Advanced Anti Keylogger

Discussion in 'Trojan Defence Suite' started by rerun2, Nov 28, 2003.

Thread Status:
Not open for further replies.
  1. rerun2

    rerun2 Registered Member

    Joined:
    Aug 27, 2003
    Posts:
    338
    I recently did a full system scan with TDS and a program called Advanced Anti-Keylogger has been identified as a possible keylogger. I have not installed this program but keep it archived. Ive actually had this file archived for quite a long time but never noticed this alert previously. Since I have never used or really cared to use AAK, I am planning to delete the archive anyways ;)

    This is the alert that TDS gave.

    Alarm: Positive identification <Adv> (in archive)

    Name: Possible Keylogger

    File: setup.exe

    I think this is the site of the file http://www.anti-keylogger.net/advanced_anti_keylogger.html

    The free download is what I have archived.
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi rerun2
    New signatures are added each day, so there might be code in the program similair to one of suspicious kind which was recently added. Please be so kind as to get that exe out of the zip, zip it and submit to DCS submit@diamondcs.com.au so the database can be refined.
    Most probably the file is ok, but better be very sure.
     
  3. pazuzu

    pazuzu Registered Member

    Joined:
    Nov 26, 2003
    Posts:
    27
    Location:
    N Z
    id be very interested to find out what the case is w thje AAK i am going to wait and see what u nice folk at DCS say lol ... best plan . have a nice time cheers :)
     
  4. pazuzu

    pazuzu Registered Member

    Joined:
    Nov 26, 2003
    Posts:
    27
    Location:
    N Z
    sorry ... me again just droppin' in :D
    TDS picked up a few visual basic scripts of ppl's but all were fine the heading "'suspioucs filename"" generic detection came up . but again all scripts seemed ok . bye
     
  5. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Was it suspicious file names with double extensions in the name maybe? file.1.2.vbs would trigger that.
    If there is another reason you might like to submit them to the TDS lab. submit@diamondcs.com.au
     
  6. pazuzu

    pazuzu Registered Member

    Joined:
    Nov 26, 2003
    Posts:
    27
    Location:
    N Z
    ok , ok i couldnt wait lol i downloaded the AAK , not scanned yet tho o_O . and yes Jooske it did read "'double extension" , as i do not know what that is in VB Coding i assumed it was ok ... bad move ? .
    anyway lets not sidetrack lol . thx for the url rerun :D
     
  7. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    I ever had that AAK but had to remove it from my system causing it to crash and run terrible with it installed i remember now. Did like the concept and an extra layer in protection, but not what it effected here.
     
  8. DolfTraanberg

    DolfTraanberg Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    676
    Location:
    Amsterdam
    hi pazuzu,
    You might want to turn that detection off in TDS.
    Dolf
     

    Attached Files:

  9. RS

    RS Guest

    I actually am a programmer, and have developed my own Anti-keylogger software...of course it doesn't compete with the mighty TDS...but I have had the same trouble with TDS detecting my anti-keyloggger programs as a positive ID - Keylogger...My code is clean however, and does not monitor any keystrokes. I wonder if this is because the program contains names & locations of actual keyloggers? I would like to sell this software in the future, it would be good to know some advice to give any TDS owners who may contact me about this detection. Thanks.
     
  10. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Yes, TDS is alarmed by many things that keyloggers do and have references to. You are best advised to mention your program is not a keylogger up front and that heuristic detection in TDS is just that, a heuristic which has sensitivities.

    And send us a copy too if you want us to look at it, we may well remove your program from detection anyway, this has been done for a few programs recently :) New versions can be sent to us as well if they are detected, depending on how much you expand the program.
     
  11. RS

    RS Guest

    Thanks alot Gavin...I have contacted you in the past..always lighting fast responses!... :D....The force must really be with you there Mr. Skywalker!... :D...Thanks for your offer of removing my software from detection...I will send it to you for your review once it is fully completed. Your help as always much appreciated!... :) ...JP
     
Thread Status:
Not open for further replies.