Keylogger malware, delivered by Trojans, and often incorporating rootkit technology, seems to be on the increase lately; much of it focusing on stealing victims’ banking credentials, including passwords. MMORPG (online multiplayer games), appear to be particular targets; especially WOW (World of Warcraft).
This type of malware is designed to remain undetected, and to be as stealthy as possible so that it can get on with its designated task, which most often results in identity theft and the compromising of the victim’s financial data.
Keyloggers are one of the most sinister types of malware; the type of malware that I pay particular attention to, and make a special effort to guard against.
A software keylogger, or system monitor, is a small program (not always malware, I should point out), that monitors every keystroke a user types on a computer’s keyboard.
This type of application does not necessarily require physical access to the user’s computer. It can be downloaded by someone who wants to monitor activity on a particular computer, or it can be downloaded unwittingly, as malware and executed as part of a rootkit, or a remote administration (RAT) Trojan horse.
Keyloggers are not restricted to software applications however, and are available as a connected hardware device designed for legitimate purposes.
From Wikipedia:
Hardware keyloggers are used for keystroke logging by means of a hardware circuit that is attached somewhere in between the computer keyboards and the computer, typically inline with the keyboard’s cable connector.
More stealthy implementations can be installed or built into standard keyboards, so that there’s no device visible on the external cable. Both types logs all keyboard activity to their internal memory, which can subsequently be accessed, for example, by typing in a secret key sequence.
A hardware keylogger has an advantage over a software solution; because it is not dependent on installation on the target computer’s operating system, it will not interfere with any program running on the target machine and also cannot be detected by any software. However its physical presence may be detected, for example if it’s installed outside the case as an inline device between the computer and the keyboard. Some of these implementations have the ability to be controlled and monitored remotely by means of a wireless communication standard.
A malware keylogger typically consists of two files: a dynamic link library (DLL) file (which does all the recording) and an executable file (.EXE) that installs the DLL file and triggers it to work. The keylogger program records each keystroke and uploads the information over the Internet.
Luckily, there are remedies for this type of malware threat.
SnoopFree Privacy Shield is a free powerful application that guards your keyboard, screen, and open windows from all such spy software. It makes it virtually impossible for any spy program to work on your computer since SnoopFree Privacy Shield’s protection works against spy software in real time.
I have been using this application for quite some time on my Windows XP machine, (unfortunately it only works on XP), and I have been amazed at the number of programs that have requested access to my keyboard and screen, particularly programs that I was in the process of installing.
Since I test a lot of applications on this particular machine, I see this type of program behavior frequently. Unless there are valid reasons for this type of access, I don’t allow it. Surprisingly, in most cases the application installs correctly. Curious!
If you’re serious about keylogger protection and maintaining your privacy, then you should consider adding this free application to your security toolbox. If you need more convincing, take a look at the “comments” page on CNET.
System Requirements: Unfortunately, this application works on Windows XP only.
Download at: Download.com
If anyone knows of a similar free application that works on Vista and above, I would appreciate you letting me know
If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.
With the more powerful computing systems many of us have today it’s becoming increasingly more difficult to tell if a computer is infected with malware, based on system slow down alone. Back in the days of less powerful systems, when 128 Meg of RAM and a Pentium 3 running at 665 MHz was considered the height of computing power, system slow down or a slow Internet experience, was suggestive of a malware infection.
Bill Mullins' Weblog - Tech Thoughts 