Hook detector

Posted on 2006-06-02
Last Modified: 2010-05-18

I need to know how can I find all keyboard hooks instaled on a computer and running.
I work on an application that should scan all running processes and find which one of them (or more) has a keyboard hook installed on Windows. It should be something like a keylogger detector.
Question by:bodrag
    LVL 28

    Accepted Solution

    that will be a hard thing to do considering the multiple ways one can do a keyboard hook (not talking about stealth and other hiding tehniques).
    maybe the best way would be to:
    - find all modules used by one process (dll's, ocx, etc)
    - scan the image of that module (the file) for calls to api hooks (by name and reference/address - for the latter you'll need to search either in the loaded module (in memory) or do an 'executable parser)

    this will be a pretty hard task and as far as I know, the success rate will still be under 90-95%.
    I'll give it a thought and get back to you if I get a better idea.
    LVL 11

    Expert Comment

    Are you looking for something like this?

    Author Comment

    No, Keylogger Hunter only make keyloggers to stop working correctly.
    I need a way to detect if a keylogger is running.
    LVL 5

    Expert Comment

    This is a daunting question, as some HOOKs that wish to remain hidden can be hidden...
    this site explains what i mean...

    Other wise ciuly's suggestion seems to be the best root for keyloggers that can be identified by file/name
    in the end a keylogger that wants to stay will stay until such time a proper and versitile anti-program is made.

    Peace Scay7

    P.S Never run a program that you are not 101% of its validity... (this is the first line of defence)
    LVL 6

    Assisted Solution

    The only documented way would be to install a WH_DEBUG hook. Otherwise you'd have to enumerate internal undocumented structures that are subject to change without notice. However, this worked quite well on Windows 9x, see MSINFO.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Suggested Solutions

    A lot of questions regard threads in Delphi.   One of the more specific questions is how to show progress of the thread.   Updating a progressbar from inside a thread is a mistake. A solution to this would be to send a synchronized message to the…
    Introduction The parallel port is a very commonly known port, it was widely used to connect a printer to the PC, if you look at the back of your computer, for those who don't have newer computers, there will be a port with 25 pins and a small print…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now