A keyboard- and mouse-logging program for 16-bit Windows (3.x and the Win16 subsystem of 95/98), written in Borland Pascal. A single system-wide WH_GETMESSAGE hook, installed from a DLL, let it see the input of every running program and log everything typed and clicked to a file — recording the context of each event: the program, the window title and the field, with timestamps. The whole program was tiny — about 21 KB (21,760 bytes).
What made the press single it out: once started it ran invisibly — not shown to the user nor listed in the Windows Task Manager — and by reading field context it could even capture masked passwords (such as hidden Dial-Up fields). Komputerra named version 2.8 the best program in its class (1999); it has its own articles in the Russian and Ukrainian Wikipedias.
It was originally written on commission for a university department, to audit how its office computers were used — legitimate usage logging that the era’s press reframed as a “spy program”. The same instrumentation was later cited in a textbook (V. A. Vul, Electronic Publications, 2003) as a way to collect interface-usage statistics — in effect early UX analytics. Its whole trick relied on the Win16 shared-memory model, where one DLL’s data was global across every task; once Windows isolated each process the global hook could no longer work, so it is preserved for study only.
Update (2026): the original 16-bit Borland Pascal source was recovered from the author’s archives, and the whole project — source, a later 32-bit Delphi port and the full version history — is now published on GitHub under the MIT license for study.
