Find out who’s doing what on your computer

Scott dunn By Scott Dunn

Are your kids visiting sites you disapprove of, or is your schnauzer making unauthorized purchases of doggie biscuits on eBay?

To answer these and other questions about the activity on your PC, keyloggers provide a silent way of monitoring and capturing information about a computer’s use.

Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

PC Drive Maintenance (Excerpt)

Subscribe and get our monthly bonuses - free!

Your hard drives store photos, books, music and film libraries, letters, financial documents and so on. This ebook is aimed at helping you understand your hard drives, expand their capacities and length of life, and recover what you can from them when they fail. We're offering you a FREE Excerpt! Get this excerpt and other 4 bonuses if you subscribe FREE now!



Keylogger programs sit quietly and invisibly in the background of the system you install them on. The software records all the keystrokes — and, in some cases, mouse clicks — users make. They also monitor the programs those keys are typed into, along with other information about the machine’s activity. Table 1 shows the most important features and which programs support them.

Table 1. Keyloggers vary in crucial features. (• = yes)

Feature Perfect
Keylogger
Lite

Perfect
Keylogger

Keylogger
Pro

Keylogger
Spy
Monitor

Silent
Logger

Displays a warning to the PC’s users
 — 


 — 

Monitors specific Windows user accounts
 — 
 — 

 — 
 — 
Disables Windows features
 — 
 — 

 — 
 — 
Captures screenshots automatically
 — 


 — 

Records IM chats
 — 


 — 

Compresses and password-protects e-mailed logs
 — 




Deletes logs after mailing
 — 
 — 


 — 
Uploads logs to ftp servers
 — 

 — 

 — 
Excludes system keys from logs
 — 


 — 
 — 
Encrypts logs


 — 
 — 
 — 
Sends alerts when specified words are used
 — 

 — 
 — 
 — 
Offers built-in scheduling
 — 
 — 


 — 
Sets processor priority
 — 
 — 

 — 
 — 


All the keyloggers I examined (except Keylogger Spy Monitor and the free version of Perfect Keylogger) let you capture screens at designated intervals. This means you can see whatever the user was seeing on the screen at that moment.

The products vary in their ability to hide themselves. Many keyloggers give you the option to keep them off your list of Start menu shortcuts and out of Windows’ Add or Remove Programs list (Vista calls this Control Panel applet Programs and Settings.) Unfortunately, this usually makes it difficult to uninstall the application.

You can still find the program in Windows Explorer and run its uninstaller there — provided you choose the option to include an uninstaller during the program’s installation. In theory, keeping an uninstaller off your disk makes it harder for the target user to eliminate the keylogger.

None of products I reviewed has a foolproof solution for hiding its files in Windows Explorer. Perfect Keylogger’s installation routine, however, does let you rename the executables to any name you want, so they’ll be harder for users to spot.

Most keyloggers also hide themselves from the list of applications in Windows’ Task Manager. Keylogger Pro and both the free and paid versions of Perfect Keylogger also keep the executable from appearing under Task Manager’s Processes tab.

If you’re concerned that your PC might be spied on, you can use the fact that none of these programs successfully hide their running executables from Microsoft’s free Process Explorer utility. Unfortunately, the correct company name or description seldom appears in the Process Explorer listing, so to spot one of these spies in Process Explorer, you may need to know the name of the keylogger’s executable.

I expected the programs’ logs to be easy to decipher, but this wasn’t always the case. Each keylogger seems to take its own approach to logging the activity it records. All of the programs except the free version of Perfect Keylogger show system (non-character) keys in their logs. This is useful if you want to see whether the user typed the Backspace key a few times to delete something in a chat window before actually sending it along, for example. Unfortunately, recording all such keys makes the logs tough to read.

As a solution, Perfect Keylogger lets you choose whether to include non-character keys in its logs. Keylogger Pro’s approach to system keys is less elegant: you have to toggle the display based on the log selection, so it’s not permanently on or off. Oddly, Keylogger Pro has no option to include system keys when exporting the entire log to HTML.

Perfect Keylogger’s free version doesn’t include system keys in its activity logs; the remaining programs I tested always include non-character keys in their logs.

In addition to capturing outgoing keystrokes, Perfect Keylogger and Silent Logger record both sides of chats conducted in popular IM clients. Keylogger Spy Monitor does not record chats, but the developer sells other products designed for this purpose.

#1: BLAZINGTOOLS PERFECT KEYLOGGER
$35 version
76
Free version
69
More info
Feature-rich keystroke recorder spots passwords

Perfect Keylogger lives up to its name by offering a bevy of useful features that you won’t find in other such programs. For example, Perfect Keylogger is the only program I tested that automatically zips and password-protects logs that it sends to you via e-mail. You can also choose to encrypt the log so that it’s viewable only via the program’s built-in log viewer.

