INTRODUCTION
SKIn2000 is a keylogger which allows to intercept all keystrokes, mouse clicks, captions of active windows, static text and other. It has a unique set of features that makes SKIn2000 a powerful keylogger, suitable for perfect monitoring of user's computer activity. These features are presented below:
- Invisible in Task Manager (both Applications and Processes lists), Taskbar, System Tray area, Services applet and Devices applet in Control Panel
- Developed for Windows NT/2000/XP
- Runs silently, without any messages or notifications and doesn't affect the computer performance
- Saves the time of the user logon and the current user's name
- Intercepts all keystrokes, including special keys, cursor control keys, keypad and combinations of keys
- Intercepts mouse clicks and saves the text under mouse pointer
- Tracks captions of activated windows and saves the time the window was activated
- Saves static text from windows, message-boxes and other
- Intercepts the text from edit controls
- Allows monitoring of URLs of visited sites
- Allows interception of different passwords, login names, etc
- Gives the managers the traceability of employees' work
- Helps to restore the documents after the applications faults or system crashes
- Has the feature of output log file encryption
- Has built-in scheduler and allows using scheduler templates
- Supports national keyboard layouts
- Can be installed on administrator's profile, so no users will see the SKIn2000 keylogger folder in the Start menu
- Has the Configuration Utility with user-friendly interface for tuning up all SKIn2000 keylogger options and log file processing
- Allows to protect SKIn2000 keylogger Configuration Utility with the logon password
SKIn2000 keylogger may be useful for system administrators, employers, parents who want to control their children's computer activity and Internet access, etc.
CAPTURING KEYBOARD AND MOUSE
Standard Keyboard
Interception of the standard keyboard means that the entire alphabet (A-Z, a-z and national chars), ciphers (0-9), punctuation marks (,.;:'!?"()-), special marks (`~@#$%^&*_=+\|[{]}/<>), , , , , , , , , , , , keys are recorded to the log file. The structure and the format of the log file are described below. Interception of the standard keyboard is enabled by default.
Keypad
Keypad is a numeric section on the right of the keyboard. It can be useful for entering some numeric datas (if NumLock is on) or for cursor position control (if NumLock is off). In first case it is strongly recommended interception of keypad to be enabled. This option is enabled by default.
Functional Keys
Functional keys include F1-F12 keys. In different applications they can perform different functions, but some of them are standardized for all Windows-applications. Monitoring of functional keys is useful to find out what special functions were used. This option is enabled by default.
Cursor Control Keys
Cursor control keys include <Left>, <Up>, <Right>, <Home>, <End>, <Page Up>, <Page Down>. Interception of these keys often makes the log file grow very quickly. Usually, cursor control keys do not carry much useful information and this option is disabled by default.
Keys Combinations
Interception of keys combinations (hotkeys) allows to retrieve the detailed sequence of user's actions. For example, if you see in the log file , you can make a conclusion that the user saved the document he was working at. Interception of keys combinations is enabled by default.
Mouse Clicks
Interception of the following mouse events is supported: left button down, left button double click, middle button down, middle button double click, right button down, right button double click. In log file these events are abbreviated for brevity. See Log File Structure for details. In addition, if you click on buttons, the text under the mouse pointer will be captured too. Moreover, this feature supports some other controls besides buttons. So you can track all user's actions to the smallest details. Interception of mouse clicks is enabled by default.
ADVANCED FEATURES
Track Windows Captions
When you run some application, its main window appears on the screen. The caption of this window, as a rule, contains application name and other useful information which can be tracked by SKIn2000 keylogger if this option is enabled. Each time the window is activated SKIn2000 keylogger captures its caption.
Add Date And Time
If this option is enabled, the current date and time are added to the window capture. This gives you the means to find out about the time the window was activated. If your computer operates around the clock several days in succession, the date of windows activation will also be of use.
Get Static Text
The Microsoft Windows operating system provides dialog boxes and controls to support communication between an application and the user. A static control is a control that enables an application to provide the user with certain types of text and graphics that typically require no response. Tracking of a static text will cause almost all the text displayed in a dialog to be written to the log file.
Save Edit Controls
An edit control is a rectangular control window typically used in a dialog box to permit the user to enter and edit the text from the keyboard. If Save Edit Controls option is enabled, all the text from edit lines will be saved to the log file. It can be useful for capturing of passwords, login names and other information. Edit controls can consist of a single line or multiple lines. You must specify the maximum number of lines of multiline edit controls to be captured.
LOG FILE PROCESSING
Selecting Log File
To select the log file you can use the button Browse or to type the log file name manually. If the name is entered without the path, the log file will be created in the same directory where SKIn2000 keylogger Configuration Utility is located.
NOTE: The log file must be located in the directory to which all users have at least read-write access.
Log File Structure
In the beginning of the work session the user logon time and the user name are recorded to the log file. For example:
.Successful logon: 19:46, Wed, 23 Jun, 1999
.User name: Administrator
All reserved notations and marks begin with the symbol '.'.
