I write a simple keylogger by C# in Windows (using Hook method SetWindowsHookEx). I checked my application with most antivirus and anti-spyware programs, but none detect it.

Why don't these antivirus or anti-spyware programs disassemble the executable to find usage of SetWindowsHookEx? I read that over 80% of keyloggers use this hooking method .

  • 2
    Do you have any information on how many programs use the SetWindowsHookEx methog legitimately? My guess would be that the function itself isn't evil and thus cannot be blocked completly. – Thanathan Sep 24 '15 at 9:14
  • yes,but they can alert the user that an app want to use the keyboard or mouse messages .Then user can select that app can run or not – M.Amrollahi Sep 24 '15 at 9:36
  • Shows you how easy it is to bypass AV when you write malware from scratch – paj28 Sep 24 '15 at 10:47
  • 7
    Maybe 80% of keyloggers use SetWindowsHookEx, but that does not mean 80% of software that use SetWindowHookEx are keyloggers. – John Sep 24 '15 at 11:50
  • that is true John,but another question:i read that the most usage of SetWindowsHookEx is for debugging .why and which softwares using SetWindowsHookEx to log keyboard or mouse or ... messages ? – M.Amrollahi Sep 24 '15 at 14:33

This is to avoid what is called a false positive, i.e. when the user receives an alert about a danger while there was actually no danger at all.

Do you remember this rich era when, while you were browsing the Internet, you where facing a dozen of times per day an alert bow stating something like "Alert ! The web page you are viewing contains some secured elements and some unsecured elements ! Are you sure you want to proceed !". The result of this was just that people were trained to ignore their browser's alert message and blindly click on the OK button, which was fully counter-productive from the security point-of-view.

Now this is the same with your SetWindowsHookEx API call. An anti-virus has no way to determine the intent of a software, it can only rely on a subset of facts. So, maybe the use of this API call enters as a part of an heuristic taking into account several other parameters helping the anti-virus to determine when a software has got a suspicious behavior, but the sole presence of this API call is not sufficient since it is also used by many authorized applications (same thing if you write a simple Batch file deleting all your documents: your anti-virus will not prevent you from running it).

These are the very reason why, while anti-virus provide a good level of protection against well-known malware, it can never be a bullet-proof protection and the first and better line of defense remains the user who should be properly educated in recognizing and refrain from opening suspicious files.

| improve this answer | |
  • I read that a few applications like games and professional programms use Hooking,but why an application like chrome browser should hook the keyboard ? – M.Amrollahi Sep 24 '15 at 10:26
  • 1
    @MehdiAmrollahi: That's precisely why on Linux you can find things like SeLinux which allows to define an "authorized behavior" by a set of rules stating which OS API calls (and file access, etc.) are allowed for which application and in which context. The downside is that to bring any significant amount of security such rules must be defined to match very closely your use-case and need to be maintained to not block any legit usage. AFAIK there is no such thing on Windows, however Windows has features designed to offer the application a safer place to get sensitive inputs like passwords. – WhiteWinterWolf Sep 24 '15 at 12:30
  • ok,but i do not satisfy why antivirus do not alarm user that a program is suspicious ! – M.Amrollahi Sep 24 '15 at 12:48
  • 5
    @MehdiAmrollahi They do it, but only when they have a very strong suspicions. Your keylogger was not injecting code into Chrome, tried some privilege escalation methods, contacted well-known malware C&C hosts, etc., so it did not pass the alert threshold. The alert messages must remain exceptional to ensure that the user adopts a responsible attitude. If the anti-virus does not stop to show wrong warnings to the user, when one day a real malware will come-in the user will not pay attention and allow it without thinking any further: "Damn, still one these annoying anti-virus popups!". – WhiteWinterWolf Sep 24 '15 at 12:58
  • I post a comment above for John and i have another question related to this . we know the most usage of SetWindowsHookEx is for debugging. what percent of windows users know debugging to use this command?Is this possible that like iOS(Apple) , users gave access the applications to access photo or contacts or...windows users can access apps to access SetWindowsHookEx command too ?? – M.Amrollahi Sep 24 '15 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.