Printable View
I am a newbie on this forum, and I have spent some time surfing related topics--but I have a question I haven't seen answered anywhere. Is it possible to determine if someone has illegally loaded a software keylogger on your own machine? I am talking someone who has physical access to a personal laptop and loaded a SpyBuddy or Net Nanny on a personal machine.
Would something like a Spyware Eliminator catch this? Or are they geared more towards adware and net traffic?
Hi Matou,
Welcome to AO! :)
I took your post and put it in it's own thread as it didn't seem to fit in the old thread you had replied to. I've changed the title and put it in a forum where it would be most likely answered.
It is possible to determine if a keylogger has been installed on a system through a variety of methods. The first thing I would do personally is get something like ProcessExplorer from SysInternals to see what processes are running and which ones are suspicious.
sorry this isn irellevant to the thread, but how did you get that MsM....heheh looks cool..Quote:
AO Supreme Being
and oh: I once worked with www.blazingtools.com perfect keylogger, there is an option that you hide from the taskmanager, control panel, systrey icon etc. would those softwware you recommened still catch it. ?
Adware 6 picks up my copy of perfect keylogger.Quote:
Cheers:
what about when someone uses winspy -- they pride themselves in not being able to be detected at all... i still can't find it (if someone knows where the exe hides, please let me know)
Where I am confused is--is there a difference btwn programs that capture spyware you pick up out on the net vs. an application someone physically loads on your machine? Will something like Ad-aware 6.0 catch both kinds of keyloggers?
Hi
Yes AD-Aware Picks Most of the Key-Logger Program i know.......
And Anti-keylogger™ is also a good ..and since it does not work on the principle of Signature verification it can even catch unknown ones.....
it's more towards Spyware Eliminator's but some of the ADware removers too catch them......
--Good Luck--
hmmm Whether someone physically loads a spyware/keylogger or you Get it from the net ....They will pick it up.........I mean a Keyloger is a keylogger ...........No matter what is the mode of installation.................or are you talking about something else..........What i am getting from your post is if say ax.exe is a spyware...........and someone physasilly installs it on your computer.................or if ax.exe gets installed by some malisious web Site( P0rn :D ) ........in both the cases it will be detected........Quote:
Where I am confused is--is there a difference btwn programs that capture spyware you pick up out on the net vs. an application someone physically loads on your machine? Will something like Ad-aware 6.0 catch both kinds of keyloggers?
Well the short answer is, available software (Adware, Search & Destroy & even antivirus software) will detect some of these products. Now if I write my own keylogger, the answer is no. I believe if I use a hardware keylogger, the answer too would be no. There have been quite a few threads started about keyloggers, use the AO search function and have a read through some of them for more information.Quote:
Originally posted here by Matou
Where I am confused is--is there a difference btwn programs that capture spyware you pick up out on the net vs. an application someone physically loads on your machine? Will something like Ad-aware 6.0 catch both kinds of keyloggers?
Cheers:
It has been my personal experience that with some keyloggers...especially those that capture screenshots and key strokes (like Starr Commander Pro), you can just do a search for files created on a particular day (I usually use the current day) and check for large HTML files. Those HTML files have both the keystrokes and screenshots wrapped up in them to be sent to the spyer's email address. It's worked for me everytime with that particular product.
Yes, you can and should DL a trojan / keylogger removal/detector, but this is also just another quick way to check.
Thanks! This is very helpful. I didn't know if there was a difference btwn the two or not. Your explanations have helped very much!
Why not just check the registry.The logger has to boout up somehow doesnt it?And I find a lot of the loggers that claim to have 'untraceable' startups having an entry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run or Runservices or something of the kind,or wini.ini or autoexec.bat...point is,you can make a file untraceable on the start panel,but never truly untraceable.
hmm,just a thought,but what if the logger created a null file on a particular date,and actually began logging sometime after?And some loggers dont create very large file sizes as they're usually picked up by watchful admins,they split them up or mail them after a certain file size.Quote:
Originally posted here by mathgirl32
It has been my personal experience that with some keyloggers...especially those that capture screenshots and key strokes (like Starr Commander Pro), you can just do a search for files created on a particular day (I usually use the current day) and check for large HTML files. Those HTML files have both the keystrokes and screenshots wrapped up in them to be sent to the spyer's email address. It's worked for me everytime with that particular product.
