Internet. SMTP is used by most Internet Service Providers for outgoing mail. eBlaster records SMTP email by default at ports 25 and 587.

Universal Naming Convention (UNC) A UNC location can be accessed from anywhere on the network. It requires a computer name, a path to a shared folder, and a file name. For example, on Bob's computer, there is a "share" named public and a file

assigned to that share named games.doc. The file is really located at C:\temp\games.doc, but the UNC file path is \\Bob's Computer\public\games.doc.

User (defined) Each user individually identifies him / herself when logging in to the computer with a unique Windows username and password.

Webmail Webmail is Internet-based email services such as Hotmail, Yahoo Mail, AOL and Myspace email. Webmail does not require a local email application; you simply log in to your email account at the Internet site.

XMPP Extensible Messaging and Presence Protocol (XMPP) is an XML-based protocol for instant messaging. XMPP is used by Jabber and other instant messaging applications.

Yahoo Yahoo! (Yet Another Hierarchical Officious Oracle) is a global Internet service offering webmail, instant messaging, file transfer, media downloads, online chat, voice communication, and more. Yahoo! maintains its own protocols for chat rooms and instant messaging.

A Date range of loaded data...... 17 Add Licenses ...... 263 Default settings ...... 143, 144 Alerts, see Keywords ...... 177 Delete...... 133 All Recordings (see Viewing Recorded Events) Data files...... 141 ...... 38 Recorded events...... 133 Snapshots ...... 98 Arranging Columns ...... 129 Disable a type of Chat/IM capture ...... 224 B Document Tracking ...... 77 Backing up recorded data...... 135, 140 by CD/DVD burn...... 172 by Drive ...... 170 Blocking access ...... 189 by Printing...... 172 for specific users ...... 146 by Type of drive ...... 169 on a schedule...... 206 Configuring...... 167 to Chat/IM contacts ...... 198 Default tracking...... 173 to the Internet ...... 202 File filter ...... 171 to Web Site domains ...... 192 Viewing...... 77 Bookmarking a hidden share ...... 252 Downloading Updated Version...... 261 C E Changing settings ...... 143 Email Activity ...... 52 Characters (foreign characters)...... 231 Email recorded ...... 57 Enable record characters ...... 231 Facebook messages ...... 125 View characters typed ...... 64 Filtering, settings...... 154 MySpace Messages ...... 116 Chat/IM...... 43 Record attachments ...... 153 Blocking ...... 198 Recording...... 153 Disable recording of a protocol ...... 224 Settings ...... 153 MySpace ...... 118 Top 10 ...... 106 Ports used to record...... 224 Troubleshooting ...... 271 Recording...... 150 Viewing...... 52 System settings ...... 224 Webmail recorded...... 58 Top 10 ...... 101 Troubleshooting ...... 269 Email notification, keywords ...... 182 Types recorded ...... 43 Viewing...... 39 F Checking for Updates ...... 261 Facebook...... 120 Accounts ...... 122 Clearing References from Internet Explorer Always display the tab...... 31 ...... 31, 36, 241 Messages ...... 125 Console activity (Cmd and DOS) ...... 233 Password...... 122 Profiles ...... 124 D Report ...... 121 Data File Sharing ...... 250 Snapshots ...... 120 Disabling Simple File Sharing ...... 259 Summary ...... 124 Windows XP Home...... 255 File management (see Data Files) ...... 138 Data Files ...... 138 Files Transferred...... 61 Backing Up ...... 140 Recording...... 159 Deleting ...... 141 System settings ...... 227 Refreshing...... 17 Viewing...... 61 Restoring ...... 140 Filtering Settings ...... 211 Email recorded ...... 154 Space management of...... 213 Files tracked ...... 171

Snapshots viewed...... 92 Marking Snapshots...... 91 View of data by program...... 128 Menu Bar...... 23 View of data by user ...... 128 Messages G Facebook...... 125 Group by ...... 131 Mode of Operation Installation ...... 241, 245 H Opening the Viewer ...... 6 Hotkey Sequence...... 6 MySpace...... 111 Define during installation ...... 241, 245 Activity List...... 111 to Open the Viewer ...... 6 Always display the tab...... 31 to Take a snapshot ...... 93 Chat / IMs ...... 118 Messages ...... 116 I MySpace Accounts ...... 113 Report ...... 112 Installing Spector Pro ...... 255 Snapshots ...... 111 Standard Installation...... 239 Summary ...... 116 Instant Messaging (IM) Top 10 Messages Received...... 114 Blocking ...... 198 Top 10 Messages Sent...... 115 Chat / IMs Supported ...... 43 Top 10 Profiles Visited ...... 115 MySpace ...... 118 Settings ...... 150 N Top 10 ...... 101 Network Activity Troubleshooting ...... 269 Settings ...... 164 Viewing...... 39 Viewing...... 83 Invalid Serial Number...... 265 No data shown ...... 17 K O Keystrokes Typed ...... 64 Online Searches Recording...... 160 Top 10 ...... 103 System settings ...... 231 Viewing...... 45 Troubleshooting ...... 273 Viewing...... 64 Open files form a Macintosh ...... 15 Keywords Alerts...... 177 Open files from a remote computer ...... 15 Advanced Email Alert Settings ...... 184 Opening the Viewer...... 6 Introduction, settings ...... 177 Setting up Email Notification Alerts...... 182 P Top 10 ...... 109 Passwords Viewing Keywords Detected ...... 80, 109 Installation ...... 241, 245 Knowledge Base ...... 264 Opening the Viewer ...... 6 Security Settings ...... 209 L Program Activity Layered windows ...... 233 Settings ...... 162 Logon warning...... 233 Top 10 ...... 108 Viewing...... 69 M When to Record Selecting Programs...... 215 Managing Data ...... 248 Backing Up and Retrieving Data...... 140 R Data File Settings ...... 211 Deleting Data Files...... 141 Recorded Activities (see Viewing Recorded Introduction...... 35 Events) ...... 38, 87, 100, 111, 144 Remove References from IE ...... 36 Recorded Data (see Viewing Recorded Security ...... 35 Events) ...... 38, 87, 100, 111, 144 Uninstalling Spector Pro...... 248 Recorded Events (see Viewing Recorded Working with Data Files ...... 138 Events) ...... 38, 87, 100, 111, 144 Manual Settings Refresh Data...... 17 Taking Snapshots ...... 93 Remote Viewing Across a Network...... 15 Manually Take Snapshots...... 93

