Jump to content











Photo
- - - - -

I need a script or a software to find keyloggers in win7 and XP


  • Please log in to reply
19 replies to this topic

#1 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 14 March 2011 - 09:23 PM

Hello @ all

I am looking for a script to find and remove keyloggers in windows XP and windows 7.

I have found on the customer's PC a directory with ca. 4000 logfiles and screen shuts, but i can not locate the software. :devil:

can not locate in

-Task Manager
-Process Manager
-Startup folder
-Task Scheduler
I have testing the software (http://technet.micro...s/bb897445.aspx) RootkitRevealer v1.71 (by By Bryce Cogswell and Mark Russinovich) but this software does not find the keylogger on the the customer-pc. Not in the active hard drive c:\=Win7 or in the sometimes active hard drive d:\=WinXP

Can anyone help me?

Regards,
linus


Edited by linuxbaby, 14 March 2011 - 09:23 PM.


#2 Rui Paz

Rui Paz

    Frequent Member

  • Advanced user
  • 201 posts
  •  
    Portugal

Posted 14 March 2011 - 09:51 PM

Hi,

Most anti-rootkit tools will try to find traces in ram and probably will fail to detect them when running XP because the malware isn't active on memory.

Install AVPTool on XP and make sure it scans the boot sectors and the Windows 7 partition
http://devbuilds.kas...builds/AVPTool/

#3 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 15 March 2011 - 06:37 AM

Install AVPTool on XP and make sure it scans the boot sectors and the Windows 7 partition
http://devbuilds.kas...builds/AVPTool/


Hello Rui Paz

thanks for the answer.

i have tested AVP-Tool but it doesen't found the Keylogger. It builds every Minute a new logfile and a screenshut.

tested
-mbam
-spybot
-RootkitRevealer
-Reanimator 6.9.7.60

I don't no what i can do anymore.


#4 RoyM

RoyM

    Frequent Member

  • .script developer
  • 415 posts
  • Interests:"Booting and Owning".
  •  
    United States

Posted 15 March 2011 - 08:35 AM

Hi linuxbaby
I'm not very experienced with keyloggers, but I think my next step would be to open regedit and search the registry for words like;
ca. 4000 or is it ca.4000 ( no space after . ) and possibly key words contained in the log file and/or the names of the screenshots

If you can suggest a free or open-source keylogger detector app to use, I may be able to find the time to write such a script.
RoyM


#5 Rui Paz

Rui Paz

    Frequent Member

  • Advanced user
  • 201 posts
  •  
    Portugal

Posted 15 March 2011 - 09:28 AM

i have tested AVP-Tool but it doesen't found the Keylogger. It builds every Minute a new logfile and a screenshut.


Is the logfile also created when you are on Windows XP?

#6 al_jo

al_jo

    Gold Member

  • Members
  • 1218 posts
  • Location:Tellus

Posted 15 March 2011 - 10:22 AM

Have you tried SuperAntiSpyware?
They have made a portable single file version
that can be run from a CD or UFD:
http://www.superanti...blescanner.html

There is also a Winbuilder script for latest SAS here:
http://al-jo.99k.org/SAS_2011-03-15.7z


Ps. As a last resort there is a very powerful tool named ComboFix:
http://www.infospywa...lware/combofix/
Read all about it and use it with extreme care!

#7 pscEx

pscEx

    Platinum Member

  • Team Reboot
  • 12701 posts
  • Location:Korschenbroich, Germany
  • Interests:What somebody else cannot do.
  •  
    European Union

Posted 15 March 2011 - 10:43 AM

I don't no what i can do anymore.

What about using Sysinternals's FileMon (or ProcMon in W7)?

Filter everything away besides the "Log Directory".

Peter

#8 skyide

skyide

    Frequent Member

  • Advanced user
  • 218 posts
  •  
    Australia

Posted 15 March 2011 - 10:43 AM

In relation to ComboFix, make sure you read the Known Issues section.

#9 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 15 March 2011 - 03:13 PM

@all Thank you very much!

Now i have found the logger with the helping Sysinternals's FileMon and RegMon (or ProcMon in W7)
Thank you very much PscEX

The Keyloggers Name is "Paint.exe" and runs under the "C:\WINDOWS\system32\wins" directory and is very small.
The folder name of the log- and screen direcotry name: C:\WINDOWS\system32\1031\bang.

@al_jo , @skyide , @RoyM and @Rui Paz Thank you very much for your help.

All Software i have tested in good hope for your help doesn't found this Keylogger on under Win7 and WinXP

tested
-AVP-Tool
-mbam
-spybot
-RootkitRevealer
-Reanimator 6.9.7.60
-SuperAntiSpyware
-Winbuilder script for latest SAS

the ComboFix i have not testet. Tomorrow i will do that. First i read the "Known Issues" section.

Also ... thank you very, very much for help.

#10 Nuno Brito

Nuno Brito

    Platinum Member

  • .script developer
  • 10525 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 15 March 2011 - 03:29 PM

I'm happy to hear your report of success finding the logger.

Congratulations!

:devil:

#11 Rui Paz

Rui Paz

    Frequent Member

  • Advanced user
  • 201 posts
  •  
    Portugal

Posted 15 March 2011 - 03:38 PM

...
The Keyloggers Name is "Paint.exe" and runs under the "C:\WINDOWS\system32\wins" directory and is very small.
The folder name of the log- and screen direcotry name: C:\WINDOWS\system32\1031\bang.
...


