The keyloggers 'hit'

In the article on August 24, we introduced some "genuine" keyloggers . In this issue, we would like to introduce some of the most "critical" keylogger programs available today so that you have a base to identify and prevent.

Hegemonic keyloggers are keyloggers that have the following characteristics: rarely show their names in ' Program Files ', never place their activity icons in the clock tray, never leave them there. My face in the ' Applications ' tab of ' Windows Task Manager ', is always able to operate in the underground operation mode, it is difficult to remove if you do not enter the correct password and hotkey combination . Here are 7 programs Popularity keylogger now popular.

007 Spy Software : This Keylogger actively marks me in C: Program FilessCommon FilesMicrosoft SharedDAO; The executable file is named svchost.exe ; Use Ctrl + Alt + Shift + F7 to activate; Ability to silently send information it records received to an e-mail address or FTP server; It is so "tricky" that storing TXT files records keyboard activity as well as JPG files that take screenshots in an extremely 'special' folder, which is C: RecycledWinLiveUpdate32scrdata , ie it marks data in . crates garbage of the computer.

2. All-In-One Spy Keylogger : The default installation directory is C: Some_undistinguished_folderAIOSKL ; The executable file is named ctfmon.exe ; The hotkey combination used to display the default is Ctrl + Alt + Shift + U ; Take a screen shot in JPG format, export the information to record the keyboard operation in TXT format and store in the installation directory.

3. Ardamax Keylogger : Default setting in folder C: Program FilesUIB ; The executable file is called UIB.exe ; Files containing stolen information are called UIB.001 , UIB.002 . until UIB.999 and located in the installation directory; The ability to hide yourself very well and use the key combination Ctrl + Alt + Shift + H to display.

The main user interface of Ardamax Keylogger

Follow other articles:
Keyloggers 'evil religion'
Eyelog Pro 4. Eye Spy Pro : The default installation in the folder C: Program FilesESP Demo ; The executable file is named ESPDemo.exe ; Use the default hotkey combination Ctrl + Shift + F5 ; Save screenshots in JPG or BMP format, save keyboard information as LOG file and these files are saved in a folder called ' Projects ' in the installation directory; Ability to send keyboard information to an e-mail address or an FTP server.

5. Real Spy Monitor : The default setting in folder C: Program FilesReal Spy Monitor ; The executable file is named winrsm.exe ; Use hotkey Ctrl + Alt + S ; Capture screen image as JPG file, record keyboard operation as TXT file and hide all in default folder C: WindowsRSM ; Ability to secretly send recorded information about an e-mail or certain FTP server. The program is designed to be extremely scalable with its own activity recognition interface for each type of extremely intuitive application.

The extremely intuitive monitoring interface of Real Spy Monitor

6. Total Spy : the default installation directory is C: Program FilesTS Trial ; The executable file is named ctfmon.exe ; The default hotkey combination is Ctrl + Alt + Shift + U ; Take a screen shot in JPG format and export the information to record the keyboard operation in TXT format; Store the information recorded in folders named ' daily_log_files ' and " daily_visited_urls ' located in the installation directory.

7. XT Spy : This keylogger is very misleading when notifying the installer that it will install the program in the C: Program FilesXTS folder , but it actually silently installs it into the ' Xfigsys ' folder located on the drive. disc C; Its executable file is xfigsys.exe ; Storing JPG files for screenshots and TXT recording keyboard operations in deep subdirectories in the ' Xfigsyslg ' folder is also in the installation directory. Initially this Keylogger can be sorted into the correct form because it clearly shows up in the ' Applications ' tab of' Windows Task Manager 'but after logging in to the program by password, it immediately disables the access path' Windows Task Manager 'so people can't discover it.

HOANG HAI