Keylogger without the need of hooks or drivers

Discussion in 'privacy technology' started by Wai_Wai, Nov 8, 2006.

Thread Status:
Not open for further replies.
  1. Wai_Wai

    Wai_Wai Registered Member

    Joined:
    Dec 28, 2004
    Posts:
    556
    I heard that a keylogger can still do the logging without hooks or drivers. I am not sure how it works. Could anyone explain about that?

    What anti-keyloggers are proactive in nature and are capable of blocking such kinds of logging (keys, mouses, screenshots) which make use of the above technolgy?

    Thank you.
     
  2. MikeNash

    MikeNash Security Expert

    Joined:
    Jun 9, 2005
    Posts:
    1,654
    Location:
    Sydney, Australia
    A program can check the state of the keyboard (polling) - and example of this is Martin's undetectable keylogger.
     
  3. Wai_Wai

    Wai_Wai Registered Member

    Joined:
    Dec 28, 2004
    Posts:
    556
    Would you mind explaining more or provide any link which explains this technique?

    What security software can stop this kind of logging?
     
  4. MikeNash

    MikeNash Security Expert

    Joined:
    Jun 9, 2005
    Posts:
    1,654
    Location:
    Sydney, Australia
    GetKeyState is defined here: http://msdn.microsoft.com/library/d...erence/keyboardinputfunctions/getkeystate.asp

    One can simply check the state of each key very rapidly - (simplistically - check if A is up or down, then check if B is up or down, and so on. Assuming 102 keys to check - its a fast loop. )

    Lets say it takes 2/10ths of a second to do the check. Keep repeating the check over and over again - and every 2/10ths of a second you know the complete state of keyboard (A - not down, B - down, Caps - down) etc.

    I'm unsure which software *currently* detects this particular method using some kind of proactive mechanism, but I know one that *will* very soon.
     
  5. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    That is next OA.
    GW partially stops it( stops logging of keys but not mouse clicks).
    Antivir detects it by heuristics.
    BOClean heard to detect it( not sure by signature or heuristics).
    SSM probably detects it.
    CH detects and stops it.
    BZ an older version used to stop it, current version- No, latest pre-release version- not checked!
    Others ... let,s wait.
     
    Last edited: Nov 8, 2006
Loading...
Thread Status:
Not open for further replies.