This is also the only keylogger I tried that you can install remotely, unless you’re willing to spring for the U.S. $83 Silent Logger Plus Remote-Install Edition, which I didn’t test.

BlazingTools perfect keylogger
Figure 1. Perfect Keylogger lets you choose whether to include non-character keys in its logs.

While all of the keyloggers I tried are adept at capturing passwords, Perfect Keylogger goes them one better by identifying and labeling the passwords it records. Without such labels, it’s difficult to know whether a random word or phrase typed in a given window is actually a password.

Perfect Keylogger’s free Lite version lacks most of the paid edition’s features. The company sells an intermediate $25 version, whose feature set falls somewhere in the middle; I didn’t test that version. A table on the company’s site lists differences among the three releases.

Despite the claims at the Perfect Keylogger site, I was unable to find a link to the free version there. Fortunately, you can still download it from a Tucows page.

#2: EXPLOREANYWHERE KEYLOGGER PRO
$40 version
67
More info
Key flaws prevent a good product from being great

Keylogger Pro is an impressive keylogging tool that offers lots of options in its easy-to-use tabbed dialog box. The program even sports a few features not found in other keylogging apps.

For example, Keylogger Pro is the only program I looked at that lets you designate which user accounts to monitor. In addition, you can disable Task Manager, Safe Mode, Startup programs, and other Windows components that could interfere with the tool’s operations.

This is also the only keylogger in this bunch that lets you set the priority for use of processor time, so the program doesn’t slow down the apps being monitored.

Keylogger Pro’s logs are easy to read, although they have a couple of quirks. For example, when you select individual log items, you can export to the text format only. If you export the entire log, however, you’re forced to export to the HTML format.

Even though I like this program a lot, it suffers from some serious problems. Although Keylogger Pro supports e-mailing of logs, I couldn’t get this feature to work.

Another problem is that the utility has not been updated to work with Vista. It appears to run under Vista, but in my testing, the OS repeatedly warned me that a suspect program was running, which ruins any chance of operating Keylogger Pro in secrecy. In addition, I consistently got an error message (“Win32cfg has stopped working”) each time I shut down the program in Vista.

#3: EMATRIXSOFT KEYLOGGER SPY MONITOR
$40 version
65
More info
A so-so keylogger offers little to recommend

Another keylogging contender is Keylogger Spy Monitor from eMatrixSoft, a company that sells many other monitoring products intended to satisfy all your spying needs. Keylogger Spy Monitor is a competent performer that offers nothing in particular to recommend it over the two top-rated products.

Keylogger Spy Monitor joins Keylogger Pro as the only two programs in this roundup that include their own built-in scheduling. It’s easy to set up the program, and its monitoring capabilities are on par with the other keylogging apps I tested.

Like most of the programs in this group, Keylogger Spy Monitor’s log is reasonably well organized. The log presents information in a table that notes the time, user, and window in which the data was captured. There’s no option for filtering out system keys, so IM chats and e-mails are difficult to spot due to the numerous Shift, Backspace, and other non-character keys that are mixed in with the text.

While there’s nothing wrong with this product, it’s no better than its competitors and priced about the same. That’s why you’re better off with a product such as my top choice, Perfect Keylogger.

#4: SILENT LOGGER
$45 version
60
More info
This keylogger is silent in all the wrong ways

Of the keylogging programs I tested, Silent Logger was the most frustrating. By default, the program is installed without telling you its default password or the hotkeys that will display its otherwise-hidden settings. Silent Logger also ships without any information about its user manual, which is available online only.

To find the password and other settings, I had to contact the company’s tech support by e-mail. Fortunately, the support staffers were prompt in providing the information I needed, including a link to the program’s online manual.

This is a decidedly odd and frustrating way to get started. Other programs simply ask you to assign a password and hotkey during installation or initial setup.

Before it will run on your PC, Silent Logger must register itself at the company’s site. In theory, this happens with no user interaction. For some reason, my purchased copy failed to register even though I tried to install it on two different machines and turned off my firewall in each case. I contacted tech support about the problem but never received a reply.

As a result, I was not able to test the program’s main function of keylogging nor see what kind of log it produced.

I was able to try out the settings dialog box. There I tried to set up Silent Logger to e-mail its logs to me. But like Keylogger Pro, the test message from the e-mail setup dialog reported failure, so this feature was a bust as well.

Like the other keyloggers I tried, Silent Logger has some features for hiding itself from the subject of your spying. However, the program failed to hide its executable from Task Manager’s Processes tab.

Silent Logger was the most expensive and least usable program of those I tested. If you need a good keylogger, I recommend you go with the $35 version of Perfect Keylogger.

Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here’s How section of that magazine.
= Paid content

All Windows Secrets articles posted on 2008-10-09: