Just about the time WannaCry ransomware is hijacking people’s computer all over the world and making them cry over having to pay a ransom before getting their files back, the story of invading keylogger shouldn't have been the next news laptop owners want to hear.

However, it is already in the news: majority of the HP laptops shipped from December 2015 to this month, May 2017, come with a keystroke logger, now called Conexant Keylogger. And by this news, if you bought an HP laptop within the period, the keylogger is likely to be on your laptop.

The aim of this post is to help you know how to check if you have the keylogger installed, and how to remove it, if you it is on your laptop. But before that, it will be good for you to really understand what a keylogger is.

What is A Keylogger?

Simply put, a keylogger is a software or hardware that records (i.e. keeps logs) all the keys a computer user presses on his or her keyboard and delivers it to a location. Most of the time, keyloggers are installed on a computer, by hackers, to spy on the passwords of unsuspecting victims.

That said, let me make it blatantly clear that the Conexant Keylogger on HP laptops wasn't installed by hackers, and also HP didn't intentionally install it to spy on its customers - - why will HP want to do that?

The keylogger results from a mistake from Conexant, the vendor supplying the audio chip for HP laptops.

Conexant had developed a sound driver called MicTray, to run the audio chip, and implemented some commands that allow keyboard shortcuts to activate functions on the audio chip; however, in the process, the developers added some lines of codes that make the sound driver records all keystrokes pressed on the keyboard of laptops in which the driver is installed. That turns the driver to a keylogger.

How To Check If Conexant Keylogger is In Your HP Laptop

As earlier stated, the possibility of having the keylogger on an HP laptop is high in HP laptops shipped between December 2015 to May 2017. If you bought a new HP laptop within this period, you need to proceed to the directory C:\Users\Public\ and check if you have a file named MicTray.log.


If the file is in that directory, it means the keylogger is on your system, and what you want to do next is open the file and see its content. It was reported that the content in the MicTray.log is usually deleted after restarting affected laptop, so you may not see anything in the file.

But to ensure that your keystrokes aren't stored anywhere on your laptop, delete the file and empty your recycle bin. This will help prevent malwares from stealing the keg-logs. Also if you do backup your hard drive to external hard drive or cloud, you should also go the directory in the external drive and cloud and delete the file.

Aside the MicTray.log file, the Conexant Keylogger also prints keystrokes via Windows OutputDebugString API, from which the keystrokes could also be hijacked; and for this reason, the executable file of the keylogger must be removed.
How To Remove Conexant Keylogger Executable File
Immediately the Conexant Keylogger was made public, Microsoft has responded with a patch, by sending Windows Update. Therefore the most reliable way to remove Conexant Keylogger executable file is by running a Windows Update on your HP laptop.

To do that, go to Settings, then Update & security and then click on Windows Update, to check and run the latest update for your laptop.



If for any reason you can't update your Windows now, you can disable the executable file manually. Press Control Alt Delete, to start the Task Manager; click on More Details, to expand the manager; and then click on the Detail tab.

On the Detail tab, locate MicTray64.exe, right click on it and select End task. If you run 32bits operating system, the file's name will be MicTray.exe.


After ending the task, to finish the final removal of the Conexant Keylogger executable file, go to the directory C:\Windows\system32\ and find MicTray.exe or MicTray64.exe and delete it. If you don’t find the file in that location, you should see it in the directory C:\Program Files\CONEXANT\MicTray\.



The only issue with the manual removal of the file is that the keyboard shortcut of your audio wouldn't work again. You will need to do all commands manually. When you have time to perform Windows Update, do it and everything will be fine -- that's the audio shortcut will work again and the Conexant Keylogger will be fixed.

Source: https://www.techrabytes.com/conexant-keylogger-mictray-hp-laptop-fix/

Useful information !

Flexherbal:
Useful information !

Thank you.