WO2006089352A1

WO2006089352A1 - Method and system for monitoring computer systems

Info

Publication number: WO2006089352A1
Application number: PCT/AU2006/000217
Authority: WO
Inventors: Nathan Powell
Original assignee: United Electrical Software P/L
Priority date: 2005-02-22
Filing date: 2006-02-21
Publication date: 2006-08-31

Abstract

A method for tracking modifications to a hardware configuration of a computer system is disclosed, the method including the steps of (a) capturing a first snapshot of the hardware configuration of the computer system at a first point in time; (b) storing the first snapshot in a remote database; (c) capturing a second snapshot of the hardware configuration of the computer system at a second subsequent point in time; and (d) comparing the stored first snapshot and the second snapshot. Any difference between the first and second snapshots indicates that a change has been made to the hardware configuration of the computer system. This method can reduce warranty abuse or fraud by the users of the computer system and also reduce the likelihood of theft of the computer(s) and any attached peripheral equipment.

Description

TITLE: METHOD AND SYSTEM FOR MONITORING COMPUTER SYSTEMS

Field of the Invention

The present invention relates to methods and systems for monitoring computer systems and more particularly to monitoring modifications to hardware configurations of computer systems.

Background to the Invention

Many new computer products and peripherals are covered by a manufacturer's warranty. Manufacturer's warranties vary in terms of the extent of repair, replacement and refund options that are available for a particular product. Most manufacturers' warranties contain express limitations regarding computer equipment which has been modified since the purchase date.

Many computer equipment distributors or resellers offer extended warranties on newly purchased equipment which constitutes an upgrade on the basic manufacturer's warranty, Extended warranties may take effect either when the manufacturer's warranty expires, or operate during and after the term of the manufacturer's warranty. Some extended warranties can be obtained through third-party warranty vendors.

Warranty abuse or fraud is a major problem for warranty vendors. When system failures occur for a product under warranty, the customer usually sends the system back to the manufacturer or authorised service provider for warranty repair. The manufacturer or third party warranty provider then repairs the system, expending whatever parts and/or labour are required to rectify the problem. However, it is not uncommon for a customer to modify a system through installation of non-genuine, defective or used parts, before reporting the system as being faulty and returning it to the manufacturer or third party warranty provider for repair under warranty. A related issue is an increase in the theft of notebooks, desktop computers and peripheral computer equipment, The theft of such devices has become a significant problem for many businesses, Security measures such as password protection can be readily circumvented by making hardware modifications to the stolen computer. Moreover, such security measures clearly fail to prevent or deter authorised users to whom the password is known from stealing computing equipment. Other security measures such as physical locks and other attachment devices can be forcibly removed and an authorised user with an appropriate key can merely use the key to unlock the attachment device and steal the computer,

The discussion of the background to the invention included herein is included to explain the context of the invention, This is not to be taken as an admission that any of the material referred to is published, known or part of the common general knowledge as at the priority date of the claims,

Summary of the Invention

According to an aspect of the present invention, there is provided a method for tracking modifications to a hardware configuration of a computer system, the method including the following steps;

(a) capturing a first snapshot of the hardware configuration of the computer system at a first point in time;

(b) storing the first snapshot in a remote database;

(c) capturing a second snapshot of the hardware configuration of the computer system at a second subsequent point in time;

(d) comparing the stored first snapshot and the second snapshot; wherein any difference between the first and second snapshots indicates that a change has been made to the hardware configuration of the computer system.

The tracking of modifications to the hardware configuration of a computer system is useful both for warranty providers and also for reporting theft of computer components.

Preferably, the method further includes the step of generating an alert to notify a nominated person that a modification has been made to the hardware configuration, Such an alert may be directed to a system administrator, warranty provider or other nominated person.

In a preferred embodiment of the invention, the fiπst point in time occurs when a program for performing the steps of the method for tracking modifications to a hardware configuration of a computer system is installed in the computer system and the second point in time occurs each time the computer system is turned on or restarted subsequent to the program being installed on the computer system.

In one form of the invention, the hardware configuration includes one or more of the following:

(a) disc drive type;

(b) central processing unit (CPU) type;

(c) memory configuration;

(d) peripheral devices. Most preferably, the method further includes the following steps:

(a) checking a status of the computer system each time a snapshot is captured; and

(b) if the status of the computer system indicates that the system has been stolen;

(c) determining a network identifier associated with the computer system; and

(d) reporting the network identifier to the nominated person;

wherein the network identifier can be used to determine the physical location of the computer system.

The network identifier may include one or more of the following:

(a) an IP address; or

(b) a MAC address.

In one embodiment, the method further includes the step of monitoring a performance parameter of one or more hardware components,

Preferably, the performance parameter is measured and the measured performance parameter is compared to a stored performance parameter included in the first snapshot. Preferably, the performance parameter is measured each time the system is started up. Most preferably, a change in the performance parameter^' causes an alert to be generated to notify the nominated person that a potential problem exists with the hardware component.

According to another aspect of the present invention, there is provided a method of 5 providing a warranty for a computer system, the method including the following steps:

(a) providing software for tracking changes in one or more hardware configuration parameters in a computer system.

(b) installing the software on the computer system;

■ 0 (C) capturing a first snapshot of a hardware configuration of the computer system at a first point in time;

(d) storing the first snapshot in a remote database;

(e) capturing a second snapshot of the hardware configuration of the computer system at a second subsequent point in time,

^; 5 (f) comparing the stored first snapshot and the second snapshot, and

(9) generating an alert for transmission to a warranty provider if the comparison reveals any difference between the first and second snapshots;

wherein a difference between the first and second snapshots indicates that 0 a change has been made to the hardware configuration of the computei system and causes the warranty provider to reassess validity of the warranty According to yet another aspect of the present invention, there is provided a method of tracking a stolen computer system, including the following steps-

(a) providing software for tracking a network identifier associated with a computer system;

(b) installing the software on the computer system,

(c) reporting the computer system as being stolen;

(d) monitoring a network identifier associated with the stolen system; and

(e) reporting the network identifier to the nominated person,

An advantage of the present invention is that manufacturer's and/or other warranty providers are enabled to monitor whether hardware modifications have been made^; to a computer system to alleviate the problem of fraudulent warranty claims

Another advantage of the present invention is the ability to track a network identifiei for a stolen computer system which can be used to determine a physical location of the stolen device

Brief Description of the Drawings

The invention will hereinafter be described in greater detail with reference to the attached drawings, which show example embodiments of the invention It is to bo understood that the particularity of the drawings does not supersede the generality of the preceding description of the invention Figure 1 is a systematic view showing the system components used to perform the present invention according to an embodiment.

