Samsung dispels rumors of laptop keylogger software

Samsung and security company claim an antivirus suite mistakenly classified a Microsoft folder as a keylogger

Samsung Electronics' laptops do not contain a secret program that logs keystrokes, security researchers have found, chalking the problem up to a mistake by an antivirus program.

An IT consultant based in Toronto, Mohamed Hassan, said on Wednesday he bought a Samsung R525 and later a R540 laptop and found the StarLogger program made by a company called de Willebois Consulting. StarLogger can log all keystrokes and capture screenshots.

[ Find out how to block the viruses, worms, and other malware that threaten your business, with hands-on advice from InfoWorld's expert contributors in InfoWorld's "Malware Deep Dive" PDF guide. ]

But Samsung and the security company F-Secure did further research and found that the VIPRE antivirus software mistakenly associated a Windows root directory folder called "SL" with StarLogger. In a statement on its website, Samsung said the SL folder is a Microsoft Live Application folder for multilanguage support. The "SL" stands for the Slovenian language, and other folders are installed depending on language, such as "KO" for Korean and "EN" for English.

"Our findings indicate that the person mentioned in the article used a security program called VIPRE that mistook a folder created by Microsoft's Live Application for a key logging software, during a virus scan," Samsung said.

F-Secure bought and tested a series of Samsung laptops -- the R540, RF710, QX310, SF510, X125, and NF310 -- and didn't find StarLogger.

GFI Software, which makes VIPRE, concurred with the findings. "A Slovenian language directory for Windows Live is causing us considerable headaches this morning, and we have no one to blame but ourselves," GFI said in a blog posting. The company said it had fixed the issue in the latest update -- definition set 8878 -- of the software.

Hassan couldn't be reached for comment Thursday, but in an interview Wednesday, he said he'd sent Samsung public relations e-mails about his article a week before it was published. Those emails were trapped by antispam filters, said Samsung spokesman Jason Redmond.

Hassan's allegations were published by Network World, which is owned by the IDG News Service's parent company, IDG.

Send news tips and comments to

Copyright © 2011 IDG Communications, Inc.

How to choose a low-code development platform