9

If yes, do you know some examples of Keyloggers capable of perform this?

EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.

Improve this question
2
  • 1
    Well it really depends on the keylogger and how the logon screen is accessed. You can access logon screen via remote desktop, virtual desktop, and via console/keyboard. In every scenario there is different keylogger involved, and in case of console, some keyloggers do log, some dont - vishnuvalentino.com/tips-and-trick/… this one does.
    – Andrew Smith
    Aug 27, 2012 at 0:06
  • Note that hardware keyloggers could record the pressed key no matter what's on the computer. Never accept a free keyboard tho (nor a free USB key, mouse, hard disk drive,...)
    – Xenos
    Jul 25, 2018 at 9:25

2 Answers 2

Reset to default
11

The log on screen is created by the WinLogin process. If a program can bind to the WinLogon process then it can most definitely keylog your login password.

The Metapreter Payload from the MetaSploit library is a good example of a tool capable of migrating into the logon process. You may look at "MetaSploit Unleashed", to learn how to compile Metapreter into a binary payload (.exe) or attach that to another (.exe) and obtain the same results.

A good demonstration of the technique can be seen at : Clicky

More References:

Note: Use of any kind of malware or spyware should only be done with prior consent of the system owner and/or users.

Also, look at Polynomial's comment below for other ways. +1 to him ;)

Improve this answer
2
  • 3
    A kernel-based HID filter driver would allow a keylogger to access keystrokes at any point in time, regardless of the target within the OS. A hardware-based keylogger could do the same. Neither of these will capture logins via remote desktop, though.
    – Polynomial
    Aug 27, 2012 at 9:30
  • @Polynomial - Of course if you have the type of malware that interacts with the HID filter driver then you likely have malware that could also access the registry information and transmit it. Which means they could simply brute force the user account's password. The type of malware that interacts with a driver would require permission from the user to be installed at least in recent versions like Windows 7 and Windows 8. This also likely means they have elevated priviliages on the machine itself.
    – Ramhound
    Aug 27, 2012 at 12:46
1

Hypervisor malewares should be definitely capable of doing this. http://en.wikipedia.org/wiki/Hypervisor#Security_implications

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.