Figure 2A is a flow chart illustrating the steps of the method of the present invention according to an embodiment.

5 Figure 2B is a flowchart which is a continuation of the flow chart in Figure 2A,

Detailed Description

Referring firstly to Figure 1 , there are shown the components used to perform the method according to one embodiment of the invention. The components include a plurality of computer systems 10 coupled to a remote server 12 via a TCP/iP 10 network 14 such as the Internet or some other analogous network.

Referring now to Figure 2A, a software program configured to perform the steps of the method must be installed on each of the computer systems to be monitored 16. The program is configured to capture a snapshot of the hardware configuration of the system and transmit the same to a remote server via a network for storing

I S and/or further processing. Installation of this software involves the inputting of requested user data for storage in a database on the remote server 18. The requested data includes a product key (or warranty identification number) which is provided on purchase of the software, a purchase date, an expiry date, and customer details including the name and email address of a person nominated by the 0 customer to receive alerts regarding any system modifications, This person may be a system administrator, computer system manufacturer, warranty provider, or other suitable person.

The data provided by the customer is encrypted and transmitted to the remote server, where it is stored in a database. As part of the registration process, the 5 system conducts a check to ensure that the product key is valid 20, If the product key is not valid, the registration process is terminated, If the product key is valid, the registration process is completed and the user data is entered into and stored in the database. Once the user data has been entered into the database, an auto generated PDF file containing the warranty policy details, terms and conditions is forwarded to the nominated person's email address for future reference.

5 Once the software has been installed and registered, a first snapshot of the hardware configuration of the system is captured 24. The hardware configuration may include any one or more of the following: disc drive type; central processing unit (Cf³U) type; memory configuration; connected peripheral devices and the like. The snapshot includes a build sheet encompassing the system's hardware configuration. I O The snapshot or build sheet is stored in the database as an XML file 26. An example of such a build sheet is shown in Appendix 1. The sample build sheet provides a number of examples of features which may bθ monitored in accordance with an embodiment of the invention.

The first snapshot will include data relating to hardware components and ^! 5 specifications which were installed in the system when it was built and/or when the software was installed. In the build sheet, original equipment may be annotated as "original equipment" for easy reference,

Referring now to Figure 2B, a second or subsequent snapshot is captured automatically each time that the computer system is turned on or restarted 28. The 0 second snapshot captures the same data set as the first snapshot but at a subsequent point in time 30. This enables the snapshots to be compared such that any difference in the snapshot data is indicative of modifications made to the hardware configuration of the computer system in the intervening period,

As with the first snapshot (or original build sheet) the second snapshot is encrypted 5 and transmitted to the remote server 32 for comparison to the first snapshot 34. Any variation in system configuration parameters between the first and second snapshots indicates that a modification has been made to the hardware configuration since the first snapshot was captured 36. The build sheet resulting from the second snapshot is annotated with the terms "modified equipment" or similar to clearly indicate which system configuration parameters have been modified. The resulting build sheet can also be configured to indicate when a hardware modification was detected In the event that the computer system is not connected to a network when modification of hardware configuration is detected, the rnodifιcation(s) will be stored in an XML file to be transmitted to the server the next time that a network connection is delected It is to be understood that the tracking of hardware configuration modifications is a transparent back end process,

When the comparison indicates that a modification has been made 38, an alert is generated for transmission to the nominated person, to notify the system administrator, warranty provider or other suitable person that a hardware modification has occurred in a system for which the nominated person is responsible 40

T here are two clear uses for the system hardware modification data Firstly, a system administrator can be made aware that a hardware modification has occurred to enable appropriate action to be taken if required For example, consider the scenario where the hardware modification is the result of a monitor having been disconnected from the computer system The alert should prompt the system administrator to take appropriate steps to determine whether disconnection of the device was authorised and if not, and attempts to locate the missing device are unsuccessful, it can be concluded that device has been stolen, This enables system administrators to monitor theft of computer components which may not otherwise be obvious

Alternatively, the occurrence of any hardware modifications can be reported to a warranty provider such that the warranty provider can determine whether the modification invalidates the terms of any warranty existing for the computer system T he database on the remote server may be provided by a warranty vendor, to enable the warranty vendor to keep lrack of any authorised or unauthorised hardware modifications In addition to the hardware modification facility, the system preferably includes a theft tracking facility. The role of the theft tracking facility is to monitor the status of each computer system and if the status is recorded as "stolen" to undertake to track a location identifier associated with the device, Each time the computer system is turned on or restarted, a check is made of the status of the system. For instance, if a system administrator advised the warranty provider that a particular system has been stolen, that system will be flagged as being stolen in the database and subsequent sta rting of that device will cause the theft tracking script to be activated , The theft tracking script may be an ASP script residing on the remote server. In ^■ addition, it should be understood that the script runs in the background such that a thief would not ordinarily be aware that the stolen computer is being tracked. The ASP theft tracker script according to an embodiment of the invention is attached as Appendix 2,

The theft tracking script captures a network identifier as soon as the stolen computer system is connected to the Internet, The network identifier is typically a network address which is given to a device when it is manufactured or assigned when the device is connected to a network. Such network addresses include Internet Protocol

(IP) addresses or Media Access Protocol (MAC) addresses, An IP address can be used to trace the physical location of the device and will also have associated with it the name and address of the IP address owner.

The network identifier is forwarded to the nominated person to enable action to be taken to determine the physical address of the device, such as for example contacting an Internet Service provider for resolution of the IP address. An advantage of hosting the theft tracker script on the remote server is that any problems and/or issues with the script can be sorted out at the server end without requiring access to the client.

