Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

If yes, do you know some examples of Keyloggers capable of perform this?

EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.

share|improve this question
1  
Well it really depends on the keylogger and how the logon screen is accessed. You can access logon screen via remote desktop, virtual desktop, and via console/keyboard. In every scenario there is different keylogger involved, and in case of console, some keyloggers do log, some dont - vishnuvalentino.com/tips-and-trick/… this one does. – Andrew Smith Aug 27 '12 at 0:06

2 Answers

up vote 8 down vote

The log on screen is created by the WinLogin process. If a program can bind to the WinLogon process then it can most definitely keylog your login password.

The Metapreter Payload from the MetaSploit library is a good example of a tool capable of migrating into the logon process. You may look at "MetaSploit Unleashed", to learn how to compile Metapreter into a binary payload (.exe) or attach that to another (.exe) and obtain the same results.

A good demonstration of the technique can be seen at : Clicky

More References:

Note: Use of any kind of malware or spyware should only be done with prior consent of the system owner and/or users.

Also, look at Polynomial's comment below for other ways. +1 to him ;)

share|improve this answer
2  
A kernel-based HID filter driver would allow a keylogger to access keystrokes at any point in time, regardless of the target within the OS. A hardware-based keylogger could do the same. Neither of these will capture logins via remote desktop, though. – Polynomial Aug 27 '12 at 9:30
@Polynomial - Of course if you have the type of malware that interacts with the HID filter driver then you likely have malware that could also access the registry information and transmit it. Which means they could simply brute force the user account's password. The type of malware that interacts with a driver would require permission from the user to be installed at least in recent versions like Windows 7 and Windows 8. This also likely means they have elevated priviliages on the machine itself. – Ramhound Aug 27 '12 at 12:46
up vote 1 down vote

Hypervisor malewares should be definitely capable of doing this. http://en.wikipedia.org/wiki/Hypervisor#Security_implications

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.