Keyloggers.

I hope this the correct sub forum.
I would like to ask a some questions about keyloggers!
We hear a lot about computer security these days. Does the process of hacking consist of the use of widely differing techniques, each leading to pretty much the same result?
In other words are keyloggers, for example, a specialised tool for gaining access to another computer?
I understand a keylogger becomes active only if the victim opens an email attachment. Given reasonable knowledge is it, any sense, difficult to send the keylogger or are they neatly "packaged" ready for use?
Of course, here, I'm only talking about software keyloggers!
Finally, and I feel I have never been given a definite answer here! Maybe a straightforward answer is simply not available?
How difficult is it to find, or isolate, a keylogger?
Should one expect a basic anti-virus program to do this or does identifying the keylogger depend on the sophistication of the device assuming differences, of this kind, do exist between them?






,

A keylogger is just a name applied to an infection that logs a User's actions.

Like any other infection it can be loaded in a number of different ways, and there is no one particular manner by which all keyloggers are distributed. The specific method that any will use will vary from type to type, and will be the one that the keylogger's creator has decided will give them the greatest penetration, and the greatest payback.

Sometimes they come as a "stand-alone" item, sometimes they come packaged with other types of malware, and sometimes the keylogging code is incorporated as part of a different infection.

In short, there is no "one size fits all" solution to detecting them, and/or removing them.

As far as detections go, pretty much all malware detections are made on the basis of "signature recognition" so your Anti-Virus will be good at detecting those that are already "known", what it will be less good at detecting, will be "new" malware. To combat this deficiency, many AV programs now incorporate heuristic detections, where a software's behaviour is analysed and flagged if it is suspicious. The downside of this is that heuristic detections are prone to generating more false positives than regular signature based detections.

Hope that answers a few of your questions.

Thanks for the reply!
As someone who lacks knowledge here I don't really know if this question makes sense.
Suppose someone is given a PC and is told the machine is infected by a keylogger, not spotted by the Anti-Virus programme.
Does that individual require a high level of expertise to have a chance of finding the (infection) keylogger?

If your AV has not found it, the chances are good that you won't either, and yes, it would take a great deal of specialised knowledge to find it.

If the machine does actually have a keylogger installed, then the easiest way to be 100% sure it is removed is to return the PC to "factory" condition, by performing a reset which is a fairly simple procedure with machines running Windows 8 or later.

The disadvantage of this method is you will lose any personal files, any "non-default" installed programs, and any customisations that may have been made to it, but it is the only sure method to ensure the computer is clean.