In addition to monitoring hardware configuration modifications, the monitoring system can further monitor performance parameters of one or more system hardware components. For instance, the first snapshot includes a fan speed in revolutions per minute (rprn). The original fan speed is logged together with the snapshot data on the build sheet such that it can be compared with the fan speed at subsequent points in time. The system may be configured to generate an alert if there is a change in the fan speed, A tolerance level can be set by the warranty provider at say 20% or some other appropriate figure, In this case the alert would indicate that preventative maintenance is required before the fan fails.

It is to be understood that various additions, alterations and/or modifications may be made to the parts previously described without departing from the ambit of the invention.

Appendix 1

- <ORIG!NAL_BUIDSHEET>

- <HEADER>

-<DISKDRIVEJHARDWARE>

-<WIN32_DISKDRIVE devicestatus="or!glnal equipment" guid="IDE\DISKIC2SN020ATCS04-0_CA2OA71A\5&3923B928&0&0.0.0 ">

<DθScription>Di8k drivθ</DθScription>

<DevicelD^\\.\PHYSICALDRIVEO</DθvicelD>

<lntβrfaceType>lDE</lnterfaceType>

<Manufacturer>(Staπdard disk drivθβ)</Manufadurer>

<MediaLoadθd>Truθ</MθdlaLθaded> <MediaTyρe>Flxed hard disk mβdia</MediaType> <Model>b</Model>

«Name>\\.\PHYSICALDRIVE0</Name> <Partitions>4</Partitions> <PNPDeviceID>IDEDISKIC25N020ATCS04- 0_CA20A71A\5&3923B928&o&0.0.0</PNPDeviceID>

<ConfigMaπagerErrorCode>Device is working properly </ConfigManagerErrorCode>

</W!N32_DISKDRIVE> </D!SKDRIVE_HARDWARE>

- <FAN_HARDWARE>

-<WIN32_FAN devicestatus="original equipment" guid-"">

</WlN32_FAN> </FAN_HARDWARE>

-<CDROMDR!VE_HARDWARE>

-<WIN32-CDROMDRIVE devicestatus="original equipment" guid="IDE\CDROMSAMSUNG_CD-ROM_SN124-N100-\5&10429FC6&0&0.0.0">

<Availability>,running/full power</Availability> <BytesPerSector l>

<Caption>SAMSUNG CD-ROM SN-124</Caption>

<Description>CD-ROM Drfve</Description»

<DevicelD>IDE\CDROMSAMSUNG-CD-ROM-SN-124N100_

\5&10429FC6&0&0.0.0</DeviceID> < Index />

<Jnsta)IDate /> ^lnterfaceType /> <Manufacturer>(Standard CD-ROM drives)</Manufacturer>

<MediaLoaded> False</MediaLoaded>

<Model /> <Name>SAMSUNG CD-ROM SN-124</Name>

^Partitions />

<PNPDevicelD>IDE\CDROMSAMSUNG-C D-ROM_SN-

124_N100_\5&10429FC6&0&0.0.0</PNPDevιcelD>

<Tota!Cylinders /> <ConfigManagerErrorCode>Device is working properly. </ConfigManagerE rrorCode>

<PowerManagemeπtCapabilities>Unknowri</PowerMaπagemeπtCapabilities>

</WIN32.. CDROMDRIVE>

</CDROM DRIVE.. HAR DWAR E > - <FLOPPYDRIVE_HARDWARE>

• <WIN32_FLOPPYDRIVE devicestatus="original equipment" guid= "FDC\GENERIC-FLOPPY_DRIVE\5&3371E7B8&0&0">

^Availability>, running/full power</Availabi!ity>

<Caρtion>Floppy disk drive</Caption> <Descriρtion>b</Descrlptlon>

<DevicelD>FDC\GENERIC-FLOPPY_DRIVE\5&3371E7B8&0&0</DevicelD>

<lπstallDa(:e />

<Manufacturer>(Standard floppy disk drivβs)</Manufacturer>

^Name>Floppy disk drive</Name> <PNPDevicelD>FDC\GENERIC_äFLOPPY_DRIVE\5&3371E7B8&0&0</PNPDevι celD> <PowerManagementCaρabilities>Unknown</PowerManagementCapabilities> <PowerManagernentSupported /> <Statu$>OK<:/Status> <Statuslnfo />

<ConfigManagerErrorCodθ>Dθvlcβ is working properly.</ConfigManagerErrorCode> </WIN 32_FLOPPYDRIVE> </FlQPPYDRIVE_HARD WARE>

- <KEYBOARD JHARDWARE> «WIN32_KEYBQARD devicestatua="original equipment" guid="ACPI\PNP0303\0">

<Caption>Enhancβd (101- or 102-key)</Caption>

<Description>Standard 101/102-Køy or Microsoft Natural PS/2

Keyboa rd </Descriptio n> <DevicelD>ACPI\PNP0303\0</DevicelD>

<lπstaliDate l>

<Name>Enhanced (101- or 102-kβy</Name>

<PNPDθvicelD>ACPI\PNP0303\0</PNPDβvicelD>

<PoworManagementCapabilities>Unknown-</PowerManagementCapabilltles> <PowerMaπagemθntSupported>Falβθ</PowerManagemβntSupported>

<Statυslnfo />

<ConfigManagerErrorCode>Devlce is working properly.</ConfigManagerErrorCode> </WIN32J<EYBOARD>

</KEYBOARD_HARDWARE>

- <BASEBOARD_^HARDWARE>

- <WIN32_BASEBOARD devicestatus^s'Original equipment" guid^a""> <Caption>Basβ Board</Caption> <DθScription>Bas© Board</De3cription> <HotSwappable /> <lnstallDatθ /> <Manufacturer>KAPOK</Manufacturer> .

