Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that some of the best keyloggers can't be viewed from the Task Manager.

Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden from there as well?

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to replace that request with one that said "what programs are running other than "my bad program". That's basically what a root kit does.

Done properly, it makes it so that no matter how you try to ask for the information that would tell you what is going on, it gets intercepted by the bad code that says nothing is wrong. There isn't any way to tell for sure if you have one and there isn't any way to tell for sure you've cleaned them all if you've been infected by one. This is part of the reason for the "nuke it from orbit" philosophy that you may have heard around here saying that you should completely reinstall a system if it is compromised by anything more than the most simplistic malware.

The easiest and most effective way to detect a root kit is to boot from something known as a LiveCD. It's an operating system on a CD or DVD that can boot up and scan your hard drive from a known good configuration. There are a few things out there that can get around even this by infecting the actual hardware components themselves, but those are still (thankfully) exceedingly rare and fairly device specific.

As another aside, there are also key loggers that are actual pieces of hardware that sit on the line for the keyboard and can detect (or even alter) all keystrokes without having any software running on the system. These are also exceptionally rare.

share|improve this answer
add comment

You are talking about rootkits which work by integrating themselves into the kernel of the operating system; they can do keylogging entirely transparently, they can also do many other things.

If a rootkit is competently written, you cannot detect it from within the running system. Only careful forensic examination of hard drives and other areas of permanent storage may help detect rootkits; once a rootkit is there your system is yours no more.

share|improve this answer
add comment

Key loggers can also be as simple as a DLL loaded into the memory of an existing process, perhaps in the form of a browser plug-in. They wouldn't show up as a separate key logging task, but would show up in a loaded modules list. And they're fabulously easy to write, requiring only two Windows API calls to load the logger, and another half dozen lines to implement it.

They may also not be named as helpfully as "KeyLogger.DLL" But if you were to run DEPENDS.EXE on all your loaded modules, you could search for SetWindowsHookEx, which is a routine that most ordinary applications would not need to call.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.