hi guys... can anyone recommend a software/tool which detects whether keyoggers are installed on a machine?
Printable View
hi guys... can anyone recommend a software/tool which detects whether keyoggers are installed on a machine?
I would try some of the usual scans... spoybot, adaware, etc. Some AV programs will detect keyloggers. Also try running a hijack this scan and have the results analyzed at hijackthis.de ... be careful when searching google for keylogger removal, not all programs are what they seem... search for reviews or forums talking about any programs you are thinking about downloading. hope this helps.
you can also post it here, http://discussions.virtualdr.com/forumdisplay.php?f=71
As far as scans, I use these two online scans:
http://www.pandasoftware.com/actives...ng=2&IdPais=63
http://www.kaspersky.com/virusscanner
That's a very valid point.Quote:
Originally Posted by westin
Steve
Even the tools meant to find keyloggers do a piss poor job nowadays. Hunting them down has become more of a forensics task rather than an administrative task.
Good luck.
--TH13
Quote:
Originally Posted by thehorse13
Thats encouraging :D ...
Why, because they're hidden from Windows? But even if they are rootkits, they should still be detectable and with a root kit scanner. Even rootkits need to store data somewhere, and that would show up as a discrepancy in a rootkit scan, wouldn't it?
Quote:
Originally Posted by JPnyc
I agree, you might try FSecure's Blacklight. Last I knew it was a free app.
http://www.f-secure.com/blacklight/
I use rootkitrevealer, in addition to Kaspersky's root kit scanner. I run both at least once a week
thanks for all the info guys...
how about UnHack me? my brother in law discovered this one recently and recommended it... anyone tried it before?
I googled 'unhackme forums' and this is one of the posts I came across.
another review said that it disabled the users keyboard, and they had to do a system restore to get it back... I am not sure of these user's level of expertise, but I would stick with some of the free ones that JP or I mentioned.Quote:
UnHackMe 4.5 released on September 11, 2007
And here is the conclusion of my great experience with it:
If you are not going to purchase a license don't even think to install the trial, it will jump in your face every very few seconds asking for registration.
I installed and uninstalled after less than 30 minutes in which registration window jumped in my face more than 30 times
A very ugly way to make sales and I think a rootkit, trojan, or virus is very welcome when compared to that ugly and terroristic registration window
They must change it's name to: " ReHackMe 4.5 times/minute " this is more realistic
So downgrade to version 1 if you need to be hacked only 1 time/minute
I think that version 4.5 is quite enough, please developers no more higher versions
Westin
Try using Icesword, gmer, Helios.
AVG also do an anti-rootkit product:
http://free.grisoft.com/doc/download...otkit/us/frt/0
A-Squared used to be pretty good at detecting keyloggers:
http://www.emsisoft.com/en/software/free/
Here is a site with a wide range of detection and prevention software:
http://www.antirootkit.com/software/index.htm
That *used* to be the case. Next gen keyloggers don't store anything, they merely forward it off. Memory Resident weaponized rootkits are growing fast. Automated tools are 50/50 at best in today's crimeware arena. The good 'ole days of using automated tools to be a security practitioner are over folks.Quote:
...But even if they are rootkits, they should still be detectable and with a root kit scanner. Even rootkits need to store data somewhere, and that would show up as a discrepancy in a rootkit scan, wouldn't it?
--TH13
But suppose you're not connected to the web when you type something? Does that mean this new generation can't store the info to forward when you ARE connected?
The answer is, it depends. If the code is written to grab targeted data, it can sit in memory until a socket is established. Of course there will be limitations on the collected data until there is a connection established.Quote:
Originally Posted by JPnyc
--TH13
Hi TH13,
I am getting a little confused :confused:. Are we talking about RAM here? As far as I know that can be scanned and dumped so detection and elimination are possible? For example, wouldn't a reboot get rid of it?
I have read about other possible malware infections that involve the various memory locations in a box that hold stuff like the BIOS and the low level firmware for peripheral devices. I guess this would include CD/DVD drives and video cards. AFAIK these memory locations can be flashed, so in theory they could be infected.
I am guessing that because those memory locations are not "volatile" the malware could be made to run and load into RAM whenever the host device was started.
I am not aware of any of the commonly used anti-malware tools that scan or lockdown these memory locations?
Thats because i dont believe they exist nihil. I have not run across any program that can lock them down. Or scan them for malware.
Some people, and even some security articles I've read, extol the use of virtual keyboard to thwart key loggers. As we all know, when a key is pressed on the keyboard it sends a keycode identifying which key was pressed. It seems to me it wouldn't matter how that keycode was generated, when it comes to logging. So a virtual keyboard, or even voice recognition software, would still be vulnerable to key loggers, yes?
Virtual keyboards are great, but can you imagine typing one character at a time per mouse click.....brutal! Virtual keyboards should only be used at login prompts.
Can the software listed in this forum detect these funky bad boys?
http://www.keyghost.com/
Errrrr?
No, they are hardware and that is the problem. Now, they can be detected physically, but the latest issue is malware that uses spare memory on components that are normally in a computer' and that is not scanned by "normal" detection software.Quote:
Can the software listed in this forum detect these funky bad boys?
;)
We had some kind of error with wolfman's acct.