<.Model />

<Name>Baae Board</Name>

<SerialNumber>12345678</SerialNumber> <Status /> <Tag> Base Board</Tag>

<ConfigManager ErrorCode>Device is working properly, <^:/ConfιgManagerErrorCode>

<PowerManagementCapabilities>Unknown<:/PowerManagementCapabilities> <ΛΛ/IN32..BASEBOARD>

</BASE8OARD._.HARDWARE>

- <PROCESSOR_HARDWARE>

- <WlN32- PROCE SSOR devicestatus="original equipment" guid="x86 Family 6 Model 11 Stepping 1 "> <AddressWidth>32</AddressWidth>

<Availability>,running/full power</Av ailability>

<Caption>x86 Family 6 Model 11 Stepping 1</Caption>

<Descriρtion>x86 Family 6 Model 11 Stepping 1 </Description>

<Manufacturer>Genuinelntel</Manufacturer> ^MaxClockSpeed>1096</MaxClookSpeed>

<Name>lntel(R) Celeron(TM) CPU 1100MHz</Name>

<OtherFami!yDescriptιon />

^PowerManagementCapabilities>Unknown</PowerManagementCapabilities> <PowerManagementSupported>False</PowerManagerneftSUρported>

< ProcessorType>3</ProcessorType> <Revisioπ>2817</Revision>

<Version>Model 11 , Stepping 1<Λ/eιsion>

<ΛΛ/IN32_PROCESSOR>

</PROCE SSOR. HARDWARE> - <MEMORYDEVICE_,HARDWARE>

■ <WIN32- MEMORYDEVICE devlcestatus="orlginal equipment" guid-"">

<ConfigManagerErrorCode>Unknσwn</ConfigManagerErrorCode>

</WIN32_MEMORYDEVICE>

-•/MEMORYDEVICE_ HARD WARE> - <PHYSICALMEMORY_HARDWARE>

- <WIN32 .PHYSICALMEMORY devicestatus="original equipment" guid="">

<BankLabel>Banks 0/1</BankLabel> <Capacity>1,069,547,520</Capacity> <Caption>Physical Memory </Captιon> <DataWidth>64</DataWidth> <Description>PhysicaI Memory</Description>. <DeviceLocator>DRAM Slot 0</DevιceL ocator> <FormFactor>DlMM</Form Factor> <HotSwappable l> <lnstallDate />

<(nterleavePosltion>DIMM</lnterleavePosition> Manufacturer />

< MemoryType>DRAM</MemoryType> <Mode) l>

<Name>Physical Me mory</Name> <Otheridenlifyinginfo l> <PartNumber /> <Positionin Row />

< Powered On /* <Reρlaceable /> <SerialNumber /> <Speed />

<7ag>b</Tag> <TypeDetail>EDO</TypeDetatl>

<Version /> <ConfigManagerErrorCode>Device is working properly. </ConfigManagerErrorCode>

</W!N32._PHYS!CALMEMORY>

- <WIN32_PHYSICALMEMORY devicestatυs="original equipment" guid="">

<Caption>Physical Memory</Caption> <DataWidth>64</DataWidth> <Description>Physical Memory</Descnption>

<DeviceLocator>Vidβo Memory</DeviceLocator> <

FormFactor>TSOP</Form Factor*

<1nterleavePositioπ>TSOP</lnterleavePosition>

Manufacturer />

<Model /> <Name>Phyβlcal Memory</Name>

<Otherldeπtifyinglnfo />

<PartNumbβr />

<Tag>Physical Memory 3</Tag> <TypeDetatl>Uπknown</TypeDetail>

<ConfigManagerErrorCode>Dβvicθ is working properly.</ConfigManagerErrorCodθ>

</WIN 32_^PHYSICALMEMORY> - <WIN32_PHYSICALMEMORY devicestatus="origlnal equipment" guid="">

<Caρtion>Physlcal Mβmory</Caption>

<DataWidth>64</DataWidth> <Dβscriptiαn>Physlcal Memory</De$cription>

<DeviCθLocator>Cachθ SRAWI</DeviceLocator> < FormFactor>TSOP</ FormFactor> <HotSwappablθ />

<lntθrl_θavePositioπ>TSOP</lnterleavePosition>

^Manufacturer /> <MemoryType>SRAM </MemoryType>

<Name>Physical

< Powered On l> <Rβp!aceable /> <SθrialNumber /> <Speed /> <Status />

<Tag>Physlcal Memory 4</Tag

^•s^;TypeDetail>Unknown</TypeDθtail>

<:Version l>

<ConfιgManagerErrorCode>Dθvic© is working properly.</ConfigManagθrErrorCode>

</WlN 32_PHYSICALMEMORY>

- <WIN32_ PHYSICAUMEMORY devicestatυ&="orlginal θqυipmont" guid="">

< Capacity >2,097,152</Capacity > <Caption^;>Physical Mβmory</Caption>

<Description>Physlcal Mβmory</Description>

<DeviceLocator>Flash BIOS U43</DeviceLocator>

< MemoryType>EEPROM</MemoryType>

<Name>Physical Memory</Name> <Otherldentifyinglnfo />

<Tag>Physical Memory 5</Tag>

<TypeDetail>Unknown</TypeDetail> <Version />

<ConfigManagerErrorCode>Device is working properly,</ConfigManagerErrorCode>

</WIN32_PHYSICALMEMORY>

</PHYSICALMEMORY_HARDWARE> - <POINTINGDEVICE_HARDWARE>

- <W1N32--PO!NTINGDEVICE devicestatus="original equipment" guid="ACPI\PNPOF13\4&15D87081 &0">

<Caption>PS/2 Compatible Moυse</Caption> <Description>PS/2 Compatible Moυse<^;/Description>

<:Devicelnterface>PS/2</Devicelnterface>

<Handedness>Right Handed Opβration^/Handedπess*

<HardwareType>PS/2 Compatible Mouse<^;/HardwareType> <lnstallDate />

<Manυfacturer>Microsoft</Manufacturer> <Name>PS/2 Compatible Mouse</Name> <PNPDevicelD>ACPI\PNP0F13\4&15D87081&0</PNPDevιceiD>

<PointingType>Uπkπown</PointingType>

<PowerManagemθntCapabilitiθ8>Unknown</PowerMaπagementCapabilities>

<PowerManagementSupportθd >Falsθ</PowerMaπagementSupported> 5 <Status>OK</Status>

