How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger operates quietly, capturing every keystroke you make and relaying that information to an external source. In 2025, infostealer malware, which includes keyloggers, was responsible for the theft of 642.4 million credentials from 13.2 million infections globally, as reported by SpyCloud. Within Australia, around 30,000 banking passwords were compromised between 2021 and 2025 due to this type of malware. This guide outlines a comprehensive approach to detecting, removing, and recovering from a keylogger infection on Windows, macOS, and Linux, providing 12 actionable steps, including copy-pasteable commands and an audit script to help navigate the process effectively.

Signs Your Device Might Have a Keylogger

Keyloggers are designed to be stealthy, making it challenging to identify them based on a single symptom. Instead, a combination of unusual behaviors can signal their presence. Look for:

• Typing lag or a cursor freeze after keystrokes.
• Unexpected notifications from antivirus software being dismissed.
• New browser extensions or altered default search engines that you did not install.
• Unexplained spikes in outbound data usage while the device is idle.
• Login alerts or password reset emails that you did not initiate.
• Increased frequency of program crashes or longer shutdown times.

While none of these signs are definitive proof of a keylogger, noticing two or more together warrants further investigation.

What Is a Keylogger, and Why It’s Still Beating Australians in 2026

A keylogger is a type of software or hardware that records keystrokes and sends that data to an attacker. Microsoft defines it as software that secretly logs every keystroke made on a device. The National Institute of Standards and Technology (NIST) describes it similarly, emphasizing its role in bypassing security measures to obtain sensitive information like passwords. Modern keyloggers often come bundled with infostealer malware that also captures browser cookies and saved credentials, making them a significant threat to users.

The Australian Cyber Security Centre (ACSC) has reported a rising trend in credential theft, with over 42,500 calls to its hotline in a single year, marking a 16% increase. Four primary malware families—LummaC2, RedLine Stealer, StealC, and Vidar—dominate the landscape, with LummaC2 alone accounting for nearly 60% of credentials linked to infostealers in 2026.

Prerequisites: Tools, Access and Time You’ll Need

Before tackling a potential keylogger infection, ensure you have the following:

• Administrator access to the affected device.
• A second, clean device for password resets.
• A licensed antivirus or anti-malware engine.
• A password manager ready for credential migration.
• An external USB drive with a bootable antivirus rescue disk.
• 60-90 minutes of uninterrupted time for the process.
• A physical notepad for tracking account resets.

If this is for a work device, consult your IT team before proceeding with removal tools.

Steps 1-4: How to Detect a Keylogger on Your Device

Step 1: Check running processes for anything unfamiliar

Access Task Manager on Windows or Activity Monitor on macOS to review running processes. Look for anything that appears suspicious or has generic names. On Windows, you can use PowerShell for a more organized view:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 20 Name, Id, CPU, Path

Step 2: Audit startup programs and scheduled tasks

Keyloggers often register as startup entries or scheduled tasks to persist through reboots. Check the Startup tab in Task Manager on Windows or list launch agents on macOS:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Step 3: Review installed programs and browser extensions

Examine installed programs in Control Panel on Windows or the Applications folder on macOS for anything unfamiliar. Pay special attention to browser extensions, as malicious ones can capture sensitive data directly.

Step 4: Check outbound network connections

To identify any active data exfiltration channels, check established connections on Windows:

Get-NetTCPConnection -State Established | Select-Object LocalAddress, RemoteAddress, RemotePort, OwningProcess

Steps 5-8: Confirm the Infection and Remove It

Step 5: Run a full antivirus and anti-malware scan

Update your antivirus definitions and conduct a full scan. On Windows, you can initiate this via PowerShell:

Update-MpSignature
Start-MpScan -ScanType FullScan

Step 6: Run a second opinion with a dedicated anti-rootkit scanner

Use a different vendor’s scanner to check for rootkits, as they can evade standard antivirus detection. Malwarebytes and ESET are popular choices.

Step 7: Physically inspect your hardware

While software keyloggers are common, hardware keyloggers can also pose a threat, especially on shared machines. Inspect USB ports for any unfamiliar devices.

Step 8: Boot into Safe Mode and repeat the scan

Safe Mode loads only essential drivers, making it easier to isolate and remove keyloggers. Run your antivirus scan again in this mode.

Steps 9-12: Recover Your Accounts and Harden Your System

Step 9: Remove the keylogger and clean residual files

Allow your antivirus to quarantine detected files, then manually check for any remnants in the locations identified earlier.

Step 10: Reset every password from a clean device

Reset passwords for your email and banking accounts from a trusted device, as typing them on an infected machine can compromise them again.

