Tutorial: Manually scanning a file for any keyloggers

[Rshopper]

This is my best tutorial so far. Enjoy.
You will need 2 files for it.

First is the sample "Virus" we will be scanning in this tutorial. Don't worry, its harmless. Its only purpose is to make this tutorial more hands-on.
http://uploadtemple.com/view.php/1171412557.zip

Second you will need a program called FileAlyzer. Get it from here. It also used to come in older versions of SB Search and Destroy.
http://www.safer-networking.org/files/filealyz.exe

Here is the tutorial. Enjoy.
http://runeportal.110mb.com/logger_tut/

Comments welcome.

BTW: The RunePortal project is dead (very sad, i had no time to finish it...), so don't ask...

 

[Andrew]

Looks great.

I prefer http://virusscan.jotti.org/ though. >_>

 

[Rshopper]

It can't find everything lol, especially not custom made loggers.

 

[burn223]

they should also get mcafee best antivirus finder ever and keylogger when a file has a trojan boom got it

 

[Rshopper]

Again, this does not help against custom loggers.

 

[Covey]

not hard to make a keylogger that virus scanners can't pick up =\

 

[Rshopper]

My Point exactly.

 

[The End]

im pretty sure the API monitor at http://www.rohitab.com/ will do the same thing intended here

 

[Rshopper]

Any debugger or program that supports signature detection, hex dump, and string search could do this. However, I've used a lot and still find FileAlyzer the easiest to use.

 

[DuffMan1020]

Nice tut man.

You have been Accepted for a User educator.

Nice job XD

 

[Masterfaizy]

Looks great.

I prefer http://virusscan.jotti.org/ though. >_>

Obselete. try http://www.virustotal.com

 

[Daily]

Virustotal is SOO slow..

I still prefer jotti.

 

[V--own4g3--V]

not hard to make a keylogger that virus scanners can't pick up =\

You would know, scammer..

 

[astanin]

cant get the keylogger out now lol

 

[pures own you]

nice tut man, dont pay eny attention to those who are simi flaming, very helpful

 

[Sephiroth]

nice tutrshopper. god luckwith scanning em XD

 

[magi]

cool thanks

 

[Rshopper]

You would know, scammer..

He's not a scammer, I don't believe it.. :'(

cool thanks

Whoa... I though you were banned, guess not...

Or welcome back if you were, I don't remember.

 

[Personal Jesus]

You don't even know me. Who the fuck are you to judge me?



Whoa... I though you were banned, guess not...

Or welcome back if you were, I don't remember.

He wasn't quoting you dude, he were quoting Covey - whom also got banned, so I guess he was right.

 

[Rshopper]

Right, I see my mistake now, sorry..

/me confused..