<Statuslπfo />

<^;ConfigManagerErrorCode>DθVlcθ is working properly. </Conf!gManagerErrorCode>

</WIN32_POINTINGDEVICE> I O </POINT!NGDEVICE_HARDWARE>

- <NETWORKADAPTER_HARDWARE>

«<WIN32_NETWORKADAPTER devicestatus="origlnal equipment" guid="PCI\VEN_1 O3θ&DEV_O9OO&SUBSYS-22O21558&REV_82\3&13COBO

C5&0&09"> 15 <AdapterType>Etherπet 802,3</AdapterType>

<Availability>,runπiπg/fυll powβr</Availability>

<Caption>[00000001] SiS 900 PCI Fast Ethernet Adapter</Caption>

<Description>SiS 900 PCI Fast Ethernet Adapter</Description>

<lπstallDate />

<Maπufacturer>SiS</Manufacturβr>

<Name>SiS 900 PCI Fast Ethernet Adapt©r</Name> 5 <PN PDevicelD>PCl\VEN_1039&DEV_0900&SUBSYS_^220215S8&REV.82\3

&13COBOC5&0&09</PN PDevicelD>

<PowθrManagementSupported>Fal»θ</PowerManagementSυpportθd>

<Spθθd />

<ConfigManagerErrorCodθ>Dθvicθ Is working properly ./ConfigMaπagerErrorCode* «/WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus-"original equipment" guid="[00000002] RAS Async Adapter">

<Availability>, running/full power</Avai!ability> <Caption>[00000002] RAS Async Adaρter</Caption>

<Description>RAS Async Adapters/Description

<Name>RAS Async Adapter</Name>

<PowerManagementSupported>False</PowerManagementSupported> <Speed />

<ConfigManagerErrorCode>running/full power</ConfigManagerErrorCode>

</WIN32_NETWORKADAPTER> - <WIN32_.NETWORKADAPTER devicestatus="original equipment" guid-"ROOT\MS_PSCHEDIVIP\0000">

<Availability>, running/full power</Availability>

<Caption>[00000003] Packet Scheduler Miniport</Caption>

<Description>Packet Scheduler Miniport</Description> <DevicelD>3</DevicelD>

<Manufacturer>Microsoft</Manufacturer> <Name>Packet Scheduler Miniport</Name>

<PNPDevicelD>ROOT\MS-PSCHEDMP\0000</PNPDevicelD>

<PowerManagementSupported>False</PowerManagementSupported> <Speed /> <Status /> <Statuslnfo />

<ConfigManagerΕrrorCode>Device is working properly. </ConfigManagerErrorCode> </WlN32. NETWORKADAPTER>

- <WIN32. NETWORKADAPTER devicestatus="original equipment" guid ="ROOT\M S_L2TPMINIPORT\0000" >

<Availability>, running/full power</Availability> <:Caρtion>[00000004] WAN Miniport (L2TP)</Caption>

^Description>WAN Miniport (L2TP)</Descriρtion>

< Manufacturer>Microsoft</Manufacturer> <Name>WAN Miniport (L2TP)</Name>

<PNPDevicelD>ROOT\MS_L2TPM INIPORT\0000</PNPDevicelD> <PowerManagememt Supported>False</PowerManagementSupported> <Sρeed />

<;ConfigMa nagerErrorCode>Device is working properly. -'/ConfigManagerErrorCode-> </WIN32 NETWORKADAPTER>

- <WIN32 NETWORKADAPTER devicestatus="original equipment" guid ="ROOT\MS-PPTPMINIPOR\0000" > <Availabιlity>,running/full power</Availability> <Caption>[00000005] WAN Miniport (PPTP)</Caption> <Description> WAN Miniport (PPTP)<\Description>

< DevicelD >5</DevicelD > <Iπdex>b< /lndex > <!nstallDate />

<Manufacturer>Microsoft<yManufacturer>

<Name>WAN Mlnlport (PPTP)</Name> <PNPDevicelD>ROOT\MS_PPTPMINIPORT\0000</PNPDevicelD>

<PowerManagementSupported>Falsβ</PowerManagementSupported>

<Speβd />

<Statuslπfo /> <ConfigMaπagerErrorCodθ^;>Dθvlcθ Is working propβr(y.</ConfigMaπagerErrorCodβ>

<ΛΛ/IN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="ori0inal equipment" guid="ROOT\MSJ*PPOEMINIPORT\0000"> <Availability>, running/full powβr</Availability>

<Caption>[00000006] WAN Minlport (PPPOE)</Captioπ>

^Description>WAN Minfport (PPPOE) </Description>

<Maπufacturer>Microsoft</Manufacturer>

<Name>WAN Miniport (PPPOE)</Name>

<PNPDevicelD>ROOTλMS_^PPPOEMINIPORT\0000</PNPDevicelD> <PowerManagementSupported>False</Pow©rManagem©ntSupported>

<Statuslπfo />

<ConfigManagerErrorCodθ>Dβvice is working propθrly.</CoπfigManagerErrorCodθ>

</WIN32J\JETWORKADAPTER>

^■ <WIN32_NETWORKAOAPTER devicestatus-'Orlglnal equipment" guid="ROOT\MS_PTIMINIPORT\0000">

<Availability>,running/full ρower</Availability>

<Caption> [00000007] Direct Parallel</Caption>

<Description>Dlrect Parallθl</Description> <DevicelD>7</DevicelD>

<Manufacturer>Mlcrosoft</Manufacturer> <Name>Direct Parallθl</Name>

<PNPDevicelD>ROOT \MS_PTIMINIPORT\0000</PNPDevicelD>

<PowerManagemβntSupported>False</PowerManagementSupportθd>

<ConfigMaπagθrErrorCode>DθviCθ is working properly.</ConfigManagerErrorCode>

</WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="original equipment" guid ="ROOT\MS_NDISWANIP\0000">

<Availability>,running/full power</Availability>

<Caption>[00000008] WAN Miniport (IP)</Caption>

<Dθscriρtion>WAN Wljniport {IPH/Description>

<Manufacturer>Mfcro3oft</Mar>ufacturer>

<Name>WAN Miniport (IP)</Name> <PNPDevicelD>ROOT\MS_^NDISWANIP\0000</PNPDβvicθlD>

