spyware/keyloggers

Hi all, not sure if this is appropriate for this forum or AV forum. I'm still new at this. I looked through some of the postings and threads for spyware and keyloggers but couldn't find the exact stuff that I'm looking for. I hope that I didn't miss anything.

Anyway, my personal bugaboo is that the users in my office work from home sometimes and they aren't adequately protected behind firewalls (we are quickly developing a policy on this). In the meantime, I'm trying to clean up the people's computers who have issues.

I downloaded Spybot, which by most accounts seems to be the best removal tool. But the evaluations that I've read say that even this tool doesn't nail the keyloggers.

Does anyone know of a freeware/shareware program that finds keyloggers. I saw that someone suggested anti-keyloggers.com but that one is too expensive for us.

Thanks for any help that you can offer.

Sorry I don't worry too much about keyloggers but I used google and found some software for you:

http://www.blazingtools.com/spy-software.html (Could be promising.)

http://www.techtv.com/callforhelp/ho...382421,00.html (Information on this topic from TechTV... names a few.)

http://www.techtv.com/screensavers/d...396854,00.html (This is the freeware of the day on The Screen Savers.)

http://www.spydex.com/anti-spy-xp/ (Some commerical software... may be good for you.)

- Do a google and altavista search, I'm sure you'll find something that suits your needs.. if not, check download.com.. they normally have some good quality freeware.

The fact of the matter is, there are so many key loggers on the net that most antivirus/spyware applications can't detect them. So this would answer your question why your software isn't knocking those out.

Scat

Hey check this out . It seems to work pretty good.

I mentioned it for a good reason. It finds them in the freeware version. It however doesn't delete them. If you know it is there you can find other methods of removing it. No real need to buy it unless you really need the automated removal.

rrbar > > It depends on what version of windows you are running but it should have this utility, goto the run command and type MSCONFIG. Then click on the start up tab and uncheck everything in there. That will get rid of just about any key-logger or trojan.

If you do not have MSCONFIG, type REGEDIT at the run command and click on HKEY_local_machine > Software > Microsoft > Windows > CurrentVersion
There are several folders here, goto RUN and delete any/all keys in it, goto RUNONCE and do the same, then goto RUNONCEEX and do the same. This will get rid of just about any trojan and/or key logger

**Reboot your computer after you do either one of these**

If he doesn't have msconfig.exe. He should have sysedit.exe.
Which has yet another start point which you forgot.In the Win.ini file you have

Load=
and
Run=

These two lines are often used by keyloggers. They are also often over looked.

Thanks for all the responses. It wouldn't seem like deleting all the run key items would be the top choice since there are valid programs that start from there, but it could certainly be looked at to determine if there are any nasties starting there.

Sysedit would seem to be a good place to look too.

My company won't pay for the anti-keylogging program. Unfortunately :-(

Jag - I'm curious why you aren't concerned with keyloggers.

Why you ask... I really don't know why I don't. Here's my outlook on it... No one can connect anything to my computer physically (case has a lock) and I clean and change parts in my computer on a daily basis (inside, back) so I'd notice any physical key logger. Then software wise... I keep safe when online.. I run Norton AV, BlackICE, and keep up-to-date w/ my trojans and virii knowledge. I also keep direct access limited too, almost always, I unplug some wires when I leave (monitor, power supply, video card, etc.). I have passwords on everything that is valuable... so I feel secure so I don't really worry that much about it.. :)

= Cheers,
jag291

jag - I won't be able to teach my users those techniques. :(

It's not me who's computer is at risk. But it does put my network at risk. Clearly the thing to do is to get protection for them when they are home. A Linksys router is the simple solution there.

But I'm still looking for the best method to kill any keyloggers that might be on there. I still need to check out the sites that you googled before.

Thanks again

AHH Jaguar the difrence here is that you only have to secure your PC where rrbar has to deal with laptops that travel and that people run from home. when you enter a network enviroment and are incharge of said enviroment you have to asume that the useres (be it 10 or 10,000) know nothing about security and will forget anything you tell them (I had people rutenly turn off their AV program because it wouldn't let them view an email attachment :( ). In a coperate network you do have to worry about compromised systems because users are dumb.

