i used c language for written one keylogger and in that i use this function:
while(1){
some code...
}
and this function cuse my cpu usage %100
i found one way to avoiding it is using keyhook but we can hook when we load one dll and i want write keylogger whitout loading any dll
anybody can help me?

put Sleep(10) inside the loop

Let my guess, your using GetAsyncKeys() (or something similar?)

You should look into WH_KEYBOARD_LL hooks

Here http://msdn.microsoft.com/library/default....eyboardproc.asp

would be a good place to start.

If you have any other questions ask, im just finishing up one i've written using a DLL. MSDN will be your best friend.

sleep(10) is good idea i should test it.
and my friend i know about hooking when we want load a dll but i don't want load any dll
just one exe file.
mmm very nice i have another question for my virus in c
my virus can find all *.exe in system directory with this function GetSystemDirectory and findfirstfile and findnextfile but it need find all of exe files on the hard drives...
i have one idea my virus can use this function system("dir /A:D /B >13.txt");
and then fread 13.txt to a string then use another system function to go to directory but i need new idea maybe with api can you help me?

the windows api has functions for checking drive letters - i used to encounter this a lot when i was into cracking copyright protection on cds etc.

i believe that there are two functions, one for enumerating all drive letters, and one for checking what type of drive they are (i.e. cd, hdd, floppy, etc).

i cant recall the exact names of the functions but you could soon find out using google and the msdn library. try GetLogicalDriveStrings and GetDriveType.

regards,
suma

dear i need find all *.exe files on hard drives for infecting
but do you think this api can help me?

yes, use GetLogicalDriveStrings and GetDriveType to get every hard disc drive. once u have that info, use FindFirstFile and FindNextFile to search for all files on the volume. It would be a simple matter to read in the filename and check to see if it ends in exe.

If you ever learned enough from system hooks then you would know that JournalHook doesnt need to lay in a dll. It can be 1 .exe file.

i used Sleep(1); and it worked and dears when we can use this simple way why should use api calling?
sleep(1) means sleep for 1 milisecond do you thinks users typing faster than 1 milisecond exactly no then our keylogger can log all key even sleep for 1 milisecond
thanks
i 'll check this function to finding exe files
thanks guys