Step 11: Migrate to a password manager and clear browser-saved passwords

Install a reputable password manager and transfer your credentials to it, ensuring that your passwords are no longer stored in the browser.

Step 12: Harden the system against reinfection

Enable security features that make keylogging more difficult, such as Secure Boot and Virtualization-Based Security on Windows 11.

Common Pitfalls When Detecting and Removing Keyloggers

• Resetting passwords on the infected machine.
• Relying on a single antivirus scan.
• Overlooking browser extension audits.
• Deleting malware without noting its location.
• Ignoring hardware keyloggers on shared devices.
• Restoring from a compromised backup.
• Assuming MFA alone protects against keyloggers.

Troubleshooting: 8 Problems You’ll Hit (and How to Fix Them)

1. The antivirus scan won’t finish or keeps freezing. Boot into Safe Mode and try again.

2. Task Manager won’t open or closes immediately. Use Ctrl+Alt+Delete to access it or run a rescue-disk scan.

3. The detected file won’t delete, “in use” errors. Quarantine it in Safe Mode.

4. The same detection reappears after every reboot. Investigate persistence mechanisms.

5. Two antivirus engines give conflicting results. Treat any positive detection as real until proven otherwise.

6. Password manager import shows missing entries. Re-export a smaller batch to isolate the problem.

7. Network connections show a remote address you can’t identify. Check the IP against a reputation lookup.

8. The machine feels “clean” but accounts are still being accessed. Force a full sign-out of all sessions.

What to Do After Removal: Reporting and Monitoring in Australia

After removing the malware, report the incident through ReportCyber if sensitive information was exposed. For banking details, contact your bank for monitoring. Keep a timeline of events, as this can be useful for disputing fraudulent transactions later. Continue monitoring for 60-90 days, as stolen credentials may be used long after the initial infection.

Free vs Paid Anti-Keylogger Tools Compared

While you don’t need every tool available, a combination of built-in protection and a paid scanner is advisable for comprehensive coverage:

Tool	Type	Cost (AUD)	Rootkit/anti-rootkit mode	Best for
Microsoft Defender	Built-in, Windows 11	Free	Basic	First-line, always-on baseline scanning
Malwarebytes Premium	Third-party anti-malware	~/yr	Yes	Second-opinion scan, real-time protection add-on
Bitdefender Total Security	Full antivirus suite	~-100/yr	Yes	All-in-one protection with anti-keylogger module
ESET Online Scanner	On-demand rootkit scanner	Free (on-demand)	Yes	One-off deep scan when you suspect infection

How Keyloggers Get In: Delivery Methods to Watch For

Keyloggers often infiltrate systems through phishing emails, malicious attachments, or compromised software downloads. Understanding these delivery methods is crucial for maintaining a clean device.

Keyloggers vs Other Infostealers: What’s the Difference

While a keylogger specifically captures keystrokes, many modern infostealers include keylogging as part of a broader data collection strategy. This distinction is important for detection, as a full infostealer may affect more areas of the system.

Detecting Keyloggers on Android and iPhone

Mobile devices are not immune to keyloggers, which often come disguised as legitimate apps. Regularly review app permissions, especially on Android, to prevent unauthorized access.

Advanced Tips for Power Users and IT Admins

For those managing multiple devices, implementing automated scans and monitoring network traffic can provide an additional layer of security against keyloggers.

Complete Working Project: A Keylogger Audit Toolkit

To streamline the detection process, consider using a PowerShell script that combines various checks into a single report, making it easier to identify potential threats.

Output Examples: What a Clean vs Infected Report Looks Like

A clean audit will show familiar processes and limited outbound connections, while an infected report may reveal suspicious processes or unusual network activity.

Frequently Asked Questions

Can antivirus software detect every keylogger?
No, as new or customized keyloggers may evade detection. A multi-engine approach is recommended.

Will a factory reset definitely remove a keylogger?
Yes, provided you reinstall the OS from official media.

How do I know if I should reset all my passwords or just a few?
If the infection timeline is unclear, reset all passwords, starting with email.

Are Macs immune to keyloggers?
No, keyloggers targeting macOS exist and have been increasing.

Can a keylogger infect my phone?
Yes, mobile keyloggers typically arrive as disguised apps.

Does using a password manager make me safe from keyloggers?
It reduces risk but does not provide complete protection.

What’s the difference between a keylogger and ransomware?
Keyloggers steal data silently, while ransomware encrypts data and demands payment.

How often should I run a keylogger audit if I haven’t noticed anything wrong?
Monthly scans for personal devices and weekly for business devices are advisable.