I am thinking the best sugestion for rrbar is to go through what is running at startup (hopefuly you know what programs should be running), but be warned some keyloggers can load as services so they wont show on that list your best bet may be to run a port scan across all at risk systems to see if any are passing data out when they shouldn't be.

Quote:

---

Originally posted here by bballad
AHH Jaguar the difrence here is that you only have to secure your PC where rrbar has to deal with laptops that travel and that people run from home. when you enter a network enviroment and are incharge of said enviroment you have to asume that the useres (be it 10 or 10,000) know nothing about security and will forget anything you tell them (I had people rutenly turn off their AV program because it wouldn't let them view an email attachment :( ). In a coperate network you do have to worry about compromised systems because users are dumb.

I am thinking the best sugestion for rrbar is to go through what is running at startup (hopefuly you know what programs should be running), but be warned some keyloggers can load as services so they wont show on that list your best bet may be to run a port scan across all at risk systems to see if any are passing data out when they shouldn't be.

---

That's why I never plan to work as an administrator... just a simple software engineer. :p

A good question and some good answers, however, to bump-up the paranoia level just a click or two, take a look at this claim. What do you think about it? If you have ten (or a hundred) travelling agents for your company, would not a competitor be sending them all an email with this thing? (they did not say *how* it loads, whether through an attachment or otherwise, but they are confident in their ability to load it beyond the capability of the victim to detect it.).
To Quote Some Of Their Claims, and to give you their website:

'... Monitor any Computer from ANYWHERE In the world .....
SSPPYY offers you the ability to remotely install the software anywhere in the world! Simply send SSPPYY software via email and it will install instantly!.....
SSPPYY offers many levels of stealth to prevent the remote user from removing the software. SSPPYY will NOT be displayed in the task manager, the process tab (under Windows NT/XP/2000),add and remove programs, or anywhere else where it may be possible for the user to detect it!...
SSPPYY uses powerful encryption to ensure that only you have access to the SSPPYY Control Panel from a remote location.... "

http://www.ssppyy.com/

My name is Paul in Cape Town SouthAfrica, my problem is that hackers have been hacking in with trojan horses etc and I want to trace them. Suggstions 4 any good links sites etc
Thanx

Detecting key loggers on all those machines is virtually impossible. Sure some software catches the common ones, but there are 10s of thousands available and there are also hardware based loggers. These are devices that plug in between the keyboard and the motherboard.

You would have to have some idea of what the system snapshot looked like before infection. Then look for changes in both registry and file structure. I know that’s difficult but that is my message, it's hard. No matter what type of key logger is installed, they have one thing in common; they have to log it somewhere. So now you have a hook to look for. A log, a file that outside of your normal program structure that is changing or building in size. If you are lucky the key logger will attempt to contact an outside server, then you can trace it. But most likely that will not be the case. I have been faced with your situation before and would you like to know what I have done?

WIPE IT ALL :D

Hiring some school kids if needed. Get your software and start with the sever. Back it up, wipe it, reinstall. Then do that to all the workstations. Then lock down registry access etc. Use typical “windows security checklist”. And for the laptops, if the CEO/Board does not want to pay for the security to get VPN or Authentication software then DO NOT let the laptops connect to your core network. Works for me. :o

File transfers are done by floppy. A little archaic but safe. If someone has a large file they have to open an IT ticket or email it into the network where I have McAfee watching. You will most likely lose that battle, unless you prepare yourself well in advance with case studies to back you up. And stand stall. I know, it’s not feasible for most business objectives. But…

i think just try and remove them by opening task manager and scanning through the processes .i kno this is tough but just maybe try it

http://www.styopkin.com

"Keylogger Hunter"

I suggest that you look at some of the AV tutorials for secondary protection.

http://www.diamondcs.com.au

RegistryProt

This crap has to live and start from somewhere?

"my company can't afford it"...................can they afford going out of business?

Time to "preach the Gospel" old chap?

Good luck :)