Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently found a program called KeyScrambler which appears to be a keyboard driver filter that intercepts keystrokes and jumbles them up for you so keyloggers aren't able to get your keystrokes while visiting your online banking sites.

I was wondering if there is a way to tell if KeyScrambler is always first in line for the keyboard driver filters or if another driver filter could be installed and intercept the keystrokes before it gets to KeyScrambler.

share|improve this question
    
anybody have any suggestions about this? –  Brian T Hannan Dec 2 '09 at 1:53
    
anybody, anybody, anybody? –  Brian T Hannan Dec 3 '09 at 17:47
    
While I cannot comment on the Windows specifics of this question, I don't think this will help you. There are probably many ways for a keylogger to hook into the system, and this is only one of them. Just face it: If malware makes it onto your computer, you're hosed. I fear it is futile to try such tricks to detect keylogging. –  sleske Feb 1 '11 at 23:25
    
@sleske Since KeyScrambler uses a kernel mode driver it is impossible for any keylogger to get in front of it unless you are dealing with a bad rootkit. –  user65705 Feb 1 '11 at 23:25
1  
@thishaxd: Again, I don't know much about Windows internals, but if KeyScrambler can do it, why could a Trojan/Rootkit not do it, too? –  sleske Feb 2 '11 at 1:38
show 1 more comment

2 Answers

I believe all the drivers for the keyboard can be found in the registry at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}

Under this key you'll find subkeys named "0000", "0001" etc.
Their numerical value defines the order of the loading of the drivers.

Since there are several kinds of keyboards (PS2, USB, Bluetooth), the above registry entry might not be the correct one in your case. In this case, just use regedit to search for "KeyScrambler" or the name of its executable file/dll, and you should find it.

share|improve this answer
add comment

Assuming you're on Windows, you can use Microsoft's devcon.exe to output information about a device stack. DevCon is a driver developer utility that is an alternative to the Device Manager GUI. Filter drivers can be included in the output.

devcon.exe is available here or in the Windows DDK. (The DDK was made for WinXP and Win2003; I believe devcon.exe is included in the current Windows Driver Kit). The utility is largely self-documenting; run devcon help to get started.

For example, this command shows me the devices and filters on my system in the keyboard class:

C:\> devcon stack =keyboard
ACPI\PNP0303\4&891F7F0&0
    Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
    Setup Class: {4D36E96B-E325-11CE-BFC1-08002BE10318} Keyboard
    Class upper filters:
        kbdclass
    Controlling service:
        i8042prt
HID\VID_15C2&PID_0042&MI_00&COL02\7&18C89C67&0&0001
    Name: HID Keyboard Device
    Setup Class: {4D36E96B-E325-11CE-BFC1-08002BE10318} Keyboard
    Class upper filters:
        kbdclass
    Controlling service:
        kbdhid
2 matching device(s) found.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.