2

I have reversed a program I found running on my computer, written in VB.NET using Microsoft Visual Studio.

I'm pretty sure it is a keylogger. Now since I'm a very careful user, I'm 100% sure I did not download that. I believe it was planted by someone who had access to my computer.

Is there a way I can identify who wrote it? (Computer name maybe, VS username, etc?) Advanced methods would be appreciated as well in case whoever wrote it found a way around the obvious ones.

3
  • I dont know how it can be possible. But maybe a Time Date Stamp (a compile time of the executable) could give you some useful information? You can see it in IMAGE_FILE_HEADER with PEView, for example. Sorry, if its not relevant for you, its the only my suggestion. – 0xDEADC0DE Sep 24 '15 at 6:47
  • 1
    There are countless ways to help determine information about the authorship of the program (PE timestamps as @0xDEADC0DE suggested, language of strings used throughout the program, embedded debug paths, remote server hostname or IP address, choice of algorithms, etc.). But without the actual binary available to review, it's difficult to say which indicators are applicable. – Jason Geffner Sep 24 '15 at 14:57
  • I would inspect the binary in a .NET decompiler, such as Jetbrains or ILSpy. Maybe a simple "strings -n5" would result in interesting strings, if he was dumb enough to leave in such information. Also AssemblyInfo.vb is common in .NET apps, so I would look into that too. – Dominik Antal Oct 15 '15 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.