Restoring Default Settings...... 144, 266 T Resume Recording ...... 31 Technical Support Retrieving Recorded Data...... 140 Contacting...... 274 Introduction to Troubleshooting ...... 264 S Restoring Default Settings ...... 266 Saving Sharing Information with ...... 266 Recorded Data ...... 135 Test Email, keywords ...... 184 Snapshots ...... 94 Time stamp on Chat/IM ...... 224 Schedule Toolbar Shortcuts ...... 28 recording...... 175 Top 10 Reports Screen Snapshots Activity List...... 100 Deleting ...... 98 Chat / IM Activity ...... 101 Filtering ...... 92 Email Activity...... 106 Marking...... 91 Keywords Detected ...... 109 MySpace ...... 111 Online Searches ...... 103 Saving ...... 94 Program Activity...... 108 Settings ...... 149 Top 10 Messages Received, Facebook .. 123 Taking Snapshots Manually ...... 93 Top 10 Messages Received, MySpace... 114 Troubleshooting ...... 268 Top 10 Messages Sent, Facebook...... 123 Viewing...... 87 Top 10 Messages Sent, MySpace...... 115 Searching Top 10 Profiles, Facebook ...... 124 Recorded Events...... 19 Top 10 Profiles, MySpace ...... 115 Search In . . . Options ...... 22 Web Sites Visited...... 104 Security Troubleshooting Advanced Security, settings ...... 233 Chat / IM...... 269 Data File Settings ...... 211 Chat / IMs Supported ...... 43 Introduction...... 35 Checking for Updates ...... 261 Passwords ...... 209 Email Supported...... 57 Servers, configuring ...... 184 Emails...... 271 Introduction...... 264 Service monitoring credentials ...... 233 Invalid Serial Number...... 265 Settings Keystrokes ...... 273 Alerts...... 177 Screen Snapshots...... 268 Chat / IM Activity ...... 150 Sharing Information with Technical Support Customizing...... 144 ...... 266 Data Files ...... 211 Web Sites...... 270 Document Tracking...... 167 Email Activity...... 153 U Files Transferred...... 159 Uninstalling Spector Pro...... 248 Introduction...... 144 Keystrokes Typed ...... 160 Upgrades/Additional Licenses ...... 263 Keywords, alerts...... 177 User Activity Network Activity ...... 164 Filtering by User ...... 128 Program Activity...... 162 Viewing...... 72 Restoring Default Settings ...... 144, 266 Screen Snapshots...... 149 V Security ...... 35 Validate Server's Certificate...... 184 Taking Snapshots Manually ...... 93 Web Sites Visited...... 151 View Options...... 31 Snapshot Context ...... 30 Viewer Blocking Access...... 189 Spector Pro Clearing References from the Internet Overview...... 5 Explorer ...... 36 SpectorSoft Deleting Recorded Events ...... 133 Company Profile ...... 275 Filtering Data by Program or User ...... 128 Contact Us...... 274 Getting Acquainted with ...... 12 Copyrights and Trademarks ...... 276 Grouping Recorded Events ...... 131 Standard installation ...... 241 Keyboard Shortcuts ...... 33 Menu Bar ...... 23

Opening ...... 6 Bookmarking Hidden Shares...... 252 Saving Recorded Events ...... 135 Data File Sharing...... 250, 255 Search In . . . Options ...... 22 Performing a Viewer Only Installation .. 245 Searching Recorded Events ...... 19 Snapshot Context ...... 30 W Toolbar Shortcuts ...... 28 Web Email Supported ...... 58 View Options...... 31 Viewer Menu Bar ...... 23 Web Sites Visited...... 48 Blocking ...... 192 Viewer Only installation ...... 245 Settings ...... 151 Viewing Recorded Events Top 10 ...... 104 All Recordings ...... 38 Troubleshooting ...... 270 Document Tracking...... 77 Viewing...... 48 Email Activity...... 52 When To Block ...... 206 Facebook Activity ...... 120 Blocking Chat / IM ...... 198 Files Transferred...... 61 Blocking Internet Access...... 202 Keystrokes ...... 64 Blocking Web Sites ...... 192 Keywords Detected ...... 80 When To Block MySpace Activities ...... 111 Setting Up a Schedule...... 206 Network Activity ...... 83 Online Searches ...... 45 When To Record Program Activity...... 69 When To Record Screen Snapshots...... 87 Selecting Programs...... 215 Top 10 Reports, list of ...... 100 Setting Up a Schedule...... 175 User Activity ...... 72 Who To Record Web Sites Visited...... 48 Selecting Users (see When To Record). 175 Viewing Remotely Across a Network