From the doc: KeySaveFeaturesLogs all keys pressed by user along with key combinations. Once installed, KeySave is completely invisible. It does not show any message while starting up. In Win 9x, it is even invisible in the list. Besides keys, it also logs the caption of the foreground windows in which keys are being typed. KeySave has a SMTP module which can be used to mail log files to a specific e-mail address every time the computer is online. KeySave comes with a QuickInstall maker which creates standalone .exes that are able to install KeySave on a system without any user interaction. KeySave is also very small. KBDLOG.EXE is only 27K while the QuickInstall .exes that are created are just over 50K. KeySave is completely FREE !! Installing KeySave To install KeySave on a machine you must have the following two files - install.exe - kbdlog.exe Run install.exe which will ask you the following questions - - Enter filename (including .exe extension) for storing KeySave: The KeySave executable is stored in your windows directory with the filename that you type in here. For example, if your windows directory is C:Windows and you want the KeySave executable to be stored as C:Windowsabcd.exe then you should type in abcd.exe in response to this question. - Do you want log files to be sent by email ? You can make KeySave send log files via email whenever the machine goes online. Type in y here to activate this feature. The following three questions are asked to you only if you have typed y here. - SMTP Host Address: - From Address: - Send Mail To: This is the info required by KeySave to send the log files via email. Please note that KeySave does not support those SMTP servers that require POP Authentication. Following this, KeySave is installed on your system and you are asked whether you want to start the keylogger. If you don't want the keylogger to run until the next reboot, type n here otherwise type y.Please note - Running kbdlog.exe directly will start the keylogger itself. However it will not be installed on your system, ie. it will not run every time you start-up. Also, log files will not be mailed automatically.Making a QuickInstaller A quick installer is a stand alone exe that contains the kbdlog.exe file as well as installation options within itself and can install KeySave without any user interaction required.To make a quick installer, simple run QINST.EXE, which is present in the QINST subdirectory. Also ensure that the file QINST.MOD is in the same directory. Give the filename for the output .exe as well as the installation options which you do during normal installation. QINST.EXE will then create the QuickInstaller file. Now the file created can be taken to and run on any machine to install KeySave with the inputted options.Please note that RUNNING QINST.EXE DOES NOT BY ITSELF INSTALL KEYSAVE ON THE MACHINE. The generated exe has to be run to install KeySave. Also, the exe file created by QINST.EXE is standalone and does not require any other file to install KeySave.Uninstalling KeySave You must know what filename you entered during install for storing the KeySave exe. The KeySave exe will be stored in your windows directory under that name. 1. Remove the reference to the KeySave exe (with full path) from the [windows] section and "run" key of your WIN.INI file. 2. Reboot your machine. 3. Delete the KeySave exe from your windows directory. Also if you want to remove the logs, they are stored in a subdirectory called KBDLOG in your windows directory.Using KeySave KeySave logs keys to a file called LOGFILE.KEY in the KBDLOG subdirectory of your windows directory. If your windows directory is C:Windows, the full path to LOGFILE.KEY is "C:WindowsKBDLOGLOGFILE.KEY". The LOGFILE.KEY file is renamed to a MLQxxxx.MQU file every day and logging continues in a new LOGFILE.KEY. The xxxx represents a sequence number. If you have log file emailing enabled, the MLQxxxx.MQU files are sent by email and then deleted to prevent them from taking up too much disk space. Whether you get the MLQxxxx.MQU files via email or access them directly from your system, you need to use READDATA to view these files. READDATA has two kinds of output modes, c for console output and t for output which can be redirected to a file. eg) readdata c c:windowskbdlogmlq0001.mqu readdata t c:windowskbdlogmlq0001.mqu > klog.txt The first statement will display the logs in a coloured format on the screen while the second will redirect it to a file called klog.txt When showing console output, you can go to a previous screen by pressing the '<' key.Ayan Chakrabarti
destructive program [F-Prot]KeySpy [McAfee]Trojan Horse.LC [Panda]Trojan.Spy.KeySaveTrojan.Spy.KeySave [Kaspersky]TrojanSpy.Win32.KeySave [Kaspersky]Win32/KeySave!Trojan [Computer Associates]Win32/KeySave.A!Spy!Trojan [Computer Associates]
install.exekbdlog.exeqinst.exereaddata.exeWindowsxxxx.exe