keylogger detection

[Faustine]

Bear wrote:

>However, in both xwindows and microsoft windows, there are higher-level 
>key handling routines that have 'hooks' which something can be attached 
>to so that one application can detect keystrokes directed to another. 
>These constitute independent sequences that would have to be checked, 
>and that would be a bit harder. 

You might have a look at PCiHookProtect 2.05 if you don't feel like writing 
it yourself--their heuristic analysis is pretty interesting. It takes 
awhile to run but I've never seen another program quite like it; if you 
know of anything better, drop me a line.

~Faustine.


http://www.geocities.com/SiliconValley/Hills/8839/hookprot.html

HookProtect's main features are:
   
- detection of loggers and monitoring programs loaded 
in memory;
   
- discovery of loggers and monitoring programs located 
on  hard  drive but not loaded in memory by using special 
technology of heuristic analysis;
   
- listing of all loaded modules and opened files;
  
- monitoring  of  files activity (files and directories 
creations, deletions, renames, changes in attributes, size 
and time - all by user's choice) on selected directory;

- detailed information in log file;

- Windows 95/98 and Windows NT Workstation 4.0 support;
   Description of hooks in Windows 9x/NT