<PowerManagementSupported>Falee</PowerManagementSupported> <Speed /> <Status /> <Statuslnfo />

<ConfigManagerErrorCode>Device is working properly,/ConfigManagerErrorCode> </WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="original equipment" guid="ROOT\MS_PSCHEDMP\0001"> <Availability>, running/full power</Availability> <Caption>[00000009] Packet Scheduler Miniport</Caption> <Description>Packet Scheduler Miniport</Description> <DevicelD>9</DevicelD> <lndex>9</lndex> <lnstallDate />

<MACAddress>42: BO: 20:52:41 :63 </MACAddress> <Manufactυrer>Microsoft</Manυfacturer>

<Name>Packet Scheduler Miniport</Name> <PNPDevlcelD>ROOT\MS_PSCHEDMP\000K/PNPDeviceID> <PowerManagementSupported>False</PowerManagementSupported> <Speed /> <Status />

<ConfigManagerErrorCode>Device is working properly.</ConfigManagerErrorCode> <ΛΛ/IN32_NETWORKADAPTER> - <WIN32_NETWORKADAPTER devicestatus="original equipment" guid="[00000010] NETGEAR MA101 USB Adapter"> <Availability>, running/full power</Availability> <Caption>[00000010] NETGEAR MA101 USB Adapter</Caption> <Description>NETGEAR MA101 USB Adapter</Description> <DevicelD>10</DevicelD> «lndex>10</lndex> <lnstallDate /> <MACAddress /> Manufacturer /> <Name>NETGEAR MA101 USB Adapter</Name>

<PNPDevicelD /> <PowerManagementSupported>False</PowerManagementSupported>

< StatusI nf o />

<CoπfigManagerErrorCode>running/full power</ConfigManagerErrorCode> <ΛΛ/!N32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="original eqυipment guid="ROOT\MS_PSCHEDMP\0002'>

<Availability>,rυnning/full power</Availabi!ity>

<Caption>[00000011] Packet Scheduler Mlniport</Caption> <Description>Packet Scheduler Miniport</Description>

<!nstalIDate />

< MACAdd ress>00;90: F5:10:18:CF</MACAdd ress> <Manufacturer>Microsoft</Manufacturer>

<Name>Packet Scheduler Miniport</Narπe>

<PNPDeviceID>ROOT\MS- PSCHEDMP\0002</PNPDevicelD>

<PσwerManagementSupported>False</PowerManagemeπtSυpported>

<ConfigManagerErrorCode>Devlce is working properly.</ConfigManagerErrorCσde>

</WIN32_NETWORKADAPTER> - <WIN32_NETWORKADAPTER devicestatus="original equipment" guid="(00000012] Microsoft TV/Video Connection">

<Availability> .running/full power</Availability> <Captioπ>[00000012] Microsoft TV/Video Connection</Caption> <Description>Microsoft TV/Video Connection</Description> <DevicelD>12</DevicejD> <lndex>12</lndex> <InstallDate /> <MACAddress l> <Manufacturer !>

<Name>Microsoft TV/Video Connection</Name> <PNPDevicelD /> <PowerManagementSupported>False</PowerManagementSupported> <Speed /> <Status /> <Statuslnfo /> <ConfigManagerErrorCode>running/full power</ConfigManagerErrorCode> </WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="original equipment" guid="[00000013] SMC EZ Connect USB/Ethernet Series Converter">

<Availability>,running/fυll power</Availability>

<Caption>[00000013] SMC EZ Connect USB/Ethernet Series Converter</^rCaption>

<Description>SM C EZ Connect USB/Ethernet Series Converter</Description>

<lnstallDate /> «MACAddress />

<Name>SMC EZ Connect USB/Ethernet Series Coπverter</Name>

<PowerManagementSupported>False</PowerManagementSupported> <Speed />

< Status Info /> <ConfigManagerErrorCode>running/full power</ConfigManagerErrorCode>

</WIN32. NETWORKADAPTER>

■ <WIN32_.NETWORKADAPTER devicestatυs=" original equipment" guid="RO OT\MS-PSCHEDMP\0003"> <Availability>, running/full power</Availability>

<Caption>[00000014] Packet Scheduler Miniport</Caption>

^Descriptions-Packet Scheduler Miniport</Description>

<:Maπufacturer>Microsoft</Manufacturer>

<Name>Packet Scheduler Miniport</Name>

<PNPDevicelD>ROOT\MS-PSCHEDMP\0003</PNPDevlcelD> <PowerManagementSupported>False</PowerManagementSupported>

<ConfιgManagerErrorCode>Device is working properly,</ConfigManagerErrorCode>

</W IN32_ NETWORKADAPTER>

- <WIN32_.NETWORKADAPTER devicestatυs="original equipment" guid="USB\VID_0707&PID_0200\0001">

<Availabιlity>,running/full power</Availabitity> <Caption>[00000015] SWlC EZ Connect USB/Ethernet Series

Converter</Captioπ^:'

<Description>SMC EZ Connect USB/Ethernet Series Converters/Description >

<Manufacturer>SMC'-/Manufacturer> <Name >SMC EZ Connect USB/Ethernet Series Converter</Name>

<PowerManagementSupporteci>Falsβ</PowerMaπagernentSυpported>

<ConfigManagerErrorCode>Devlce is working properly.</ConfigMa nagerErrorCode>

</WIN32_NETWORKADAPTER> - <WIN32_NETWORKADAPTER devicestatus«"orlginal equipment" guid=ROOT\MS.PSCHEDMP\0004">

<Availability >, running/full power</Availability>

<Captioπ>[00000016] Packet Scheduler Miniport</Caption>

<Description>Packet Scheduler Miniport</Descriptioπ> <DevicelD>16</DevicelD>

<Manufacturer>Microsoft</Manufacturer> . <Name>Packe1 Scheduler Miniport</Name>

<PNPDevicelD>ROOT\MS-.PSCHEDMP\0004</PNPDevicelD>

<PowerManagementSupported>False</PowerManagementSupported>

^Speed />

<ConfigManagerErrorCode>Device Is working properly,</Config Ma nagerErτorCode>

</WIN32_NETWORKADAPTER>

- <W1N32_NETWORKADAPTER devicestatus="original equipment" guid="[00000017] SMC EZ Connect USB/Ethernet Series Converter'^