Try to copy the paint.exe to another clean machine and upload the file to http://www.virustotal.com/ the site it give you the information about anti-virus that can detect the malware in that file, booting from a clean system, LiveCD or the WinXP installation if clean and running one of the tools should fix the problem.

#12 pscEx

pscEx

    Platinum Member

  • Team Reboot
  • 12701 posts
  • Location:Korschenbroich, Germany
  • Interests:What somebody else cannot do.
  •  
    European Union

Posted 15 March 2011 - 04:24 PM

@all Thank you very much!

Now i have found the logger with the helping Sysinternals's FileMon and RegMon (or ProcMon in W7)
Thank you very much PscEX

The Keyloggers Name is "Paint.exe" and runs under the "C:\WINDOWS\system32\wins" directory and is very small.
The folder name of the log- and screen direcotry name: C:\WINDOWS\system32\1031\bang.

@al_jo , @skyide , @RoyM and @Rui Paz Thank you very much for your help.

All Software i have tested in good hope for your help doesn't found this Keylogger on under Win7 and WinXP

tested
-AVP-Tool
-mbam
-spybot
-RootkitRevealer
-Reanimator 6.9.7.60
-SuperAntiSpyware
-Winbuilder script for latest SAS

the ComboFix i have not testet. Tomorrow i will do that. First i read the "Known Issues" section.

Also ... thank you very, very much for help.

This proofs that sometimes using the "built-in human brain" :devil: can solve issues better than sophisticated high-tec applications.

Peter B)

#13 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 15 March 2011 - 10:09 PM

Try to copy the paint.exe to another clean machine and upload the file to http://www.virustotal.com/ the site it give you the information about anti-virus that can detect the malware in that file, booting from a clean system, LiveCD or the WinXP installation if clean and running one of the tools should fix the problem.


the report of http://www.virustotal.com/ shows no [0]/49 results.

It's crazy again.

#14 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 15 March 2011 - 10:25 PM

This proofs that sometimes using the "built-in human brain" :whistling: can solve issues better than sophisticated high-tec applications.

Peter :cheers:


That's right Peter

Brain.exe is sometimes good, better than sophisticated high-tec applications but my [Slackware] Linux is at any time my favorite when I see what *. exe can destroy in the people live.

Thanks again Peter....

#15 Rui Paz

Rui Paz

    Frequent Member

  • Advanced user
  • 201 posts
  •  
    Portugal

Posted 15 March 2011 - 11:31 PM

the report of http://www.virustotal.com/ shows no [0]/49 results.

It's crazy again.


Well that can explain why the tools didn't find the infection. It seems you got a new specie :whistling:

The best bet against brand new malware is Behavior Analysis and not all AV's use that also this mean that the AV need to be running for some time on the system...

#16 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14267 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 16 March 2011 - 08:53 AM

Obviously brain.exe is full of bloat. :cheers:
Brain.com is much faster and smaller, though EXACTLY as powerful. :whistling:

:rofl:

:cheers:
Wonko

#17 al_jo

al_jo

    Gold Member

  • Members
  • 1218 posts
  • Location:Tellus

Posted 16 March 2011 - 08:54 AM

the report of http://www.virustotal.com/ shows no [0]/49 results.

It's crazy again.


Perhaps the key logger was not a malware.
Only a Spy program that “somebody” installed
to log a users behaviour?
Some companies/wifes/husbands is doing that…legal or not!
:whistling:

#18 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 14267 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 16 March 2011 - 10:44 AM

Perhaps the key logger was not a malware.
Only a Spy program that “somebody” installed
to log a users behaviour?
Some companies/wifes/husbands is doing that…legal or not!
:cheers:

Yep, more generally "real" keyloggers:
  • hide "better" the logs and screenshots
  • send them *somewhere*
  • are hardware devices

I mean to have an actual usefulness you would need physical (or remote) access to the machine to gather the results.

A number of years ago I did have a complete moron unexperienced user (actually an executive in the company) who kept NOT saving the notes he typed on his PC and later went around whining :whistling: that someone had deleted them, until I installed (with his approval in writing :cheers:) a key logger to his PC so that we coud get anything he actually typed back from the logged key presses.

:rofl:
Wonko

#19 skyide

skyide

    Frequent Member

  • Advanced user
  • 218 posts
  •  
    Australia

Posted 16 March 2011 - 11:16 AM

linuxbaby, I think Avira AV comes with some type of new technology (forgot how they call it) that can detect unknown newly released viruses. Are you able to test the file with Avira and see what it tells you without downloading updates? Then again, a key logger is not a virus but it is malware of some sort. If the test fails, download updates and test again.

#20 linuxbaby

linuxbaby

    Frequent Member

  • .script developer
  • 139 posts
  •  
    Germany

Posted 16 March 2011 - 02:47 PM

A number of years ago I did have a complete moron unexperienced user (actually an executive in the company) who kept NOT saving the notes he typed on his PC and later went around whining :cheers: that someone had deleted them, until I installed (with his approval in writing :cheers:) a key logger to his PC so that we coud get anything he actually typed back from the logged key presses.


this is real-security to themselves. :whistling:

@ skyide

hmmm....worry to the Avira AV. No results! i dont no too .... i test all scanners I know but always: No results.

i will here report continue to my experience.

Thanks @all ...
Linus

Edited by linuxbaby, 16 March 2011 - 02:54 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users