What is a keylogger and how can you avoid, detect and remove them

Keyloggers are a form of spyware that records everything you type. They can usually be removed using anti-keylogger software or a spyware-removal program. Whether you’re worried your device may be infected or are just interested in learning about digital threats, read on. I’ll explain how keyloggers get installed, how to detect them, and what the removal process looks like.

What is a keylogger?

Keyloggers (sometimes called keystroke loggers) are malicious programs that record every button you press on your computer’s keyboard. This technology has legitimate uses, including monitoring your children’s online activities, but it is extremely dangerous if installed without your knowledge. That’s because keyloggers allow attackers to gather a staggering amount of information, including:

• Login credentials: Once you enter a URL like “gmail.com”, the next things typed are often your username and password.
• Personal data: If you fill in the fields manually, a single online purchase can give a hacker your home address, credit card information, and even your CVV.
• Message contents: The keylogger will pick up the contents of any message you send. However, they’ll only know the recipient if you type their name or email address (rather than choosing a contact from a list).
• Basic OS information: The Windows key and the macOS Command key sent different codes to the operating system. This tells the attacker which platform you’re using.
• Browsing history: Keyloggers record every website address you type and every Google search. By monitoring your activities, hackers can discover which online banking service, email client, and social media platforms you use.

If you think you’ve accidentally installed a keylogger, the first thing you should do is disconnect from the internet. This temporarily stops it from sending keystroke logs, letting you remove the malware without continuously feeding the attacker new information. An anti-keylogger or anti-rootkit scan should resolve the infection, but you should also change your passwords, set up two-factor authentication, and warn your bank to be on the lookout for suspicious transactions.

How do keyloggers get onto your computer?

Keyloggers are typically installed by Trojan horse malware. These programs pretend to be useful utilities, but in reality, their only purpose is to infect your device with viruses. People often inadvertently install Trojans when they download apps from third-party websites, open malicious email attachments, or use cracked software.

Hardware-based keyloggers exist, too, but these are far less common. There are several types, but most sit between your keyboard and the USB port, capturing the signal of every keypress. Acoustic keyloggers work by analyzing tiny differences in the sound that each key makes when pressed. There are even electromagnetic emission keyloggers that capture electrical pulses leaking into the air from your keyboard cable.

How to detect a keylogger

The longer a keylogger goes undetected, the more information it can steal. That’s why keyloggers hide, disguise themselves, and try to avoid appearing in the list of installed programs. Detection usually only comes after a virus scan or a thorough examination of running processes, apps, and browser extensions. However, many legitimate programs and websites have keylogger-like abilities, so your antivirus may raise false positives or, worse, overlook real threats.

If you suspect you have a keylogger on your device, here are a few ways to find out:

• Check Task Manager for any processes you don’t recognize. If you find any, check online to see if they’re viruses. Sometimes, malware processes have randomly-generated names to prevent this kind of verification. If searching for a process online yields no results, or if the process changes its name, it’s probably malicious.
• Make sure you know which apps are allowed to run at startup. If you see anything suspicious, right-click the process name and hit Disable. Then, click Open file location and note the location down so we can have our antivirus scan it later.

  

• Check which apps are using your data. Press Windows+I at the same time, then move to Network & Internet > Data usage. Google any apps you don’t recognize to see if any are keyloggers.

  

• Look for suspicious browser extensions. Just open the browser’s menu and hit the option labeled Extensions, Manage extensions, or something similar. Check your installed extensions to see if there are any you don’t recognize.

  

How to remove a keylogger

A keylogger that is easily discovered is effectively useless. That’s why some go even further than dynamically changing their code or filenames. Keyloggers may hide within the operating system itself (a “rootkit” virus) or at an even lower system level (hypervisor malware).

Because these viruses are often more sophisticated than typical malware, they require a specialized solution. This usually means using anti-rootkit or anti-spyware programs, rather than relying on your usual antivirus app.

Follow these steps to get rid of keyloggers for good:

1. First, install a reputable antivirus app with anti-keylogger functionality. I suggest MalwareBytes Anti-Rootkit, SpyShelter, or Norton 360.
2. Disconnect from the internet and run a full system scan.
3. Delete any malicious apps that are found.
4. If no keyloggers or rootkits are detected but you want to be completely sure you’re safe, reinstall your operating system.
5. Change important passwords (email, online banking, social media, and so on). Be on the lookout for unusual login notifications or password-reset attempts moving forward.
6. If you believe financial accounts were compromised, tell your bank as soon as possible. They can freeze your account, preventing unauthorized transfers or credit applications.
7. Finally, make sure your operating system is up to date and set up regular malware scans on your device. This will limit the avenues of attack and should stop most keyloggers from ever being installed in the first place.

Conclusion

Keyloggers are a particularly nasty form of malware because they’re hard to detect and often difficult to remove. Specialized removal tools are freely available but deletion is just the first step. Keyloggers can steal a lot of sensitive data quickly so you’ll also have to audit your accounts, change passwords, and install a robust keylogger-detection tool to prevent future infections.