Yes, you can and should DL a trojan / keylogger removal/detector, but this is also just another quick way to check.
It'd be nifty to see a program that monitored file sizes and such every day,easiest way to pick up the logger?It'd mean wasting a lot of time fcourse
Some of the best conversations I've had were with an old programming friend of mine....we'd sit around and try to figure out all the different ways you could send out the information without it being detected....or at the very least without raising suspision.Quote:
Originally posted here by therenegade
And some loggers dont create very large file sizes as they're usually picked up by watchful admins,they split them up or mail them after a certain file size.
It'd be nifty to see a program that monitored file sizes and such every day,easiest way to pick up the logger?It'd mean wasting a lot of time fcourse
and your conclusions were? ;)
Hee hee....how much time do you have??Quote:
Seriously, we got pretty creative. Though most would have been extremely time consuming....there are a lot of possibilities out there. I just have to wait for my skillZ to catch up with my ideas. ;)
off topic/
[I like this forum, I like the reading and the comments.
At first I was going to study study study,
But NOW, I've read of a College PROFESSOR (MsM) who is STILL taking exams.
AND (Because I read the profiles) a Post graduate working in computer science (MG32) who will 'just have to wait for my skillZ to catch up with my ideas.'
Jeez.......... take me outside and shoot me now.
I knew I should have punched my little brother out and stole his Spectrum all those years ago.
Bit late now as the little b*st**d grew into a Royal Marine, before going into IT.] end rant/
Matou
I deliberatly placed a keylogger on my computer a while ago to check to see if either spybot/adaware/TDS3/AVG etc, would be able to detect it. They did, right on the get-go. If you want to try it, family keylogger is the one I used.
I am working up a "C" keylogger and it won't probably be detected as was mentioned earlier.
cheers
[QUOTE] Originally posted here by therenegade
[B]Why not just check the registry.The logger has to boout up somehow doesnt it?And I find a lot of the loggers that claim to have 'untraceable' startups having an entry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run or Runservices or something of the kind,or wini.ini or autoexec.bat...point is,you can make a file untraceable on the start panel,but never truly untraceable.
Hmm..being new at this, what would I look for in the registry? What would indicate something suspicious?
[QUOTE] Originally posted here by therenegade
[B]Why not just check the registry.The logger has to boout up somehow doesnt it?And I find a lot of the loggers that claim to have 'untraceable' startups having an entry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run or Runservices or something of the kind,or wini.ini or autoexec.bat...point is,you can make a file untraceable on the start panel,but never truly untraceable.
Hmm..being new at this, what would I look for in the registry? What would indicate something suspicious?
You'd be looking for a suspicious entry in this entry:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run or this one:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\RunServices
A suspicious entry would be a program you hadn't authorised to run..programs in the Run and Runservices entries start every time your computer boots,and since a logger or any mailicious program for that matter would need to start every time your computer boots,there's sometimes an entry in that.(if you're not sure whether a program running in your registry is legit or not,google around for it...NEVER delete if if you're not sure,playing with the registry can lead to a complete crash).However,programs have been known to use other start up methods too..check the other above posts.
hi
i'm a new here, can someone install spyware online without my knowledge?
2pi :D
Hey 2pie,first..welcome to AO..second,since your question isnt really related to this thread,I suggest you post a new thread.Here's the site FAQ if you feel a bit lost.http://www.antionline.com/misc.php?action=faq
Oh,and the answer to your question is yes.Spyware normally installs itself without your consent,hence the name.