Slashdot Mirror
Anti-Keylogging Recommendations?
BeeazleBub writes "A friend asked me about the best programs to detect and remove spyware/logging/monitoring software that might have been placed on her computer by a spouse. Since there are a plethora of good and bad programs out there, I thought I would ask the slashdot crew for their recommendations. What is simple, reliable and most effective? I'm sure some of you have had the same question or circumstance. (No, booting from a Linux CD is not an option for this user)."
Too true.
Nowadays, if you need a "trusted" computer, think about getting a Mac Airbook that you can slip into a folder in a filing cabinet when not in use, or keep with you all the time.
Using a laptop raises the hurdle for installing a hardware keylogger (they're usually just dongles that sit between the keyboard and the computer), and using OS X should raise the bar a bit to install malware (not that it doesn't exist, it just might be more difficult to find, and navigating in OS X will be more challenging for a user not use to it).
Using a small footprint laptop (like the Air), means you can hide it "in plain site", or in a place you can ensure physical control over (although personal control trumps al others for security).
Realize that unless you're using encrypted protocols to browse web sites or send/receive email, your traffic could still be intercepted on the network, but that again requires a more sophisticated user than the average "Spouse who installed a keylogger".
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Most people are assuming that the spouse resides in the same residence. If the spouse is already out of the house due to separation, and is possibly using spyware/hardware to collect information for blackmail or court, then there is the option of having someone over to purge the system and visually inspect it.
Any networking hardware like routers that could be compromised would need to be replaced or reflashed. Since she doesn't have the capability of dealing with a boot CD, her only option is third party intervention or going to the library to use their computers.
We're missing too much info...
How tech savvy is the spouse? Does he still live there? What kind of network setup is being used? etc. etc.
If she takes the computer in for repair with claims if running slow and suspect being the target of a directed attack, then that can be used as evidence.
If joe schmoe guy who is her friend does the same, the court would most likely ignore or strike that evidence out, and also gives the husband an attack vector by claiming this guy planted it to undermine their marriage or trying to get into her pants, which would not only have the evidence thrown out, but look worse for her own case.
Sadly, this service will be expensive. You can't really trust best buy or geek squad to not just glaze their eyes over at your description, hear only 'virus', and just format the machine and reinstall.
Now, if she just wants the keylogger gone, this is a good solution. However for gathering evidence, it is disastrous.
The problem is the poster never mentioned their intentions. The way to go about doing this is VASTLY different depending on if they want to find and prove its there, or just get rid of it.
Either way, your and the GP's comments are spot on. There isn't a technical solution to a social problem.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
You missed a few points. He could access non encrypted partitions by booting off a CD (And get files, browser history et cetera). He could have added a compromised DNS server. If he's technically skilled enough he could have done any number of things.
Few well probably read this now but i think it might work. First get a new keyboard and glue its screws. Then reinstall windows, lock down bios with a password and disable booting from anything but the hard drive. Then install windows steadystate. Its like reapplying a ghosted image each time she reboots, so no changes can be permanently made to c: unless the admin specifically allows them to be made permanent such as after an update. Give her a limited user account. Hopefully you can also lock the case and/or enable a case open warning from the bios. Nothings perfect but i think this is a decent approach.