I found one online, which I wanted to try out at my house and see if it actually worked. It's written in C, and it is not very big at all considering half of it is just a bunch of cases for which key is pressed, ex:

fputs("[CAPS LOCK]",file);

and it also does a bit with the registry, like

reg_key=RegOpenKeyEx    (HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_QUERY_VALUE,&hKey);

My windows 7 computer will pick this up as 'Potentially harmful software', while my XP computer at school with Symantec Endpoint Protection will not.. Being corporate software, I thought Symantec would pick it up in a heartbeat but it did not..

So my question is, what establishes this program as 'Potentially Harmful Software'? Is it the modification / usage of the registry or some other factor that generally gets a keylogger caught?

Note: There is more to the program, but it's rather lengthy so I edited out some of the repetitive pieces. Here's most of the keylogger, however, but I left out a few statements (if-else and switch) that pretty much only wrote the data to memory.

    #include <windows.h>
#include <winuser.h>
#include <windowsx.h>

#define BUFSIZE 80

int test_key(void);
int create_key(char *);
int get_keys(void);

int main(void)
   HWND stealth; /*creating stealth (window is not visible)*/

   int test,create;
   test=test_key();/*check if key is available for opening*/

   if (test==2)/*create key*/
       char *path="c:\\%windir%\\svchost.exe";/*the path in which the file needs to be*/


   int t=get_keys();

   return t;

int get_keys(void)
           short character;

                            FILE *file;
                                    return 1;
                                    else if((character>64)&&(character<91))
                                              case VK_SPACE:
                                              fputc(' ',file);

      A lot of switch statements left out for brevity
      I left out a lot of if-elses as well, all they did was write the
      data to the file.

           return EXIT_SUCCESS;                            

int test_key(void)
   int check;
   HKEY hKey;
   char path[BUFSIZE];
   DWORD buf_length=BUFSIZE;
   int reg_key;

       return check;



   return check;  

int create_key(char *path)
       int reg_key,check;

       HKEY hkey;

               RegSetValueEx((HKEY)hkey,"svchost",0,REG_SZ,(BYTE *)path,strlen(path));
               return check;

       return check;
  • 2
    Which API is this keylogger based on? WH_KEYBOARD, WH_KEYBOARD_LL or something else? Commented Feb 17, 2012 at 13:44
  • ↑ This is an important question. What privileges does that program (that API) require? Would it be able to run at all if you run it as "limited user"?
    – badp
    Commented Feb 17, 2012 at 14:17
  • @badp SetWindowsHookEx based loggers work with limited users, but I don't know how they interact with elevated programs running on the same desktop. Commented Feb 17, 2012 at 14:49
  • 3
    The reason Symantec Endpoint Protection does not pick this up is because is more in the category of "malware" behavior and honestly SEP wasn't designed to find that sort of behavior. On your Windows 7 machine you like are using MSE which uses behavioral detection...SEP does not.
    – Ramhound
    Commented Feb 17, 2012 at 15:18
  • 1
    MSE and Windows Defender have behavoral scanning. Symantec Endpoint Protection does not. You mention you don't have MSE, while I doubt that, I know you have Windows Defender.
    – Ramhound
    Commented Jul 9, 2012 at 14:38

5 Answers 5


In order to understand why certain programs (malicious and non-malicious) are flagged by Anti-Virus software, we need to understand some of the basic principles that Anti-Virus software use.

Access to unauthorized resources

The Keyboard Hook

As others have suggested, the keyboard hook is one of the first ways in which a primitive keylogger gets detected. If you're not a programmer then you may be confused between user input and keyboard hooks. A keyboard hook reads all traffic of user i/p through the (say microsoft message channel). Most programs only require to listen to i/p directed to them, not every OS program. A window handle is generally used to specify which i/p goes where. However, the reason the antivirus didn't detect this is because of two potential reasons:

  • Although keyboard hooks are not in general program use, programs such a macros, certain games, etc require to filter user input before it reaches any program. For such programs it is possible to over ride the security flag.
  • The Anti-Virus is not a real time one or hasn't been configured on a alert level to notify the user of that PC immediately. It could either have that alert disabled or asked to log it to memory.

