How do keyloggers work? I know what they do, but not how they do it. Do they function by any of the below methods? write to application's memory create remote thread create hidden window install global hook modify child process direct memory access critical registry modification send message to another application control process control system services I ask because I recently decided to switch from LnS to Jetico and I wanted to know if I am protected. JPF can protect from the above, but when I tried this test I wasn't alerted at all.