Key Logger sniffer
 

Hello All,

I was wondering is there a program that I can see if there is a key logger program installed. I know it is on my machine but it does not show up in the services. Does anybody know of a way to see what it is. Thanks for your help.:confused:

Would you mind playing a bit with lsof and see what's opened on your system and what files are being used ?
A good start would be to just type 'lsof' and put the command output into a file for later examination

lsof will show up the command name, pid, user running as, and several other infos alongside the file names a process is accessing while running. Play with it, it's a nifty tool

Regards
Andy

Perhaps it is masquarading as a legitimate service? That is most likely the case...you won't see 'keylogger' showing in a process list, for example.

Keyloggers need to run stealthily and access hardware, so under GNU/Linux that shouldn't be userspace apps (unprivileged aka ring 3 mode) but LKM's (kernel aka ring 0). Shouldn't be hard to find tools to interrogate and/or verify kernel and module integrity. Booting a Live CD and running the tools from there is your best option since this will boot a (presumably) untainted kernel.

How do you know that? what are the evidences of that? Someone told you? someone showed it to you?