Tools to sniff out keyloggers?

S

Saulyx

Junior Member

Jan 10, 2010

107

5

• Jul 15, 2012

• #1

Hi there,

So i'm looking for tools to back track key loggers, especially the ones that send logs via SMTP and IMAP.

I am already using Cian&Abel to track down FTP data, however it's not working that well with mail stuff. As for wireshark - it's a bit tricky, could someone recommend something good?


Thanks

 

Techxan

Elite Member

Dec 7, 2011

3,091

3,620

• Jul 15, 2012

• #2

e-scan for windows anti virus, it will get hem and remove them.

 

S

Saulyx

Junior Member

Jan 10, 2010

107

5

• Jul 15, 2012
• Thread Starter Thread Starter

• #3

Removing them isn't really what I'm after, I'm after tracking down where my logs are being passed to

 

unknownymous

Regular Member

Jan 22, 2012

272

144

• Jul 15, 2012

• #4

New UD keylogger are used/distributed every 3 months. The best way to solve it is:

Reformat your PC Then install eset nod32 or any good AV.
That will rid off any shit in your system.


For tracking the the receiver email or FTP used by hack3r ..Hmmm.. I forgot it anyway.

 

Last edited: Jul 15, 2012

S

Saulyx

Junior Member

Jan 10, 2010

107

5

• Jul 15, 2012
• Thread Starter Thread Starter

• #5

Getting rid of it is not my problem, tracking it down is what i'm after, it's not spinning on my main frame anyway

 

cool0403

BANNED

Dec 29, 2008

564

726

• Jul 15, 2012

• #6

One tool that has always worked for me much better than any vmware or sandbox is to use procmon. It monitors registry,file,processes, threads etc

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
I use it all the time to actually see what exe's do when i find them suspicious.

 

C

csguy

BANNED

Jul 13, 2012

396

43

• Jul 15, 2012

• #7

Look for an smtp sniffer.

 

Tsongkie

Regular Member

Dec 22, 2006

207

149

• Jul 15, 2012

• #8

A network monitor for smtp traffic will do the trick. Also check your http requests with a tool like http analyzer.

 

dannyduberstein

Regular Member

Nov 1, 2011

214

117

• Jul 15, 2012

• #9

vmware + wireshark

check out this book "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" it has a pretty good run down on analyzing malware

here is a pdf:

http://filepost.com/files/7am8a85c/Practical_Malware_Analysis.pdf/

good luck.

 

m0r0n

Registered Member

Jun 13, 2011

76

56

• Jul 15, 2012

• #10

Just run everything in sandbox 1st and watch for the thing its installing,
for semi manual av program i prefer unhackme + sysinternal suite + unlocker (no fud thing can bypass your brain)

 

C

csguy

BANNED

Jul 13, 2012

396

43

• Jul 15, 2012

• #11

I use httpscoop for http traffic on mac.