Swiss security firm modzero AG reports that some HP devices have a keylogger installed that resides in the audio drivers.
The keylogger is built into the driver and records all keystrokes made by system users and saves them in a log file called MicTray.log and saves it in the path:
C:\Users\Public\
Note that the log file is saved in the public folder and not in the user's specific folder.
The security firm's publication naturally raises several questions. First, why would a keylogger be in the audio driver, and second, how can we make sure it's not running on HP devices.
The first thing you need to know is that only HP devices appear to be affected by the company's discovery. Modzero AG says that HP EliteBook, HP ProBook, HP Elite, and HP ZBook models running Windows 7 and Windows 10 are affected. You can see the full list of affected devices in the link at the end of the post.
The security company says that if you are using an HP (Hewlett-Packard) device, you should check for the files
C:\Windows\System32\MicTray64.exe
and
C:\Windows\System32\MicTray.exe
If there are any, you will need to delete or rename them to stop the keylogger.
Additionally, you should check for the existence of the file
C:\Users\Public\MicTray.log
If it exists, delete it.
All your keystrokes are recorded in this text file, which may contain sensitive information such as authentication data, credit card numbers, private chat messages, and even emails. Note, however, that this file is overwritten after each login.
So it may exist in backups, File History, or other services that create copies of the file and may have stored previous versions of it. So you should be sure to delete these files as well to avoid any leaks.
The MicTray executable (in either 64-bit or 32-bit versions) is installed with the Conexant audio driver. The program is scheduled to run immediately after the user logs in, so it immediately begins recording their keystrokes.
Its main function is to provide functionality between the device keys and certain audio driver functions, such as muting the microphone.
Modzero AG reports on keylogging:
Keystroke tracking is added by implementing a low-level keyboard input hook function that is installed and calls SetwindowsHookEx().
You're probably wondering why the keylogger was added to the driver. Modzero AG states:
In reality, the purpose of the software is to recognize whether a specific key has been pressed or released. However, the developer has introduced various diagnostic and debugging features to ensure that all keystrokes are either transmitted through the debug interface or recorded in the log file located in a public folder on the hard drive.
________________________________________________
Users operating affected HP devices should ensure that the software is not updated. If it is updated, it will reinstall the keylogging application we deleted above….
https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt
