I suspect a keylogger on a client's PC, but cannot isolate it. My fear is that this keylogger transmits data outbound to an indeterminate location.
So I am seeking a tool which may allow me to look at any outbound activity, and then isolate destinations and take it from there.
Time is of the essence, so I only have a limited time to familiarize myself with a tool.
Will Wireshark address my needs? Thanks!
asked 29 Jan '11, 12:34
Yes, Wireshark can help but depending on the usage pattern of the PC it can be difficult to determine which traffic is harmless and which is malicious.
This is what I would do if I suspect a keylogger transmitting data:
BTW, if you suspect a keylogger you should also check the PC for physical dongles - nobody checks the back of the PC for PS/2 or USB keyloggers in hardware unless it's a notebook ;-)
answered 30 Jan '11, 05:19
Well, it may. You'll have to be prepared to chew on some raw data packets, the keylogger most likely tries to conceal its communications. Still Wireshark should show them, and allows some higher level view on the connections. Take a stroll through the User's Guide to get an idea what's possible.
answered 30 Jan '11, 05:09
What's type of protocol that keylog using to tranfer file outbound my PC? I used wireshark but couldn't find smtp or ftp protocol :(
answered 02 Apr, 20:41
Trần Thành Đức