Apparent keylogger problem

bighands123 · 10-25-2008, 05:36 PM

Ok, this is a long story, but it would appear I am in some way having my computer accessed.

I have recently started at university, and my girlfriend, who i now live approx 100 miles from, has started to recieve messages over myspace from an anonymous character, making certain accusations about me. Without going into detail, there is enough evidence to show that this person lives here in the city where i go to university. Now, initially i assumed this person used the myspace search engine to find my girlfriend. However, the person doing this has managed to access my hotmail account, as well as both our myspace accounts. We frequently change our passwords to entirely unguessable ones, however this person continues to gain access to said accounts. I have spoken to a few people who have suggested that i might have a keylogger on my computer. i have scanned the computer with spybot, i use zonealarm with all the settings at max, however i can't find any trace of a keylogger.

If anybody has any ideas of what this could be, id really appreciate suggestions. if the description is slightly vague i can go into more detail.

Any help would be hugely appreciated,

Thanks

juniormaven · 10-26-2008, 05:06 AM

are you using a wireless key board and or mouse?
is there a hidden camera in your house?
Do you use the same password for everything?
can anyone see in your windows?

whats your girlfriend say about it?

juniormaven · 10-26-2008, 10:47 AM

MSN hooks the keystroke and mouse messages that Windows sends to other programs. Like Zonealarm warned you, this allows it to see every key you press on other programs, and every mouse movement or click.

Yahoo Messenger, at least in previous versions a few years ago, did this (don't know about current versions, I presume it's still doing the same). I haven't analyzed what MSN does with the keystroke and mouse information, but I did analyze what Yahoo Messenger did. Yahoo Messenger hooked the keystroke and mouse messages by registering a DLL called idle.dll as a message listener for all processes (injecting the DLL into other processes). It used this information to keep track of how long you go without pressing a key or moving the mouse. Presumably, this was to implement the "automatically change my status to Idle/Away if I'm inactive for X minutes" feature. In particular, Yahoo Messenger did not record the actual keys you pressed, or where you were clicking. Only how long you went without pressing a key or moving the mouse.

I cannot speak for current versions of Yahoo Messenger, or for any version of MSN.

It is indeed possible to trace what MSN is doing, through several different ways. One rather verbose possibility is to debug the program while it runs with a debugger (e.g. a Windows port of GDB, or the Visual Studio debugger, etc). Another possibility is to trace filesystem activity while the program runs, so you see which files are being written to (using something like FileMon, by SysInternals). You may also want to monitor the process's activities, using something like Process Monitor, again by SysInternals.

If you identify the DLL which is being used to monitor the keystroke and mouse messages (in case they're using a DLL in the first place, which is likely) then you could disassemble the DLL (if that is legal in your country, I am not a lawyer).

You could also try to find a Windows equivalent of strace (there seems to be a Cygwin port of the utility).

10-25-2008, 05:36 PM	#1 (permalink)
bighands123 Registered User Join Date: Oct 2008 Posts: 1 OS: windows vista home	Apparent keylogger problem Ok, this is a long story, but it would appear I am in some way having my computer accessed. I have recently started at university, and my girlfriend, who i now live approx 100 miles from, has started to recieve messages over myspace from an anonymous character, making certain accusations about me. Without going into detail, there is enough evidence to show that this person lives here in the city where i go to university. Now, initially i assumed this person used the myspace search engine to find my girlfriend. However, the person doing this has managed to access my hotmail account, as well as both our myspace accounts. We frequently change our passwords to entirely unguessable ones, however this person continues to gain access to said accounts. I have spoken to a few people who have suggested that i might have a keylogger on my computer. i have scanned the computer with spybot, i use zonealarm with all the settings at max, however i can't find any trace of a keylogger. If anybody has any ideas of what this could be, id really appreciate suggestions. if the description is slightly vague i can go into more detail. Any help would be hugely appreciated, Thanks

10-26-2008, 05:06 AM	#2 (permalink)
juniormaven Registered User Join Date: Nov 2007 Posts: 4 OS: XP	Re: Apparent keylogger problem are you using a wireless key board and or mouse? is there a hidden camera in your house? Do you use the same password for everything? can anyone see in your windows? whats your girlfriend say about it?

10-26-2008, 10:47 AM	#3 (permalink)
juniormaven Registered User Join Date: Nov 2007 Posts: 4 OS: XP	Re: Apparent keylogger problem MSN hooks the keystroke and mouse messages that Windows sends to other programs. Like Zonealarm warned you, this allows it to see every key you press on other programs, and every mouse movement or click. Yahoo Messenger, at least in previous versions a few years ago, did this (don't know about current versions, I presume it's still doing the same). I haven't analyzed what MSN does with the keystroke and mouse information, but I did analyze what Yahoo Messenger did. Yahoo Messenger hooked the keystroke and mouse messages by registering a DLL called idle.dll as a message listener for all processes (injecting the DLL into other processes). It used this information to keep track of how long you go without pressing a key or moving the mouse. Presumably, this was to implement the "automatically change my status to Idle/Away if I'm inactive for X minutes" feature. In particular, Yahoo Messenger did not record the actual keys you pressed, or where you were clicking. Only how long you went without pressing a key or moving the mouse. I cannot speak for current versions of Yahoo Messenger, or for any version of MSN. It is indeed possible to trace what MSN is doing, through several different ways. One rather verbose possibility is to debug the program while it runs with a debugger (e.g. a Windows port of GDB, or the Visual Studio debugger, etc). Another possibility is to trace filesystem activity while the program runs, so you see which files are being written to (using something like FileMon, by SysInternals). You may also want to monitor the process's activities, using something like Process Monitor, again by SysInternals. If you identify the DLL which is being used to monitor the keystroke and mouse messages (in case they're using a DLL in the first place, which is likely) then you could disassemble the DLL (if that is legal in your country, I am not a lawyer). You could also try to find a Windows equivalent of strace (there seems to be a Cygwin port of the utility).