Printable View
I have a suspicion that a keylogger may be installed on the computer that I work on. However, I have heared that keyloggers don't show up in the Task Manager list under running processes.
Is there any way, or anywhere else where I can look, where I may find evidence of a keylogger currently running in the background?
Thank you
If you run XP or 98, try msconfig to see the program that run at start-up.
If you use 2000, check your registry key for suspect program that run at start-up.
Download a tool called security task manager
this will find hidden processes, tell you what it is and what it is for, and allow you to kill it and delete the program.
www.snapfiles.com/get/securitytask.html
Oh sorry, I run XP Pro. And thanks, I'll try stm.
Go to sysinternals.com...
Find the program called filemon, it will give you a realtime view of files being written to. Filter out the noise, you may be able to find a keylogger that is logging to a file. Also, sweep for Malware, try other process utilities that have been mentioned (maybe process explorer from sysinternals.com as well.) Don't forget to check the hardware / plug for anything physically on the wire. Regmon might help as well. Also a sniffer, tcpview, yadda yadda.
Also to add to the possiblities here, you can download Anti Key-Logger from my site.
Sorry but you do have to register before getting access to the downloads. You could also search on the name and find it somewhere that don't require you to register if you don't want to. Even though it is spamming my site, it is in direct response to a post!
If this is frowned upon, then I want do it no more.
CyberSorcerer
Hi Cyber~
Direct answer to direct question..............doesn't look like spam to me :)
OK:
http://digilander.libero.it/zancart/winsonar/
WinSonar...............it is free and monitors for programs starting in the background. You need to watch it, as it will block all sorts of stuff until you tell it that it is a good guy (works a bit like firewall rules there)
Do you think that this is a remote attack or a local one?
Cheers
Thanks, I installed some of those programs like Filemon and Security Task Manager, and from what I could gather, there doesn't seem to be a key-logger running in the background.
Cyber, when I do search and type Anti key-logger I still get a message that I need to register first. Maybe I'll do that then, since there's no way round it I guess.
Try KL-Detector: http://www.dewasoft.com/privacy/kldetector.htm
If you are at work or dealing with some one that knows about security they might be keeping close tabs on your network activity. If at my work place I had enough suspison about a person and needed to put a key logger on their computer then I would also keep tabs on their network activity to see if they go to download sites or fourm that would aid them on de-activating the key logger. If it were I and I had a suspicion I would use Knoppix or any other linux boot cd to get the registery or the config files then do an exaimination on another computer not the one that i suspected had a key logger installed.
Just curious as to why we are enabling Kezman.
Quote:
Kezman: I have a suspicion that a keylogger may be installed on the computer that I work on. However, I have heared that keyloggers don't show up in the Task Manager list under running processes.
Is there any way, or anywhere else where I can look, where I may find evidence of a keylogger currently running in the background?
From the suicidal thread:
http://www.antionline.com/showthread...hreadid=263826
Quote:
Kezman: I'm trying to copy the SAM and system files from a machine. However, this machine doesn't boot from bootable CD's, nor from floppy disks. Is there any other way? The computer runs under Win 2000 server I believe.
Quote:
Kezman: I completely forgot to mention that the BIOS has a password, and I don't know it. So I can't make any changes to the setting.
So even though the computer doesn't boot from CD, I can use an XP Pro disk for instance, to copy the required files? Iv'e also heard something bout a emergency rescue disk or something, does Win 2000 server/advanced server have one of those?
Relyt, I noticed this when he first posted, but decided to take a more proactive approach to the matter of skiddies attempting to get around their work/school networks.Quote:
I figure that if they get help with their ~preceived~ problems then they will implement the ~cures~ and get themselves fired and blacklisted from computer jobs at the very least, and at the worst get to meet Bubba.
At least, that will save us from listnening to their whining and bi^&*%ing in the future, and perhaps provide some of our newer admin types with the knowledge of what some employees will attempt.
Moxnix,Quote:
and get themselves fired and blacklisted from computer jobs at the very least, and at the worst get to meet Bubba.
What simply amazes me, is that it appears they believe no one is on to them yet. Additionally, most of their admins probably frequent this site. :eek:
I guess we can always make the introductions for them at the county condo.
"Bubba this is Skiddie, Skiddie is your new roommate"
:D
cheers