Our goal is to develop simple instructions to expose the presence of keyloggers on a PC and identify who is responsible so the instructions can be shared with activists and dissidents. This post describes why this is so important.
The majority of network traffic is often one way, from the internet down to the PC. The PC sends short, simple requests for data or specific pages that are then delivered to it.
Blogging and online activities like email are obvious exceptions but the local keystrokes are still usually small in comparison to the data sent down to paint a graphic intensive page or a screen of video.
Keyloggers may encrypt the logged information they send home but the IP address must always be in clear text. Confirming a keylogger is present and identifying where the information is being sent goes a long way toward proving who is responsible.
Exposing Keyloggers 
