I know that some of the best keyloggers can't be viewed from the Task Manager.
Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden from there as well?
Add a comment
|
3 Answers
The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to replace that request with one that said "what programs are running other than "my bad program". That's basically what a root kit does.
Done properly, it makes it so that no matter how you try to ask for the information that would tell you what is going on, it gets intercepted by the bad code that says nothing is wrong. There isn't any way to tell for sure if you have one and there isn't any way to tell for sure you've cleaned them all if you've been infected by one. This is part of the reason for the "nuke it from orbit" philosophy that you may have heard around here saying that you should completely reinstall a system if it is compromised by anything more than the most simplistic malware.
The easiest and most effective way to detect a root kit is to boot from something known as a LiveCD. It's an operating system on a CD or DVD that can boot up and scan your hard drive from a known good configuration. There are a few things out there that can get around even this by infecting the actual hardware components themselves, but those are still (thankfully) exceedingly rare and fairly device specific.
As another aside, there are also key loggers that are actual pieces of hardware that sit on the line for the keyboard and can detect (or even alter) all keystrokes without having any software running on the system. These are also exceptionally rare.
answered Mar 27, 2013 at 18:41
-
They aren't that rare.. they are easily purchasable in both USB and PS/2 form in the U.S. for ~$50 or so, and come with built-in memory Commented Sep 22, 2014 at 21:22
-
@user2813274 - sure they can be made cheaply and are easily available, but the chances of someone actually encountering one are far FAR less likely than a software keylogger since they require physical access to the box to implement and most people don't merit that kind of targeted effort. Commented Sep 22, 2014 at 21:37
You are talking about rootkits which work by integrating themselves into the kernel of the operating system; they can do keylogging entirely transparently, they can also do many other things.
If a rootkit is competently written, you cannot detect it from within the running system. Only careful forensic examination of hard drives and other areas of permanent storage may help detect rootkits; once a rootkit is there your system is yours no more.
answered Mar 27, 2013 at 18:31
Key loggers can also be as simple as a DLL loaded into the memory of an existing process, perhaps in the form of a browser plug-in. They wouldn't show up as a separate key logging task, but would show up in a loaded modules list. And they're fabulously easy to write, requiring only two Windows API calls to load the logger, and another half dozen lines to implement it.
They may also not be named as helpfully as "KeyLogger.DLL" But if you were to run DEPENDS.EXE on all your loaded modules, you could search for SetWindowsHookEx, which is a routine that most ordinary applications would not need to call.
answered Mar 27, 2013 at 19:57
