Perfect Keylogger: how can I let bsdhooks.dll through?

[finlam]

There were a couple of posts a year ago about avast! reporting bsdhooks.dll (part of perfect keylogger) as an infected file.  Apparently, the consensus was that keylogging software is spyware.

I have to disagree with that statement.  Let me briefly explain:  many people are using keyloggers to keep an eye on their young children's browsing habits.  I can see nothing wrong with that.  As for myself, I am interested in perfect keylogger because I do a lot of typing in programs which do not have an auto save feature, and I have lost hours of work through program crashes much too often.  For me, keylogging makes sense... as long as it is self-inflicted, of course ;-)

Now to my question:  how do I get avast! to ignore the threat?  I thought all it would take would be to declare bsdhooks.dll as an exclusion, but this doesn't seem to work...

Thanks for your help.

[DavidR]

1. does it detect your version of bsdhooks.dll as infected? if not you have no problem.
2. You can exclude the program/process perfect keylogger.

Check out this thread for lots of options you can set through the avast.ini file. Understanding avast4.ini file

[igor]

Well, I'd say that to watch a child's browsing habbits, it's not really necessary to log every keypress.

Anyway, setting an exclusion should work. What exactly did you do?

[finlam]

Thanks, DavidR.  You solved my problem.  Indeed, bsdhooks.dll was marked as infected, so I had excluded it.  What I should have done is exclude the main executable.  Everything is fine now.

[igor]

That's rather strange. If the DLL file is reported as infected, it's the one that should be excluded (or possibly the whole folder of this application). Excluding the exe file shouldn't have any effect.

[finlam]

Well, I was too prompt reporting success yesterday.  Avast! keeps interfering.  I tried to exclude the whole program folder, to no effect  :'(

[igor]

So, what exactly did you do?

[finlam]

In avast! I excluded the whole folder c:\program files\perfect keylogger lite\, which contains both bpk.exe the main executable and bsdhooks.dll. I scanned my disk to make sure that there is no other instance of bsdhooks.dll anywhere, and there isn't. Still, avast! reports a virus in bsdhooks.dll.  The last time it did that, perfect keylogger was not even running: I was simply browsing the directory in windows explorer.  I assume this happened simply because explorer was loading the files to extract their icons.

[igor]

OK, but how did you exlude the folder?

First, there are actually two exclusion lists: one in program settings, affecting the on-demand scanners, and another one in Standard Shield settings, affecting Standard Shield (i.e. on-access protection) only.
Second, it's necessary to put the complete mask to the exlucions, i.e. something like
c:\program files\perfect keylogger lite\*
or simply
*\bsdhooks.dll

I'd rather suggest the later, because of potential problems with long file names in the first case.

[finlam]

I was using the exclusion list from the program settings.  I don't see any standard shield settings (maybe due to the fact that I am using the freeware version of avast! ?).
The exclusion mask was c:\program files\perfect keylogger lite\*.
I just added *\bsdhooks.dll, but this makes no difference. Avast! still blocks execution of the program.

I think I am going to give up and stop monitoring this stream in a day or two, unless someone comes up with an explanation.

Thanks to all for your help.

[igor]

Click on avast! tray icon - the On-Access Scanner control window will appear. Click "Details...>>", if not already expanded. Select "Standard Shield" from the list of providers on the left side and click "Customize". Now, switch to the "Advanced" page and enter the exclusion there.

[finlam]

Igor, I did what you said and it worked.  Thanks a lot.