The keyloggers 'hit'

In the article on August 24, we introduced some "genuine" keyloggers . In this issue, we would like to introduce some of the most "critical" keylogger programs available today so that you have a base to identify and prevent.

Hegemonic keyloggers are keyloggers that have the following characteristics: rarely show their names in ' Program Files ', never place their activity icons in the clock tray, never leave them there. My face in the ' Applications ' tab of ' Windows Task Manager ', is always able to operate in the underground operation mode, it is difficult to remove if you do not enter the correct password and hotkey combination . Here are 7 programs Popularity keylogger now popular.

007 Spy Software : This Keylogger actively marks me in C: Program FilessCommon FilesMicrosoft SharedDAO; The executable file is named svchost.exe ; Use Ctrl + Alt + Shift + F7 to activate; Ability to silently send information it records received to an e-mail address or FTP server; It is so "tricky" that storing TXT files records keyboard activity as well as JPG files that take screenshots in an extremely 'special' folder, which is C: RecycledWinLiveUpdate32scrdata , ie it marks data in . crates garbage of the computer.

The keyloggers 'hit' Picture 1

2. All-In-One Spy Keylogger : The default installation directory is C: Some_undistinguished_folderAIOSKL ; The executable file is named ctfmon.exe ; The hotkey combination used to display the default is Ctrl + Alt + Shift + U ; Take a screen shot in JPG format, export the information to record the keyboard operation in TXT format and store in the installation directory.

The keyloggers 'hit' Picture 2

3. Ardamax Keylogger : Default setting in folder C: Program FilesUIB ; The executable file is called UIB.exe ; Files containing stolen information are called UIB.001 , UIB.002 . until UIB.999 and located in the installation directory; The ability to hide yourself very well and use the key combination Ctrl + Alt + Shift + H to display.

The keyloggers 'hit' Picture 3
The main user interface of Ardamax Keylogger

Follow other articles:
Keyloggers 'evil religion'
Eyelog Pro 4. Eye Spy Pro : The default installation in the folder C: Program FilesESP Demo ; The executable file is named ESPDemo.exe ; Use the default hotkey combination Ctrl + Shift + F5 ; Save screenshots in JPG or BMP format, save keyboard information as LOG file and these files are saved in a folder called ' Projects ' in the installation directory; Ability to send keyboard information to an e-mail address or an FTP server.

5. Real Spy Monitor : The default setting in folder C: Program FilesReal Spy Monitor ; The executable file is named winrsm.exe ; Use hotkey Ctrl + Alt + S ; Capture screen image as JPG file, record keyboard operation as TXT file and hide all in default folder C: WindowsRSM ; Ability to secretly send recorded information about an e-mail or certain FTP server. The program is designed to be extremely scalable with its own activity recognition interface for each type of extremely intuitive application.

The keyloggers 'hit' Picture 4
The extremely intuitive monitoring interface of Real Spy Monitor

6. Total Spy : the default installation directory is C: Program FilesTS Trial ; The executable file is named ctfmon.exe ; The default hotkey combination is Ctrl + Alt + Shift + U ; Take a screen shot in JPG format and export the information to record the keyboard operation in TXT format; Store the information recorded in folders named ' daily_log_files ' and " daily_visited_urls ' located in the installation directory.

7. XT Spy : This keylogger is very misleading when notifying the installer that it will install the program in the C: Program FilesXTS folder , but it actually silently installs it into the ' Xfigsys ' folder located on the drive. disc C; Its executable file is xfigsys.exe ; Storing JPG files for screenshots and TXT recording keyboard operations in deep subdirectories in the ' Xfigsyslg ' folder is also in the installation directory. Initially this Keylogger can be sorted into the correct form because it clearly shows up in the ' Applications ' tab of' Windows Task Manager 'but after logging in to the program by password, it immediately disables the access path' Windows Task Manager 'so people can't discover it.

HOANG HAI