2010-01-17, 10:34 AM
MissingLink Wrote:Does anyone know a sure-fire low-level way to detect keyloggers. Like pressing a key a 100 times and seeing if memory is getting consumed, or file writes occurring that shouldn't be happening, or using router logs somehow?
If they're writing to disk they can be found using FileMon in most instances. If they're feeding data to another computer via the internet or permitting someone else to control you TCPView will show them. Otherwise Process Explorer is another good one for determining exactly what is running, and where it's located.
http://technet.microsoft.com/en-us/sysin...fault.aspx
It's not having what you want - It's wanting what you've got.

