Bear wrote:

However, in both xwindows and microsoft windows, there are higher-level key handling routines that have 'hooks' which something can be attached to so that one application can detect keystrokes directed to another. These constitute independent sequences that would have to be checked, and that would be a bit harder.

You might have a look at PCiHookProtect 2.05 if you don't feel like writing it yourself--their heuristic analysis is pretty interesting. It takes awhile to run but I've never seen another program quite like it; if you know of anything better, drop me a line. ~Faustine. http://www.geocities.com/SiliconValley/Hills/8839/hookprot.html HookProtect's main features are: - detection of loggers and monitoring programs loaded in memory; - discovery of loggers and monitoring programs located on hard drive but not loaded in memory by using special technology of heuristic analysis; - listing of all loaded modules and opened files; - monitoring of files activity (files and directories creations, deletions, renames, changes in attributes, size and time - all by user's choice) on selected directory; - detailed information in log file; - Windows 95/98 and Windows NT Workstation 4.0 support; Description of hooks in Windows 9x/NT