How effective is Windows Task Manager at identifying keyloggers?

Question

I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick up the windows of one of the instances and drag it around quickly. The CPU usage on one of the processes goes up, presumably as that process' paint message is rapidly called (assuming your system does "Show window contents while dragging").

Today I wondered if my system has a keylogger. I imagined a hardware keylogger using the OS for its software components and thought there might be some way to detect it without dismantling my computer, but the search hits I got were mostly for software keyloggers and using anti-Malware software to detect them. If you activate Windows Task Manager and then just hit lots of keys on the keyboard (gently!), then any process that is recording them would presumably start using some CPU. I wondered if it would use enough CPU to bring it to the top. When I try it, I can get dwm.exe and csrss.exe and taskhost.exe to come up. I think this shows that it is possible to use this method to find a process that is watching the keyboard, but it takes some discernment.

Does this seem plausible, and is this technique one that is resilient to camouflage methods that malware authors might take?

Answer 1

Efficient malware will manipulate the kernel internal structure so as not to appear at all in the list of process (then again, a hide-and-seek game between malware and malware detectors; see for instance this page for some information). Thus, you will not see anything in the task manager.

Even if the keylogger does appear as a task in the task manager, key logging, in its basic forms, is extremely inexpensive. My first computer could keep track of all I typed with its 6809E CPU, running at the blazing speed of 1 MHz. A basic PC is more than 10000 times faster than that, and will thus need no more than 1/10000th of its CPU to log key strokes. To see that in the task manager, you will need sharp eyes... To complicate the setup, there are a lot of process which exhibit some regular activity even when nominally idle; this is typical of process with background garbage collection activity.

And, of course, when you look at the task manager, you observe, among the list of process, the task manager itself, which uses CPU to update the list as graphically rendered on the screen...

Answer 2

Completely useless against anything but the university project of a computer security student.

You can make processes appear another process's name or not at all without too much difficulty. Also you can get hardware key loggers which can take the raw signal from your keyboard and store it to a memory stick or broadcast it over wifi.

Answer 3

To detect a keylogger on PC, open task manager and search for processes other than the programmes you have installed. You can also search on the web for it .This is the most effective way. The reason why keyloggers are so hard to detect is that they're not illegal. Most people think they are because of the ways hackers use them (which is illegal). However it is not illegal to install keyloggers on your own computer to monitor your kids, or to monitor your employees for business. Due to those reasons, They are allowed to be sold legally, and are protected from being detected easily. There are some methods of detection, but programmers know them and change them to go undetected from those methods.