<Availability>,running/full powør</Avai!abi!ity> <Caption>l00000017] SMC EZ Connect USB/Ethernet Series Converter</Caption>

<Descriρtion;>SMC EZ Connect USB/Ethernet Series Converter</Description>

<Maπufacturβr />

<Name>SMC EZ Connect USB/Ethernet Series Converter</Name>

<PNPDevicelD /> <PowθrManagementSupported>Falsθ</PowerManagθmβntSupported>

<ConfigManagerErrσrCode>running/full power</ConfigManagerErrorCode> </WIN32_NETWDRKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="origlnal equipment" gυtd="ROOT\MS_PSCHEDMP\0005">

<Availability>, running/full power</Availability>

<Caption>[00000018] Packet Scheduler Miniρort</Caption> <Description>Packθt Scheduler Minlport</Deecription>

<MACAddress /> <Manufacturer>Microsoft</Maπufacturer>

<Namθ>Packet Scheduler Mllniport</Name>

<PNPDθvicθlD>ROOT\MS_PSCHEDMP\0005</PNPDevicelD>

<Status!nfo /> <ConfιgManagΘrErrorCodθ>Device is working properly./ConfigManagerErrorCode> </WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER deviceStatus-"Original equipment" guid ="[00000019] SMC EZ Connect USB/Ethernet Series Converter'> <Availability>, running/full power<:/Availability>

<Caρtion>[00000019] SMC EZ Connect USB/Ethernet Series

Converter</Caption>

<Description>SMC EZ Connect USB/Ethernet Series Converter</Description>

<lnsta!IDate l>

Manufacturer />

<Name>SMC EZ Connect USB/Ethernet Series Converter</Name> <PNPDevicelD />

<PowerManagementSupported>False</PowerManagementSupported>

<Statuslnfo /> <ConfigManagerErrorCode>running/full power</ConfigManagerErrorCode>

</WIN 32-NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatuss"Origlnal equipment" guid="ROOT\MS-PSCHEDMP\0006"> <Availability>,runnlng/full power</Availability> -ϊCaptiσn>[00000020] Packet Scheduler Miniport</Caption>

<Description>Packet Scheduler Miniport</Description>

< M\anufacturer>Mlcrosoft</Manufacturer> <Name >Packet Scheduler Miniport</Name> <PNPDevicelD>ROOT\MS-PSCHEDMP\0006</PNPDevicelD>

<PowerManagementSupported>False</PowerManagementSupported>

<Statυs /> <Statuslnfo />

<ConfigManagerErrorCode>Device Is working properly.</Config Ma nagerErrorCode>

</WIN32_NETWORKADAPTER>

■ <WIN32_NETWORKADAPTER devicestatus="original equipment" guid="[00000021 ] SMC EZ Connect USB/Ethernet Series Converter">

<Availability>, running/full power</Availability>

«Caption>[00000021] SMC EZ Connect USB/Ethernet Series

Converter</Caption>

<Description>SMC EZ connect USB/Ethernet Series Converted/Description> <DeviceID>21</DevicelD>

Manufacturer /> <Name>SMC EZ Connect USB/Ethernet Series Converter</Name>

<PowerManagementSupported>False</PowerManagementSupported>

<Sρeed />

<ConfigMaπagerErrorCode>running/full power</ConfigManagerErrorCode>

</WIN32_NETWORKADAPTER>

- <WIN32_NETWORKADAPTER devicestatus="original equipment" guid=" ROOT\MS_PSCHEDMP\0007"> <Availability>,running/full power</Availability>

<Caption>[00000022) Packet Scheduler Miniport</Caption> <Descriρtion>Packet Scheduler Miniport</Description> <DeviceID>22</DevicelD>

<MACAddress /> <Manufacturer>Microsoft</Manufacturer>

<Name>Packet Scheduler Minlport</Name>

< PNPDevicelD>ROOT\MS_PSCHEDMP\0007</PNPDevicelD>

<PowerManagementSupported>False</PowerManagementSupported>

<Speed /> ^Status l>

<ConfigManagerErrorCode>Device is working properly. </Config Ma nagerErrorCode>

</WIN32_NETWORKADAPTER> </NETWORKADAPTER_HARDWARE>

- <VI DEOCONTROLLE R_HARDWARE>

- <WIN32_VIDEOCONTROLLER devicestatus="original equipment" guid="PCI\VEN_1039&DEV_6300&SUB8YS-22021558&REV-31 \4&DA4DF0 &0&0010"> <Availability>,runnlng/fυll power</Availability>

<DevicelD>VideoController1 < /DevicelD>

<PNPDevicelD>PCI\VEN_1039&DEV_6300&SUBSYS-2202i568&REV_31\4

&DA4DF0&0&0010</PNPDevicelD>

<PowerManagementCapabilities>Unknownn/PowerManagementCapabilities>

<ConfigManagerErrorCode>Devlce is working properly. </ConfigManagerErrorCode>

</WIN32_VIDEOCONTROLLER>

<Λ/IDEOCONTROLLER_HARDWARE>

- <DESKTOPMONITOR_HARDWARE> - <WIN32_DESKTOPMONITOR devicestatus="original equipment" quid="DISPLAY\DEFAULT-MONITOR\5&CC3080B&0&10000001&01&00">

<Availability>, running/full power</Availability>

<Caρtion>Default Monitor</Caption>

<Description>Default Monitor</Description > <DevicelD>DesktopMonitor1</DevicelD>

<!nstallDate l>

< Nam e>Default Monitor</Nam e>

<PNPDevicelD>DISPLAY\DEFAULT_MONITOR\5&CC3080B&0&10000001&0

1&00</PNPDevicelD> <PowerManagemenlCapabilities>Unknown</PowerManagementCapabilities>

<ConfigManagerErrorCode>Device Is working properly. </ConfigManagerErrorCode>

</WIN32 _DESKTOPMONITOR>

</DESKTOPM0NIT0R_HARDWARE>

- <POTSMODEM_HARDWARE>

- <WIN32_POTSMODEM devicestatυs="origina! equipment" guid=" PCI\VEN1039&,DEV_7013&SUBSYS-22021558&REV_A0\3&13COB0