Read More: http://www.keylogger.org/articles/arkon/keyboard-hook-6.html

Registry Windows has recently adopted a Linux-like(without the password ie. :P) approach towards security wherein un-authorized resource use or program execution causes a security popup which suspends other processes and can only been dismissed by direct user input. This feature, UAC (User Account Control) is what was responsible imo for detecting your keylogger initially as an unauthorized new software. Using the keyboard hook, running with no open forms and hidden in the background all added to this.

The Main Failure

File Creation Many antivirus solutions store a list of all files you have on your PC, whenever a new file is created, its origin is traced back. If this does not check up, a security flag is raised. This feature is used in conjunction with scans in real time, so extracting contents of a zip, in modern day AVs causes an immediate search of the newly found files.

White list & Black list AVs store billions of program file hashes in order to identify a simple modification of even a byte of a windows DLL. They also store all known and documented programs in the world in order to better classify them from the other evil ones.

Ultimately, the fact that your AV didn't do the following is the main cause of concern:

  1. Detect execution of an unfamiliar program.
  2. Not detect registry or keyboard hook access by this program.
  3. Not flag the creation of files without user consent by the unfamiliar program.
  4. Not alarm when this program tried to send this data unencrypted through the network to the attacker. (this being the last stance where a data leak could be prevented)

Note: As another answer states, the .exe having originated from another computer and also caused a security alert on a Win 7 machine, etc.


In my experience, most anti virus/malware solutions don't complain about low-level-keyboard-hooks, which are the easiest way to create a keylogger.

One of my most popular programs contained such a keyboard hook, and only one user told me about his firewall complaining. On the other hand, several other modules of it, which were pretty harmless, triggered several false positives.

I don't know why they don't consider low-level-keyboard-hooks as evil. One possible reason might be that incompetent programmers people who don't know better abuse them to get global hotkeys, instead of using the hotkey APIs.

Interestingly normal global keyboard hooks, which result in dll injection on keyboard events are commonly detected.

  • W7 is a much more mature operating system, from a security perspective. A lot of the design decisions have been based on lessons learned from XP and earlier.
    – Rory Alsop
    Commented Feb 17, 2012 at 13:47
  • Even a fully patched version of XP though with an updated firewall, that's kind of concerning. Also, it's not installed as autorun, it is just an executable the user has to open, or be placed in the Start folder.
    – cutrightjm
    Commented Feb 17, 2012 at 13:48
  • Installing itself in the autorun might trigger that warning. My keylogger like program doesn't trigger a warning in Win7 with MS security essentials. Commented Feb 17, 2012 at 13:54
  • @ekaj - Windows XP in 2012 is not secure. Lets stop trying to secure an operating system release over 10 years ago. You Windows 7 system has something installed, otherwise by default, there is nothing that would have detect this behavior. You claim there is nothing installed but there has to be. Windows 7 does not have this type of functionality built into it.
    – Ramhound
    Commented Feb 17, 2012 at 15:20
  • @ekaj you may want to check out my answer.
    – user5575
    Commented Jul 10, 2012 at 8:13

In this instance, the fact that it is reading keystrokes and storing them will be what flagged this one up. Generally that shouldn't be needed by anything so it should be used as a trigger.

As @CodeInChaos says, though, this often isn't picked up - which seems like a massive oversight.


One comment you made left me confused. I asked if you downloaded the exe and you said you didn't however your question says you downloaded at home and it got you the message. For that example i believe the exe was flagged by unsafe which windows does automatically. If you right click properties at the bottom of the general tab there will be something saying this exe came from a different computer with an unblock button.

Windows XP may not have that functionality which is why it wasnt picked up.

  • Windows XP does not have this feature it was added in Vista and Windows 7.
    – Ramhound
    Commented Jul 9, 2012 at 14:42
  • I suspect this is the correct answer and I will be testing it tomorrow.
    – Michael Z.
    Commented Apr 13, 2017 at 17:40

The fact of the matter is that the Anti virus protection currently offered is simply not enough. Majority of Anti virus companies do not have advanced heuristic capabilities (some dont have any at all). Almost all of them rely on the MD5 checksum of a particular file to mark it as a virus, this method works on all the big boys (as long as they're not polymorphic) but it fails to catch the smaller, less well known "malware".

I feel that it probably did not detect it because it did not have the checksum of that file

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .