John discovers that malware has been installed on one of the systems he is responsible for. Shortly afterward, the passwords used by the user to which the system is assigned are discovered to be in use by attackers. What type of malicious program should John look for on the compromised system?

A keylogger is a software or hardware tool used to capture keystrokes. Keyloggers are often used by attackers to capture credentials and other sensitive information. A rootkit is used to obtain and maintain administrative rights on a system, and a worm is a self-spreading form of malware that frequently targets vulnerable services on a network to spread.