C5&0&0E">

<Avai!ability>,</Availability>

<Caption>HAMR5600 Modem</Caption>

<ConfigManagerErrorCode>Device is working properly,</ConfigManagerErrorCode>

< DevicelD>PCI\VEN 1039&<DEV_7013&SU BSYS_22021558&REV_A0\3&13 C0B0C5&0&0E</DevicelD> <lndex>0</lndex> <lnstallDate />

<Model >HAMR5600 Modem</Model» <Name>HAMR5600 Modem</Name>

<PNPDevicelD>PCI\VEN_1039&DEV_7O13&SUBSYS_22θ21558&REV_A0\3

&13C0B0CS&Q&QE</PNPDevicelD>

<PowerManagementCapabilities>Unknown</PowerManagementCapabilities> <PowerManagementSupported>False</PowerManagementSupported> <Status>OK</Statυs>

<Statuslnfo>3-^::/Statusinfo> </WIN32_POTSMODEM> </POTS MODEM_HARDWARE> </ORIGINAL_BUILDSHEET>

Appendix 2

<%@LANGUAGE="VBSCRIPT" CODEPAGE-"1252"%> <%

'Script Purpose: Log MAC / IP address of STOLEN PC Into Guardian Database

cst - "Provider=Microsoft.Jet.OLEDB.4.0;Data Source*" cst = cst & Server,MaρPath("../Data/Guardian.mdb") set conn = CreateObject(ADODB. Connection") conn. mode = 3 ' adModeReadWrite conn. open cst

Dim RSPID MMColPararn RSPIDJ/IMColParam = "1"

If (REQUEST.QueryString("ρid")<> "") Then

RSPIDJ/IMColParam = REQUESTQueryStringfpld") else RSPID.MMColParam - REQUEST,form("pid")

End If

Dim RSPID

Dim RSPID_numRows

Set RSPID = Server.CreateObjectC'ADODB.RθCordset") RSPID.ActiveConnection = conn

RSPID.Source = "SELECT * FROM AntitheftJPTracker"

RSPID.CursorType = 2

RSPID, CursorLocation = 2

RSPID. LockType a 2 RSPID.OpenO

RSPID_numRows = 0 %>

<html> <head> <title>Guardian Anti-Theft Tracking Scriρt«/title> <% dim strDatβ dim δtrTimθ

¹ Set the date / time of the client activity, strDate=date strTimθ=tfme if RSPID_MMCo!Param <> "" then Track our Client by requesting server variables from the Web Server RSPID.Addnew RSPID("Date")=εtrDate RSPID(^!Time")=strTime

RSPID(" CLI ENT_PID") = req uest.form ("pld") RSPID("REMOTE_IP")=request.ServerVariables("REMOTE_ADDR") RSPID("REMOTE_MAC") = req uest.form <"remote_mac") RSPID("DENIED_REQUEST" )=request.form("denied_request") RSPID("DENIED_REASON")=request.form("denied_reason")

RSPID.UPDATE

^' By setting a third command 'DEACTIVATE'.

' We can remotely deactivate the stolen software here if required.

^' This command is currently UNUSED but can be implemented at any time.

IF RSPID.EOF<>TRUE THEN

REGSTATUS="LOGGED" ELSE

REGSTATUS=ΕRROR" END IF %>

</head>

<body> <% response.write("?REGSTATUS="& REGSTATUS &"")

%>

</body> </html> <% RSPID.CIoseO conn.closθ()

Set RSPID = Nothing set coπn=nothing

%>

Claims

1 , A method for tracking modifications to a hardware configuration of a computer system for tracking changes in one or more hardware configuration parameters in a computer system, the method including the following steps:

(B) storing the first snapshot in a remote database;

(D) comparing the stored first snapshot and the second snapshot;

wherein any difference between the first and second snapshots indicates that a change has been made to the hardware configuration of the computer system.

2. A method according to claim I, further including the step oi generating an alert to notify a nominated person that a modification has been made to the hardware configuration,

3. A method according to claim 1 or 2, wherein the first point in time occurs when a program which performs the steps of the method is installed in the computer system and the second point in time occurs each t/rne the computer system is turned on or restarted subsequent to the program being installed on the computer system.

4. A method aocording to any one of the preceding claims, wherein the hardware configuration includes one or more of the following: (A) disc drive type;

(B) central processing unit (CPU) type;

(C) memory configuration;

(D) peripheral devices.

5, A method of any one of the preceding claims, the method further includes the following steps;

(D) reporting the network identifier to the nominated person;

, A method according to claim 5, wherein the network identifier includes one or more of the following;

(A) an IP address; or

(B) a MAC address. 7. A method according to any one of the preceding claims, further including the step of monitoring a performance parameter of one or more hardware components.

8. A method according to claim 7, further including the step of measuring a performance parameter and comparing the performance parameter to a stored performance parameter included in the first snapshot.

9. A method according to claim 8, wherein a change in the performance parameter causes an alert to be generated to notify the nominated person that a potential problem exists with the hardware component.

10. A method of providing a warranty for a computer system, the method including the following steps:

(A) providing software for tracking changes in one or more hardware configuration parameters in a computer system;

(B) installing the software on the computer system;

(C) capturing a first snapshot of a hardware configuration of the computer system at a first point in time;

(D) storing the first snapshot in a remote database;

(E) capturing a second snapshot of the hardware configuration of the computer system at a second subsequent point in time;

(F) comparing the stored first snapshot and the second snapshot; and (G) generating an alert for transmission to a warranty provider if the comparison reveals any difference between the first and second snapshots;

wherein a difference between the first and second snapshots indicates that a change has been made to the hardware configuration of the computer system and causes the warranty provider to reassess validity of the warranty,

11. A method of tracking a stolen computer system, including the following steps:

(B) installing the software on the computer system;

(C) reporting the computer system as being stolen;

(D) monitoring a network identifier associated with the stolen computer system; and

(F) reporting the network identifier to the nominated person;