If basic options are enabled, all keystrokes are recorded without any separators or marks, as the text was typed. For example:
Sample text
1234567890!
Special keys and combinations are enclosed in angle brackets. For example:
<Left><Del><BS><Tab><Ctrl+A><Home><NumLock><Alt+F4>
Mouse clicks are recorded in the following way:
{Mouse:RBTNDWN}{Mouse:LBTNDBLCLK}
Meaning of abbreviations:
LBTNDWN - Left button down
LBTNDBLCLK - Left button double click
MBTNDWN - Middle button down
MBTNDBLCLK - Middle button double click
RBTNDWN - Right button down
RBTNDBLCLK - Right button double click
So, the record
{Mouse:LBTNDWN|& OK}
means that the user clicked a left mouse button on the button OK in the dialog box.
Captions of activated windows begin with reserved notation '.Window activated: ' and the caption itself, including the time and date of window activation if appropriate option is enabled, is enclosed in square brackets. For example:
.Window activated: [Shut Down Windows|21:03-6.23]
A static text begins with the reserved notation '.STATIC: ' and is enclosed in braces. For example:
.STATIC: {Please enter the password:}
The text from the edit control begins with the reserved notation '.EDIT: ' and is enclosed in braces. For example:
.EDIT: {password}
Log File Wrapping
Log file wrapping has two options: do not overwrite log and overwrite log larger than ... kilobytes. If you choose "do not overwrite log", the log file will be growing until you clear it manually with the button Clear. It is recommended that the log file size does not exceed 1 Mb. If you select the second option, the log file will be automatically overwritten when the specified size is reached.
Using Log File Encryption
You can enable encryption of the log file in the tab Log file. This will protect the log file from being read and examined by everyone. Only the person who knows the password will be able to decrypt and view the log file.
If you set the password for the first time, you must enter your password in the field 'New' and confirm it in the field 'Confirm'. If the both passwords are identical, you will see the message 'Your password has been set successfully'. Then the fields 'New' and 'Confirm' will become grayed and the field 'Old' will be enabled, and you can change the password. If you want to change the existing password, you must enter the old one in the field 'Old' first. After that you can enter a new password and its confirmation. Just press the Tab key and the password will be set.
To decrypt the log file, first, you must enter the correct password which has been set for the log file encryption. Second, enter the name of the output decrypted file. If the file name is entered without the path, it will be created in the same directory where SKIn2000 keylogger Configuration Utility is located. You can use the button Browse to select the full path. Third, press the button Decrypt Log. If all previous parameters are correct, the log file is decrypted and its contents is shown in the Notepad. After you examined the decrypted file, you can delete it manually or replace it to a safe folder to which only you have access. If the log file contains a partially open text and the encrypted text, after decryption it will reverse (encrypted text will be decrypted and open text - encrypted). The changes will take effect when you exit SKIn2000 keylogger Configuration Utility by pressing the button OK.
USING SCHEDULER
SKIn2000 keylogger may be scheduled. You can set begin and end time of work session for each weekday. If you set up the timetable you can save it as a scheduler template. There may be several different templates and you will load then in case of need. Pressing the button Default will load the default template - round-the-clock monitoring timetable. You can disable monitoring at any time by unchecking the option Enable monitoring. But this option will not take effect for desktop events unless you disable all basic and advanced options in the tab 'Capture'.
The timetable consists of four columns: begin time hour; begin time minutes; end time hour; end time minutes. There are several rules you should follow: begin time hour and end time hour must lie in range 00-24; begin time minutes and end time minutes must lie in range 00-59.
Your customized timetable may be saved to a scheduler template (*.sch) by pressing the button Save. After that any time you need this timetable you press the button Load and choose the appropriate template. If you press the button Default, the default scheduler template will be loaded (every day from 00:00 to 24:00).
SECURITY
You can protect SKIn2000 keylogger Configuration Utility with the password. In this case, when loading SKIn2000 keylogger Configuration Utility, you will be asked for the password. It will give you the monopoly right of the control over SKIn2000 keylogger settings. Remember, that the password will be captured by SKIn2000 keylogger and saved in the log file. So, you should enable the encryption option in the tab 'Log file' beforehand. The most difficult-to-break passwords consist of random series of characters and digits and have the maximum length (14 symbols). A password is a very sensitive case. When you set the password for the first time, you must enter the password twice in the fields 'New' and 'Confirm'. If you want to change the existing password, you must enter the old password first. Then you can enter a new password with its confirmation. Just press the Tab key and the password will be set.
UNREGISTERED VERSION LIMITATIONS
Unregistered version of SKIn2000 keylogger is completely functional. You can try all its features, even advanced ones. The only limitation - the nag screen that appears every time the user logs on. This nag screen is needed to inform the users that they work under a keylogger monitoring. If you register SKIn2000 keylogger, you will never see this nag screen again, and the program will operate completely invisibly.
|