How to Detect Keyloggers in Windows Systems

Keyloggers are a dangerous security threat to Windows computers. Their aim is to monitor keystrokes and expose private data to hackers and surveillance agents. It’s important to detect these threats in advance before they can do any serious damage. Learn some of the best ways to detect keyloggers on a Windows computer.

Tip: want to know whether your antivirus is reliable? Learn how to test it against real malware.

Why Are Keyloggers Dangerous?

A keylogger is a piece of software or hardware that monitors the keystrokes entered on a computer/laptop keyboard or mobile device. Hardware keyloggers are inserted using USB or a rogue driver and are easier to detect and remove. Software keyloggers are stealthier in comparison and may be undetectable.

Unlike regular viruses and Trojans, remote keyloggers do not impact the system performance but do a lot more harm by exposing your private information to others. Think of financial information, credit card data, PIN numbers, passwords, and your anonymous online posts and comments.

The most sophisticated keyloggers can profile users based on keystroke analysis, the rhythm and pattern of their keystroke entries. However, for any keylogger to be effective, it has to first install properly on your computer. There are various categories of keyloggers, depending on the severity.

• Browser-based keyloggers: some malicious websites may use CSS scripts, Man-In-the-Browser (MITB) attacks, or web-form-based keyloggers. Fortunately, if you have an updated Windows 10 or 11 system and have enabled the Windows Security app, these threats will be blocked immediately.
• General spyware keyloggers: traditional keyloggers are inserted using a suspicious email attachment or a social media/torrent download. Again, they are likely to be blocked by Windows Defender or an anti-malware program.
• Kernel-level keyloggers: these are more dangerous. They operate underneath the Windows operating system as rootkits and can go undetected.
• Hypervisor-based keyloggers: using virtualization, the sophisticated keyloggers can establish themselves as replicas of the operating system and scan all keystrokes. These threats are very rare, though.

Good to know: the antimalware service executable may be slowing your computer down. Find out why.

How to Detect and Remove Keyloggers

If you suspect that your Windows system has been attacked by keyloggers, follow these methods to detect and/or remove the keyloggers.

1. With Task Manager

1. Open the Task Manager with a simple right-click in the taskbar.

2. Go to the background processes and navigate to the Windows Logon Application.
3. If it has a duplicate entry – unusual if you’re the only one using the PC – such as “Windows Logon (1),” it means someone else is logged in to your Windows system. You may also want to read our post on how to know if someone else is logging in to your Windows PC.

4. That’s the first sign of a potential keylogger. Right-click and end the program.

5. Also check under the “Startup” tab. You don’t need most of these programs during startup, so disable them. This reduces the likelihood of a keylogger getting in while Windows boots up.

6. The only programs that belong in the Startup menu are audio codecs like Realtek (without which there would be no sound), the browser you most likely use, and SecurityHealthSystray.exe program. Everything else is optional.

Tip: did you know that you can search for and open files from Command Prompt? Follow this guide to find out how.

2. Use Command Prompt to Detect Suspicious Internet Connections

Once you’ve ensured that no one else is logged in on your computer, it’s important to check whether there are any suspicious Internet connections on your device.

1. Open Windows command line in Administrator mode.

2. Enter the following:

netstat -b

3. All the websites and software connected online to your Windows computer are now visible.
4. The ones connected to Microsoft Store, Edge or Chrome browser, “explorer.exe,” “searchhost.exe” or other system apps such as “svchost.exe,” are harmless. Fortunately, there are dead giveaways if malware is trying to replicate the authentic Windows process.

5. The Command Prompt lets you select and copy-paste any text, including the IPv4/IPv6 addresses.
6. You can verify the IP addresses online on websites like What Is My IP Address. If the source is your ISP, a Microsoft or Google data center (for Edge or Chrome), or some videoconferencing or gaming applications, there are no keyloggers.

3. With Windows Security (Defender)

Windows has built-in Windows Security (formerly Defender), which can detect any keyloggers upon arrival.

1. Open Windows Security from the search bar.
2. On the homepage, you can see security at a glance for your entire system. Make sure there are green checkmarks next to each of the security features on the page.
3. If there are warning signs for any of the symbols, go deeper to address the issue.

4. Go to “Virus & threat protection.” If there are any keyloggers due to spyware, viruses, browser-based attacks, or even kernel-level attacks, you will find them flagged. The system will prompt you to quarantine the threat immediately.
5. Click “Manage settings” under “Virus & threat protection settings” for more options.

6. Enable all the “Virus & Threat Protection Settings” options.

7. Go to “App & browser control” and select “Exploit protection settings.”

8. Exploit protection system settings are enabled by default. These provide a very high degree of protection from ransomware and rootkit attacks. Enable any of the options that are not set to On.

9. Under “Device security,” ensure that “Secure boot” is on. Click each of these options. “Memory integrity” needs to be turned on as well.

Tip: is Windows Security enough to keep your PC safe? Find out in our dedicated guide.

4. Use Anti-Rootkit Malware Solutions to Remove Keyloggers

Apart from Windows Security, you can use a third-party anti-rootkit malware solution to deal with kernel-level keyloggers.

Among the more lightweight solutions, Kaspersky has a free rootkit removal tool: TDSSKiller. It is totally safe to use. (It didn’t get flagged by Windows SmartScreen or VirusTotal.)

1. As soon as you install it, you can start the scan to check for updates and kernel-mode threats, including rootkit keyloggers.

2. If you click “Change Parameters,” there are additional “Objects to scan,” for which a reboot is required.
3. Check the “Additional options.”

4. Wait for the system scan to finish. The process is very fast and reliable and does not cause any burden on your Windows system.

5. The software will inform you if no threats are found. If there are any rootkits or Trojans, the program will detect and remove them automatically.

5. Detect Keyloggers Using “Programs & Features”

1. Open Control Panel from the search bar and click “Programs.”

2. Press on “Programs and Features.”

3. If you see any dangerous or unknown applications in the list of programs, uninstall them with a simple right-click.

Good to know: learn how to change the administrator in Windows.

6. Reset Your Windows PC

Doing a reset on your Windows device with a cloud download is one of the best ways to deal with deeply embedded malware, including hypervisor-level keyloggers. Fortunately, Windows allows you to do this without losing your files, as the cloud download does not depend on local resources.

Apart from a cloud reset, currently there are very few effective means to detect hypervisor-level keyloggers, as such a virtual system can remain invisible and go undetected.

How to Prevent Keyloggers in Windows Devices

You can take a few precautions that are meant to prevent keyloggers from doing their wicked work on your PC.

1. Use Keystroke Encryption

Keystroke encryption is a fantastic way to prevent keylogging. It encrypts all your keystrokes before they are sent online.

If you fall victim to a hypervisor-level keylogger attack, the malware can only detect encrypted random characters.

SpyShelter SIlent Anti-Keylogger is a reliable, malware-free, keyword encryption solution.

1. Download, install and reboot the system.

2. After installation, enable SpyShelter Silent from the right system tray.

3. In Settings, enable an option that protects against keystroke profiling. Choose various encryption options for your keystrokes. The feature moderates your typing rhythm to protect your anonymity against websites that attempt to profile you by the way you type.

2. Check for Updates

Windows updates are the easiest way for you to stay protected, as they guarantee all the security fixes you’ll need. If you have automatic cloud-delivered protection enabled in “Virus & threat protection” settings, it will deliver security and intelligence updates even when your system is idle.

• In Windows 11, check for updates under “Settings -> Windows Update.”
• In Windows 10, the option is available under “Settings -> Windows Settings -> Update and Security.”

A cumulative update is the best way to get the latest version of Windows Security. Follow our guidelines on how to deal with Windows 10 or 11 update issues.

Frequently Asked Questions

Image credit: Pexels. All screenshots by Sayak Boral.

Sayak Boral - Staff Writer

Sayak Boral is a technology writer with over eleven years of experience working in different industries including semiconductors, IoT, enterprise IT, telecommunications OSS/BSS, and network security. He has been writing for MakeTechEasier on a wide range of technical topics including Windows, Android, Internet, Hardware Guides, Browsers, Software Tools, and Product Reviews.