How to Detect and Remove Keyloggers

Co-authored by Yaffet Meshesha and Travis Boylls

Last Updated: January 31, 2023 Tested

A keylogger is a piece of generally-malicious software or hardware installed on your computer that logs what you type. While they may be legitimately used in rare circumstances, they can also be used by cybercriminals to gather personal information and passwords. They can also cause your computer to slow down. This wikiHow teaches you to detect and remove it keyloggers.

Part 1

Part 1 of 3:

Preparing Your Computer

1
Update your operating system and applications. Outdated software may have exposed security holes that can open your computer up to infection.
- Make sure that all users of the computer know not to click freely on the internet, especially pop-ups, and avoiding freebies at all costs.
2
Configure your web browser's security settings. The process of configuring your web browser is different from one web browser to another. Open the Settings menu on your web browser and look for the Privacy and/or Security settings. Disable any unwanted plug-ins, block malicious websites, and clear your browser history. Delete cookies that track personal information.^{[1]
X
Research source}

Advertisement
3
Install reputable security software on your computer. Install both an on-demand anti-malware and an always-on antivirus. Free options include Malwarebytes (for malware) and Avast or Panda (for antivirus). Keep your security software updated.

Part 2

Part 2 of 3:

Detecting Keyloggers

1
Open the Task Manager. Use the following steps to open the Task Manager:
- Right-click the taskbar at the bottom of the page.
- Click Task Manager in the pop-up menu.
2
Click More Details. It's in the lower-left corner of the Task Manager. This displays a list of all processes running on your computer. This includes apps you have open as well as processes running in the background.
3
Check for suspicious processes. You'll most likely find suspicious processes running in the background. Check for apps that you don't recognize.
- If you are not sure what a process is, right-click it and click Search online. This will do a Google search of the app or process.
- If you find a process you want to stop, click the process and then click End task in the lower-right corner.
4
Click the Startup tab. It's at the top of the Task Manager. This displays a list of programs that startup with your computer.
5
Check for any suspicious programs. Look through all the startup programs and see if there is anything you don't recognize.
- If your are not sure what a program is, right-click it and click Search Online. This does a Google Search of the program.
- If you find a program you want to disable. Click the program and click Disable in the lower-right corner.
6
Scan for viruses and malware. Many keyloggers hide themselves from both msconfig and the Task Manager, or disguise themselves as legitimate programs. Use your reputable anti-malware to scan for viruses and malware on your computer.
7
Check on your desktop computer. If you have a desktop computer, it may also have a hardware keylogger on it. Look at where your keyboard cable connects to your tower. If there is a device plugged in between the keyboard cable and the tower, it might be a hardware keylogger.
- Please note that this may also be a legitimate converter or device. If you find an unfamiliar device attached to your computer, find out who put it there and why.

Part 3

Part 3 of 3:

Removing the Keylogger

1
Determine if the keylogger is visible. If the keylogger detected is visible as an entry on the list of programs in the Control Panel, then it might be a legitimate keylogger program with an uninstaller. Uninstall the program, and use an anti-malware to remove any remnants.
2
Try an uninstaller. With some keylogger programs, such as Logixoft's Revealer Keylogger, the installer can be used to uninstall the keylogger. Download the installer, and use that to uninstall the keylogger. You can also uninstall programs through the Settings menu. Remove remnants of the keylogger using a reputable anti-malware scanner.
- If you are unable to uninstall the program, try restarting your computer in Safe Mode and uninstalling it while in Safe Mode.
3
Perform an Offline Scan with Windows 10 Defender. After getting the latest updates for your antivirus, run a rootkit detector such as Windows Defender Offline. In order for you to run it, you have to go deep into settings or create offline media.
4
Search for specific advice for the keylogger, by name. Do a Google search for the specific keylogger program name. Some keylogger programs, such as Refog, actively prevent uninstallation. Check on internet forums such as Bleeping Computer to see how you can remove the program without breaking your computer.
- Hijack This is a good tool for removing programs that are buried deep within your Windows Registry. However, you need to use Hijack This with caution. It can also be used to inadvertently delete things Windows needs to function. Do a Google search before deleting any registry items.
5
Consider reinstalling your computer's operating system. Many keyloggers get buried deep within your Windows Operating system, making them difficult to remove. In some cases, the easiest solution may be to back up your files and reinstall Windows.^{[2]
X
Expert Source

Yaffet Meshesha
Computer Specialist
Expert Interview. 10 February 2021}
- Reinstalling Windows will remove everything on your computer. Be sure to back up your files before reinstalling your system. You can back up your files using an external hard drive, or a cloud service such as Google Drive, Dropbox, or One Drive.
- You should reinstall your operating system if you have detected a keylogger on a computer that you plan to use for bank transactions or dealing with trade secrets, because the keylogger might not have been completely removed.