![\"HP](\"\/huntsville-al\/wp-content\/uploads\/sites\/13\/2017\/05\/HP-Laptop.jpg\")
<\/p>\nBy Catalin Cimpanu
\nMay 11, 2017 08:45 AM 2<\/p>\n
<\/p>\n
The audio driver installed on some HP laptops includes a feature that could best be described as a keylogger, which records all the user’s keystrokes and saves the information to a local file, accessible to anyone or any third-party software or malware that knows where to look.<\/p>\n
Swiss cyber-security firm modzero discovered the keylogger on April 28 and made its findings public today.<\/p>\n
Keylogger found in preinstalled audio driver
\nAccording to researchers, the keylogger feature was discovered in the Conexant HD Audio Driver Package version 1.0.0.46 and earlier.<\/p>\n
This is an audio driver that is preinstalled on HP laptops. One of the files of this audio driver is MicTray64.exe (C:\\windows\\system32\\mictray64.exe).<\/p>\n
This file is registered to start via a Scheduled Task every time the user logs into his computer. According to modzero researchers, the file “monitors all keystrokes made by the user to capture and react to functions such as microphone mute\/unmute keys\/hotkeys.”<\/p>\n
This behavior, by itself, is not a problem, as many other apps work this way. The problem is that this file writes all keystrokes to a local file at:<\/p>\n
C:\\users\\public\\MicTray.log
\nAudio driver also exposes keystrokes in real-time via local API
\nIf the file doesn’t exist or a registry key containing this file’s path does not exist or was corrupted, the audio driver will pass all keystrokes to a local API, named the OutputDebugString API.<\/p>\n
The danger is that malicious software installed on the computer, or a person with physical access to the computer, can copy the log file and have access to historical keystroke data, from where he can extract passwords, chat logs, visited URLs, source code, or any other sensitive data.<\/p>\n
Furthermore, the OutputDebugString API provides a covert channel for malware to record real-time keystrokes without using native Windows functions, usually under the watchful eye of antivirus software.<\/p>\n
Keylogger feature confirmed in HP laptops
\nModzero researchers said they found the Conexant HD Audio Driver Package preinstalled on 28 HP laptop models. Other hardware that uses this driver may also be affected, but investigators haven’t officially confirmed that the issue affects other manufacturers.<\/p>\n
HP EliteBook 820 G3 Notebook PC
\nHP EliteBook 828 G3 Notebook PC
\nHP EliteBook 840 G3 Notebook PC
\nHP EliteBook 848 G3 Notebook PC
\nHP EliteBook 850 G3 Notebook PC
\nHP ProBook 640 G2 Notebook PC
\nHP ProBook 650 G2 Notebook PC
\nHP ProBook 645 G2 Notebook PC
\nHP ProBook 655 G2 Notebook PC
\nHP ProBook 450 G3 Notebook PC
\nHP ProBook 430 G3 Notebook PC
\nHP ProBook 440 G3 Notebook PC
\nHP ProBook 446 G3 Notebook PC
\nHP ProBook 470 G3 Notebook PC
\nHP ProBook 455 G3 Notebook PC
\nHP EliteBook 725 G3 Notebook PC
\nHP EliteBook 745 G3 Notebook PC
\nHP EliteBook 755 G3 Notebook PC
\nHP EliteBook 1030 G1 Notebook PC
\nHP ZBook 15u G3 Mobile Workstation
\nHP Elite x2 1012 G1 Tablet
\nHP Elite x2 1012 G1 with Travel Keyboard
\nHP Elite x2 1012 G1 Advanced Keyboard
\nHP EliteBook Folio 1040 G3 Notebook PC
\nHP ZBook 17 G3 Mobile Workstation
\nHP ZBook 15 G3 Mobile Workstation
\nHP ZBook Studio G3 Mobile Workstation
\nHP EliteBook Folio G1 Notebook PC
\nThe Conexant HD Audio Driver Package has versions for the following operating systems.<\/p>\n
Microsoft Windows 10 32-Bit
\nMicrosoft Windows 10 64-Bit
\nMicrosoft Windows 10 IOT Enterprise 32-Bit (x86)
\nMicrosoft Windows 10 IOT Enterprise 64-Bit (x86)
\nMicrosoft Windows 7 Enterprise 32 Edition
\nMicrosoft Windows 7 Enterprise 64 Edition
\nMicrosoft Windows 7 Home Basic 32 Edition
\nMicrosoft Windows 7 Home Basic 64 Edition
\nMicrosoft Windows 7 Home Premium 32 Edition
\nMicrosoft Windows 7 Home Premium 64 Edition
\nMicrosoft Windows 7 Professional 32 Edition
\nMicrosoft Windows 7 Professional 64 Edition
\nMicrosoft Windows 7 Starter 32 Edition
\nMicrosoft Windows 7 Ultimate 32 Edition
\nMicrosoft Windows 7 Ultimate 64 Edition
\nMicrosoft Windows Embedded Standard 7 32
\nMicrosoft Windows Embedded Standard 7E 32-Bit
\nHP did not respond to a request for comment from Bleeping Computer in time for this article’s publication.<\/p>\n
Here’s how to Check for and Remove the HP MicTray64 Keylogger
\nAccording to modzero, to check for and remove the HP MicTray64.exe keylogger, you should follow these steps:<\/p>\n
Open Task Manager and check for a running process called MicTray64.exe. If this process exists, close it.<\/p>\n
Navigate to c:\\Windows\\System32\\MicTray64.exe and move the file to your Desktop.<\/p>\n
Now check if the file C:\\Users\\Public\\MicTray.log exists. If it does, move this file to the Desktop as well.<\/p>\n
Now that the keylogger has been removed and you have isolated the log files, let’s take a look at what was logged.<\/p>\n
Open the MicTray.log file on your desktop and examine the contents. If you notice that login names, passwords, banking info, or any other sensitive login info has been logged, you should immediately change your passwords at the associated accounts.
\nAfter following the steps, the keylogger will no longer be active and will not start on reboot.<\/p>\n","protected":false},"excerpt":{"rendered":"
By Catalin Cimpanu May 11, 2017 08:45 AM 2 The audio driver installed on some HP laptops includes a feature that could best be described as a keylogger, which records all the user’s keystrokes and saves the information to a local file, accessible to anyone or any third-party software or malware that knows where to […]<\/p>\n","protected":false},"author":15,"featured_media":1904,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1132","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"yoast_head":"\n