158
2 Computer Viruses, Malicious Logic, and Spyware
Fig. 2.13 Actual Spy
of the most popular type—hook-based ones. However, such methods return many
false positives. My studies have shown that there are hundreds of safe programs
that are not keyboard spies but use hooks to track keyboard input and mouse.
The most popular examples are Punto Switcher, Lingvo dictionary, and software
of multimedia keyboards and mouses.
3. Monitoring of API functions used by keyloggers. This method is based on interception of a number of functions applied by a keyboard spy, in particular, the
functions SetWindowsHookEx, UnhookWindowsHookEx, GetAsyncKeyState,
and GetKeyboardState. Calling of these functions by any application helps raise
alarm in a timely manner; however, the problems of multiple false positives will
be the same as with method 2.
4. Tracking of drivers, processors, and services used by the system. This is a multipurpose method that can be used not only against keyboard spies. In the most
basic case, it is possible to use programs like Kaspersky Inspector or Adinf that
track emergence of new files in a system.
2.4.2.6 Keyloggers Based on Filter Drivers
Operation of such keyloggers is based on installation of a special driver connected
to the keyboard driver as a filter; this keylogger is one of the simplest ones in terms
of both implementation and detection.
Keylogger of this type can be based on one of the following:
2 Computer Viruses, Malicious Logic, and Spyware
Fig. 2.13 Actual Spy
of the most popular type—hook-based ones. However, such methods return many
false positives. My studies have shown that there are hundreds of safe programs
that are not keyboard spies but use hooks to track keyboard input and mouse.
The most popular examples are Punto Switcher, Lingvo dictionary, and software
of multimedia keyboards and mouses.
3. Monitoring of API functions used by keyloggers. This method is based on interception of a number of functions applied by a keyboard spy, in particular, the
functions SetWindowsHookEx, UnhookWindowsHookEx, GetAsyncKeyState,
and GetKeyboardState. Calling of these functions by any application helps raise
alarm in a timely manner; however, the problems of multiple false positives will
be the same as with method 2.
4. Tracking of drivers, processors, and services used by the system. This is a multipurpose method that can be used not only against keyboard spies. In the most
basic case, it is possible to use programs like Kaspersky Inspector or Adinf that
track emergence of new files in a system.
2.4.2.6 Keyloggers Based on Filter Drivers
Operation of such keyloggers is based on installation of a special driver connected
to the keyboard driver as a filter; this keylogger is one of the simplest ones in terms
of both implementation and detection.
Keylogger of this type can be based on one of the following: