topic Re: Question about Keylogger detection in Norton Internet Security / Norton AntiVirus

Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 17:47:30 GMT

i have a short Question to Symantec Employees

Why NIS do not detect this Keylogging Activity with Settingschange Firewall -> Program Control from automatic to manual ON.

Key-Logger Simulation Test Program

http://www.zemana.com/list/list.aspx?ktgr_id=423

if you start this keylogger and write Words into a Notepad , NIS detect nothing.

thank for your Answer

Re: Question about Keylogger detection

huwyngr — Sun, 08 Mar 2009 21:11:20 GMT

To help get a useful reply:

What version of WIndows are you using including Service Packs and whether 32 bit or 64 bit? If this is not a USA/CAN version what country is it localized for?

What version of NIS are you using -- check Help / About for the Version ID nn.nn.nn.nn

How did you get your NIS -- download from Symantec/Digital River or on a retail CD? If so is it localized for the same country as your Windows? Giving the downloaded filename, if that is what you used, should indicate this.

Re: Question about Keylogger detection

delphinium — Sun, 08 Mar 2009 21:25:06 GMT

Hi Hugh:

I ran the application provided by Voyager 10 as well. Same results. Nada.

XP sp 3 32 bit. NIS2009 installed from disc. In Canada. Version still 16.2.0.7. No idea how the application works or if the test is valid. Would need some kind of response from someone else to determine validity.

Edit for log info. No history of any kind in NIS logs.

Message Edited by delphinium on 03-08-2009 02:25 PM

Re: Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 21:31:24 GMT

@ huwyngr

Sorry i think that has nothing to do with this Keylogger Demo and this key-logging detection on NIS09 .

if you want say something about this Topic please check this Demo with your NIS09 and give your Detection Result , thanks.

Message Edited by Voyager10 on 03-08-2009 02:31 PM

Re: Question about Keylogger detection

delphinium — Sun, 08 Mar 2009 21:28:44 GMT

Actually, it will give Symantec the ability to compare differences should other results be available. If you have the newest update, and I don't, that still tells us something about the lack of Norton response. I fwe get a positive reult from one of the other posters, there will be more info to find out why.

Re: Question about Keylogger detection

huwyngr — Sun, 08 Mar 2009 21:32:12 GMT

Thanks for the helpful replies ....

Re: Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 21:38:47 GMT

Your Replie also not helpful , Norton do not detect this Keylogging Activity with this Demo Program (Automatic or Manuel Program Control - Firewall settings) . i have a current version NIS09 16.2 .

Let us wait what symantec would like to say.

Re: Question about Keylogger detection

huwyngr — Sun, 08 Mar 2009 21:56:36 GMT

Now that you (and Delphinium) have given some more basic information there is a better chance of doing so although these are in fact Peer to Peer forums with users helping users.

I have spent a large part of my life troubleshooting so I know very well the importance of getting basic facts first. Next time someone here asks you for more information I suggest you give it regardless of what you think.

<< i have a current version NIS09 16.2 . >>

That does not identify the version you have [nn.nn.nn.nnn is the format] but one of several and not the current one which is in distribution but has not reached everyone yet.

You also have not answered the question about localization.

You could also helpfully follow the submission procedure in How to troubleshoot a suspected Malware infection

Re: Question about Keylogger detection

Phil_D — Sun, 08 Mar 2009 22:21:04 GMT

Since Zemana is promoting and selling their own "AntiLogger" on the same site (at a ridiculously high price) I would have my doubts about the independent validity of this test.

Re: Question about Keylogger detection

dbrisendine — Sun, 08 Mar 2009 22:23:29 GMT

Ran test from web link; got same results. However, this may just be because this is what the program does and it did not try and send anything through the firewall. Also, waht were everyone else's settings? Under Inetrnet Settings > Smart Firewall > Advanced Program Control mine was set to ON. Anyone test this with this OFF and the Advanced Event Monitoring ON?

PS - Agree with Phil_D.

Message Edited by dbrisendine on 03-08-2009 06:23 PM

Re: Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 22:27:17 GMT

@ huwyngr

You have not a different Detection Result with this Demo ? you know that has nothing to do with Malware Infection ? i know my english is not perfect but Delphinium understand my words.

The Fact is NIS09 do not detect this keylogging activity , why do you think this may be to a retail-version , system or language? you want to say a trial version has no keylogger detection , please explain ;)

Delphinium have a Result , in Germany we discuss this have also the same a Result , believe me this has nothing to do with your basic facts.

@ dbrisendine

"Anyone test this with this OFF and the Advanced Event Monitoring ON?"

thats the interesting , also no recognition

Message Edited by Voyager10 on 03-08-2009 03:27 PM

Re: Question about Keylogger detection

Phil_D — Sun, 08 Mar 2009 22:31:11 GMT

What I am saying is that I would not trust a "test" from a company who is trying to sell me a program specifically designed to protect against the "supposed results" of that test.

I didn't have any results because I won't even bother to download such a test for the reasons mentioned above.

Re: Question about Keylogger detection

dbrisendine — Sun, 08 Mar 2009 22:33:15 GMT

Ran file through Virus Total and others; NOT an active keylogger. Case Closed.

Re: Question about Keylogger detection

Phil_D — Sun, 08 Mar 2009 22:39:15 GMT

Thank you for taking the time to research that, dbrisendine.

Much appreciated!

Re: Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 22:46:06 GMT

@Phil_D

I agree with you but there must a statement of why Norton nothing detects (Advanced Event Monitoring ON) when I start the demo and write words into the Notepad. Thats all i want to know. It would be nice if someone writes about the Topic.

@dbrisendine

hmm ? ;) This is a Simulation Program or so , not Malware.

Re: Question about Keylogger detection

huwyngr — Sun, 08 Mar 2009 23:13:21 GMT

Voyager10 wrote:
@ huwyngr

You have not a different Detection Result with this Demo ? you know that has nothing to do with Malware Infection ?

[ ... ]

I have no reason to test it. I don't doubt your report and that of others that NIS 2009 does not detect it. Any Keylogger not installed by the user is Malware by any definition I know about.

My only purpose in this thread is to make sure that enough information is provided to identify variables. That is what it would be pleasant if you would accept and stop fighting against it. It has nothing to do with your English -- my German is surely worse since although I can ask the way to the Railway Station I rarely understand the answer <s>) but with localization of products which has been shown here in these forums to trigger problems when there is a mismatch

Basic facts have everything to do with troubleshooting especially when you ask "Why" and the fact that it happens and is being discussed elsewhere has nothing to do with answering your question "Why does NIS not detect it?" That does require basic facts.

I hope you find your answer and learn from your experience.

Re: Question about Keylogger detection

Voyager10 — Sun, 08 Mar 2009 23:47:57 GMT

@huwyngr

Why you write in this Topic if you do not know what we talk about ? ;)

i can show you a Picture if you are really interest to know.

http://img19.imageshack.us/my.php?image=96803982.jpg

this Picture show a Simulation Program what can logging keyboard input , that has nothing to do with your basic facts (Retail , Trial or Servicepack-Language?!) . NIS09 do not detect this (on all systems , users and languages) , It should give a statement for this.

if you dont want to check this or write about the Topic than Thanks and bye...

Message Edited by Voyager10 on 03-08-2009 04:47 PM

Re: Question about Keylogger detection

huwyngr — Sun, 08 Mar 2009 23:50:34 GMT

dbrisendine wrote:
Ran file through Virus Total and others; NOT an active keylogger. Case Closed.

Many thanks -- given the reaction so far I decided not to even suggest that it might not be working!

If you have the patience perhaps submit it to threatexpert and symantec via the links I gave and see what they report.