I know that some of the best keyloggers can't be viewed from the Task Manager.
Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden from there as well?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to replace that request with one that said "what programs are running other than "my bad program". That's basically what a root kit does.
Done properly, it makes it so that no matter how you try to ask for the information that would tell you what is going on, it gets intercepted by the bad code that says nothing is wrong. There isn't any way to tell for sure if you have one and there isn't any way to tell for sure you've cleaned them all if you've been infected by one. This is part of the reason for the "nuke it from orbit" philosophy that you may have heard around here saying that you should completely reinstall a system if it is compromised by anything more than the most simplistic malware.
The easiest and most effective way to detect a root kit is to boot from something known as a LiveCD. It's an operating system on a CD or DVD that can boot up and scan your hard drive from a known good configuration. There are a few things out there that can get around even this by infecting the actual hardware components themselves, but those are still (thankfully) exceedingly rare and fairly device specific.
As another aside, there are also key loggers that are actual pieces of hardware that sit on the line for the keyboard and can detect (or even alter) all keystrokes without having any software running on the system. These are also exceptionally rare.
You are talking about rootkits which work by integrating themselves into the kernel of the operating system; they can do keylogging entirely transparently, they can also do many other things.
If a rootkit is competently written, you cannot detect it from within the running system. Only careful forensic examination of hard drives and other areas of permanent storage may help detect rootkits; once a rootkit is there your system is yours no more.
Key loggers can also be as simple as a DLL loaded into the memory of an existing process, perhaps in the form of a browser plug-in. They wouldn't show up as a separate key logging task, but would show up in a loaded modules list. And they're fabulously easy to write, requiring only two Windows API calls to load the logger, and another half dozen lines to implement it.
They may also not be named as helpfully as "KeyLogger.DLL" But if you were to run DEPENDS.EXE on all your loaded modules, you could search for SetWindowsHookEx, which is a routine that most ordinary applications would not need to call.
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?