From the course: Windows Performance Toolkit: Spyware Detection
Unlock the full course today
Join today to access over 22,400 courses taught by industry experts or purchase this course individually.
Finding the keylogger hooks, part 2 - Windows Tutorial
From the course: Windows Performance Toolkit: Spyware Detection
Finding the keylogger hooks, part 2
- We have narrowed our search for the keylogger. We now need to find the evidence that we were indeed being recorded by inspecting the call stacks of the threads that belong to these processes. We're looking for calls to anything related to hooks and KBDLLHOOKSTRUCT. So let's start inspecting. Let's go from top to bottom. Let's click on the drop-down arrow for svchost. We will now see the thread's New Thread Id column and if we will look at the graph, we see that only one thread is active the entire time we are keypressing in Notepad. Thread Id 420 is the only one that comes in and is active while we are pressing and holding down a button in Notepad. So let's click on the drop-down arrow button next to [Root] and inspect the thread stack for this thread. We can see a User GetMessage call but if we look at the UserCallbackDispatcher this should give us the name of the callback procedure. So let's click on the arrow next to UserCallbackDispatcher and bingo, look at that…
Practice while you learn with exercise files
Download the files the instructor uses to teach the course. Follow along and learn by watching, listening and practicing.
Contents
-
-
-
Looking at a keylogger4m 6s
-
Looking at the keylogger source code, part 14m 45s
-
Looking at the keylogger source code, part 24m 44s
-
Looking at the keylogger source code, part 34m 57s
-
Gathering keylogger evidence setup1m 55s
-
Gathering keylogger evidence4m 23s
-
WPA and symbol loading1m 49s
-
Finding the keylogger hooks, part 13m 12s
-
Finding the keylogger hooks, part 23m 13s
-
Finding the keylogger hooks, part 33m 27s
-
Finding the keylogger hooks, part 44m 41s
-
Finding the keylogger hooks, part 51m 51s
-
Keylogger deletion2m 36s
-
-