• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 633
  • Last Modified:

Protecting Users from Keyloggers

Has anyone found an effective way to protect their networks from keylogging programs?  (Outside of preventing users from opening executable files.)  Are there any good shareware programs that specifically scan for keyloggers?  Spybot-like programs should protect against most keyloggers, right?  Do you guys consider keyloggers to be a considerable threat to network security?  (Their remote depoyment capabilites have me somewhat freaked. :)  

Thanks!!
0
meade470
Asked:
meade470
3 Solutions
 
luv2smileCommented:
I definately consider them a threat to network security as someone can see any information typed including passwords.  However, they are one of many possible threats out there today.

In general, start with basic security concepts: Run and keep updated antivirus software, use a firewall....look at both software firewalls and possibly hardware firewalls, use ad aware programs such as Ad-Aware and Spybot.

Here's an article on the topic:

https://ss.nus.edu.sg:9876/articles/Protecting%20yourself%20against%20KeyLoggers%20and%20Spyware%20in%20general.html

0
 
bbaoIT ConsultantCommented:
> Are there any good shareware programs that specifically scan for keyloggers?

i have no direct good suggestions on the specific scanner, but i think you can detect existence of such keylogging programs, by monitoring currently opening files. Sysinternals' FileMon is a good freeware for this. you may learn and download it at http://www.sysinternals.com/ntw2k/source/filemon.shtml.

after running FileMon, if a strange file is keeping opened all the time, it should be suspected as the data file of a keylogging program. you should study more on its host program which is opening the strange file.

anyway, there are some specific software available on the market, such as Anti-Keylogger 5.3, but who knows itself is not a spyware or even a keylogging software? hehe ;))

> Spybot-like programs should protect against most keyloggers, right?

not exact.

> Do you guys consider keyloggers to be a considerable threat to network security?

y. if the log has been sent to the malicious hackers, all the confidential information you inputted should be known by them. you know what it does mean!

> (Their remote depoyment capabilites have me somewhat freaked. :)

if your system is well patched and protected, the malicious guys can not deploy such a software on your system.

hope it helps,
bbao
0
 
knoxj81Commented:
Spybot will detect SOME, but won't prevent. As far as preventing you need a program to monitor registry, BHO's, and a good virus scanner as well as a firewall to detect inbound/outbound traffic. Here's a list of the best programs with some sites to use for research:

I would use these programs to help you prevent this from happening again:

Antivirus:
Kaspersky Antivirus 5.0 (new version) http://www.kaspersky.com/personal
This program is the best by far. It updates every 3 hours, scans web browser scripts also.
I've tested many other virus scanners through the years and this is by far the best.

AVG is also a great virus scanner (more for home user) not to mention they have a wonderful FREE edition.
http://www.grisoft.com/us/us_dwnl_free.php

Firewall:
Sygate Personal Firewall Pro - Compared to ZoneAlarm or Nortons which both have tons of exploits to drop their service like a fly. Sygate is the choice for a software firewall.

Sygate has a home editon for free as well.  www.sygate.com

Spyware/Adware/Malware/Dataware:
AD-AWARE - www.lavasoftusa.com
If you can afford it by the PRO version, the extra feature AD-WATCH is well worth it for it monitors your registry and notifies you of any changes made allowing you to ALLOW or REJECT the request on the fly.

RegistryProt 2.0 - http://www.diamondcs.com.au/index.php?page=regprot
This is a free program to monitor all changes to registry. This is a must in security for you windows machine. Big help in eliminating spyware, Trojans, backdoors, etc..

BHO Demon - www.majorgeeks.com/download3550.html  (mirrored)
This is a must now-a-days if your running Internet Explorer! BHO is used in a lot of the recent IE exploits as well as keyloggers. Windows XP SP2 offers something along these lines, but why trust M$.

IDS ( Intrusion Detection System ): - snort.org
I was reading my Windows & .NET Magazine, and it has a great article on SNORT. Setting it up and everything. Page 51! Or you can buy the book SNORT 2.1 Second Edition. This program is absolutly promising, this is for extreme paranoid users & advanced users.

References:
http://isc.sans.org/index.php?off=diary -Everyday info on the latest exploits/virus/security issues.
http://eeye.com - perfect for advisories and the best security software.
www.majorgeeks.com - Every program a nerd could think of!!
www.sygate.com – Great Software firewall.
www.kaspersky.com – Best AV on the market.
www.lavasoftusa.com – Best spyware removal program.
http://www.grisoft.com – Wonderful FREE AV.


Good Luck,

Jorden
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
meade470Author Commented:
Thanks, guys.  These are all great responses.  I'm new to this site--can I award points to all of you for answering, or do I have to choose only one?
0
 
bbaoIT ConsultantCommented:
just click the link of "Question and Answer tips", specifically, please go to http://www.experts-exchange.com/Security/help.jsp#hi19 for how to split the points.
0
 
Yaroslav_BuzkoCommented:
Just a hint: I'd advise you use some app to monitor active processes and kill/report everything not explicitly permitted. This way you'll also avoid users running games and other crap. :)
0
 
meade470Author Commented:
Thanks, guys!  Great site!  I'll see ya around ;)
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now