# detecting a key logger **URL:** \ **Category:** Factual Questions\ **Created:** [August 9, 2003, 12:58am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953 "2003-08-09T00:58:37Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Micro\_Furry](https://avatars.discourse-cdn.com/v4/letter/m/77aa72/32.png) [@Micro\_Furry](https://boards.straightdope.com/u/Micro_Furry)\ **Post date:** [August 9, 2003, 12:58am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/1 "2003-08-09T00:58:37Z")
Okay, that’s weird, no text, let’s try again… This maybe isn’t the typical kind of question that gets asked here but this message board still has the highest concentration of smart people that I know of, so here goes. (BTW, I already tried a board Search for this using the words “key log,” in case this has already been answered, but the rather asinine search refuses to accept words shorter than 4 letters, and the words “logging” and “logger” have no hits, sooo…) My father is in a union. He does have a laptop which he mainly uses for union business, but he’s worried about the possibility that there might be key logging software installed on his computers at work, which could compromise their lawsuit by allowing the people they are sueing access to private correspondence. He wants to know how he can determine whether such software is in place. I’m at a loss. I know that these programs frequently can hide themselves from the Ctrl-Alt-Del task manager and from the Alt-Tab process list. I have considered telling him how to use the built-in windows utility **msconfig** to look at the programs the computer is loading up at startup, but… A) He’s not computer literate generally, other than stuff that makes the news. I’m not sure he’d fully comprehend the list of what he was seeing and understand what could be safely disabled. B) I’m not sure if this utility would be considered illicit hacking or the like, and so whether it would be a good idea to use it at all. On the other hand, it’s preferable to going directly into the Registry. Likewise, I am trying to avoid programs that would have to be downloaded and installed, especially those that have to be purchased. I just need to know if there is some simple way to detect the presence of these programs; or if not, if msconfig is okay to use to check for this stuff. (If it matters, it’s a government agency - a state Department of Corrections.) If anyone can give any advice here, it’d definitely be appreciated. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [August 9, 2003, 1:21am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/2 "2003-08-09T01:21:27Z")
If your father is concerned about the company he works for logging his keystrokes then he’s out of luck, since they have every right to. If he’s concerned about someone _outside_ of the company looging keystrokes, he really ought to to let his company’s IT department handle it. In any case, I really need to know who owns the computers in question and a bit more about the stuation before I’ll attempt to answer. ---
**Author:** ![Reeder](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Reeder](https://boards.straightdope.com/u/Reeder)\ **Post date:** [August 9, 2003, 1:35am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/3 "2003-08-09T01:35:29Z")
I have no idea as to your question but I can help you with your search…use a wild card. Thus key becomes key\* and log becomes log\*. ---
**Author:** ![Clu](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Clu](https://boards.straightdope.com/u/Clu)\ **Post date:** [August 9, 2003, 2:16am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/4 "2003-08-09T02:16:20Z")
Do a search for various keylogger S/W packages on the net. Note how these products advertise their stealth. Best advice I can offer. This area of computing was never my expertise. ---
**Author:** ![maleinblack](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@maleinblack](https://boards.straightdope.com/u/maleinblack)\ **Post date:** [August 9, 2003, 4:21am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/5 "2003-08-09T04:21:19Z")
I know a software caled "[iOpus Starr](http://www.iopus.com) " which is used for key logging activities. From use I can tell you this very very good and there is absolutely no way to detect its presence.It doesnt show in ctrl+alt+del or in msconfig, not even in DOS.IIRC the only way to see if it is installed is to go to Start\>Run\>starrcfg If the software is installed it shows up. Bad news is that it can be installed over a lan by the admin and the users will never know about it. So you could try this. ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [August 9, 2003, 4:22am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/6 "2003-08-09T04:22:38Z")
Difficult to detect and looking at msconfig is _not_ going to help you as typical KL program loading occurs prior to and outside of MS config listnigs. See [Detect Keystoke Logging Software and Removal Instructions](http://itim.tamu.edu/htmlfs/keystrokelogging.shtml) or [Detect, delete / remove keylogger, trojan or other spy software on your PC - free download! Detect keystroke spy](http://users6.cgiforme.com/ciberpol/messages/715.html) or [Keylogger Killer 1.0](http://www.spychecker.com/program/keyloggerkiller.html) Also see this thread [Why no good deed goes unpunished](http://boards.straightdope.com/sdmb/showthread.php?s=&threadid=165318&highlight=deed) ---
**Author:** ![Ranger](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@Ranger](https://boards.straightdope.com/u/Ranger)\ **Post date:** [August 9, 2003, 4:42am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/7 "2003-08-09T04:42:29Z")
The freeware program Spybot - Search and Destroy can detect and remove many keylogger programs. If the computer in question is company property, one might want to think twice before altering it’s programming. ---
**Author:** ![Micro\_Furry](https://avatars.discourse-cdn.com/v4/letter/m/77aa72/32.png) [@Micro\_Furry](https://boards.straightdope.com/u/Micro_Furry)\ **Post date:** [August 9, 2003, 4:55am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/8 "2003-08-09T04:55:06Z")
Thanks for the information. Especially thanks for all the links, **astro**. ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [August 9, 2003, 7:07am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/9 "2003-08-09T07:07:23Z")
> [@](#): > > \*Originally posted by Reeder \* > \*\*I have no idea as to your question but I can help you with your search…use a wild card. > > Thus key becomes key\* and log becomes log\*. \*\* This will _not_ work. Wildcards won’t work with three letter words using the SDMB search function. Haj ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [August 9, 2003, 7:16am UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/10 "2003-08-09T07:16:35Z")
It would appear that they do - I’ve used wildcards to search for threads where I’ve been mentioned. ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [August 9, 2003, 3:29pm UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/11 "2003-08-09T15:29:46Z")
> [@](#): > > \*Originally posted by qts \* > \*\*It would appear that they do - I’ve used wildcards to search for threads where I’ve been mentioned. \*\* No. It would work if there was something after the qts like a comma or a period. You won’t be able to find this post. Haj ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [August 9, 2003, 3:31pm UTC](https://boards.straightdope.com/t/detecting-a-key-logger/193953/12 "2003-08-09T15:31:39Z")
…but you will find this one, qts. Haj