Which keylogger is described as a forged Windows device driver that records keystrokes and is undetectable by standard tools?

• A. Acoustic/CAM Keylogger
• B. rootkit-based keylogger
• C. Wi-Fi Keylogger
• D. Application Keylogger

Answer: (B)

A rootkit-based keylogger. When a keylogger is implemented as a forged Windows device driver, it operates at the kernel level as a rootkit. This lets it lie in the keyboard input path and capture keystrokes directly as they flow through the system, while hiding itself from standard security tools that don’t look deep enough into the kernel. That combination of deep access and stealth is what makes it undetectable by typical tools, which is exactly what “forged device driver” implies. Other types don’t fit this mechanism: acoustic/CAM keyloggers rely on sounds or video to guess keystrokes, not on intercepting the input path with a hidden driver; a Wi-Fi keylogger would capture keystrokes via network-related data, not by installing a Windows device driver; and an application keylogger runs in user space and is generally more easily detected.