How to detect a keylogger on Windows, step by step

A keylogger is a program, or a small plug, that records what you type: passwords, messages, card numbers. They are not common on a normal home PC, but you can check for one yourself in about half an hour, with tools that are already in Windows.

1. What a keylogger is, and how it gets on a PC

There are two kinds:

• Software keyloggers: a program that runs quietly in the background and saves or sends what you type. It usually arrives with something you downloaded: a "free" version of a paid program, a game cheat, an e-mail attachment, or a fake update. Sometimes it is a "monitoring" app someone installed on purpose.
• Hardware keyloggers: a small adapter, often looking like a USB stick or a plug, put between the keyboard cable and the computer. It needs someone to have had hands-on access to your PC.

Signs are often weak or missing. A slow PC, a flickering mouse or a "laggy" keyboard are usually not a keylogger; updates, a full disk or an old battery are far more common. That is why checking is better than guessing.

2. Check what starts with Windows

A keylogger wants to run every time you switch on the PC, so it usually adds itself to the startup list.

1. Press Ctrl + Shift + Esc to open Task Manager. If you see only a small window, click More details.
2. Open the Startup tab (Windows 11: Startup apps on the left).
3. For each entry you don't know, right-click it › Search online. Most entries are normal: your sound driver, OneDrive, a printer helper.
4. If something is unknown and you don't need it, right-click › Disable. This only stops it from starting; nothing is deleted, and you can switch it on again.

Want to see more? Microsoft's free Autoruns tool (part of Sysinternals) lists every place a program can start from, including scheduled tasks and services. It shows a lot; only change what you understand.

3. Check what is running right now

1. In Task Manager, open Processes (Windows 11: the first icon on the left).
2. For a name you don't know, right-click it › Open file location.
3. Where is the file? Programs in C:\Program Files or C:\Windows are in the normal places. A program you don't know in AppData, Temp or Downloads deserves a closer look. (AppData is a hidden folder in your user folder where programs keep their settings; malware likes it because no administrator rights are needed to write there.)
4. Who made it? Right-click the file › Properties › Digital Signatures. A digital signature is like a seal that shows which company published the program. A missing tab means the file is not signed. That alone is not proof of anything, but together with a strange folder it is worth checking.

Many svchost.exe entries are normal: Windows runs many of its services this way.

4. Check what is installed

• Settings › Apps (Windows 11: Apps › Installed apps): sort by install date and look for anything new that you didn't install yourself.
• Watch out for "monitoring", "parental control", "spy" or remote-control tools you didn't choose.
• Also check your browser extensions (in the browser's menu › Extensions). An extension can read what you type into web pages. Remove the ones you don't know or use.

5. Run a full scan with Windows Security

1. Open Windows Security (type it into the Start menu) › Virus & threat protection › Scan options.
2. Choose Full scan › Scan now. It takes a while; you can keep working.
3. If you are still unsure, choose Microsoft Defender Offline scan. The PC restarts and is scanned before Windows starts, so a program that hides while Windows runs can be found. Save your work first.

If you use another antivirus program, run its full scan instead.

6. Check for a hardware keylogger

• Follow the keyboard cable to the PC. It should go straight into the USB port. A small extra plug or "adapter" in between that you didn't put there is a warning sign.
• On a desktop PC, also check the back of the computer. On a laptop, the built-in keyboard is hard to tamper with; check any external keyboard.
• Device Manager (right-click Start › Device Manager) › Keyboards may show an extra keyboard you don't own. Many hardware keyloggers don't show up at all, so the look at the cable matters most.
• This is mainly a concern on shared or public computers, or in an office where others have access. At home, with a PC nobody else touches, it is rare.

7. Why "sending out" is the weak spot of every software keylogger

A software keylogger is only useful to its owner if the recorded keys reach them. So the program has to connect to the internet and send data out. Windows lets every program connect out by default, without asking you. If programs had to ask once before they may connect out, an unknown keylogger would show up the first time it tried, and you could say no.

No single check is 100% safe: a keylogger can hide inside a browser extension, or send through a program you already allow. But each step above makes it much harder.

8. If you find something

1. Take the PC off the network: unplug the cable or switch off Wi-Fi.
2. Remove it with Windows Security or your antivirus program, and uninstall programs you don't want (Settings › Apps).
3. Change important passwords from another, clean device, starting with e-mail and banking, and switch on two-step sign-in.
4. If banking or card details may be affected, call your bank.
5. At work: tell your IT team before changing anything, so they can keep the evidence. At home: if in doubt, back up your personal files and ask a trusted IT professional, or reinstall Windows.

9. See what sends data out, at any time, with Coinetic

Doing this by hand means...

• a snapshot: Task Manager shows this moment, not the program that sent data out at 3 a.m.;
• no say in the matter: Windows lets every program connect out by default, so you only find out afterwards, if at all;
• bare addresses: even when you look at connections, you see numbers, not who owns them or which country they are in;
• remembering to check again next month.

Coinetic works through the Windows Firewall that is already there. Setup installs a protection service that works in the background, also when nobody is logged on. Coinetic is not an antivirus program and does not remove viruses; keep Windows Security for that. What it does is show you, and let you control, what talks to the internet.

• Every new program asks once before it may send data out: switch outbound control on, and a program that tries to connect out for the first time asks you, with its publisher and digital signature, where it wants to go and a recommended choice. Allow it, allow it only on your own network, or block it. The Programs page lists every decision.
• Unusual behaviour stopped automatically: in every plan, Coinetic learns what is normal for your PC for 7 days. An unsigned program in a folder like Temp, AppData or Downloads that connects to the internet raises an alert. A program that "phones home" at regular intervals, as remote-control malware does, can be cut off from the internet automatically. You can release it with one click.
• Every connection, with a name: the Connections page shows the live connections with the program, the remote address, who owns it and the country. The live log shows every allowed and blocked connection.
• Is that program who it claims to be? Right-click a connection or log line › Process info shows the publisher and the digital signature. From the same menu you can block the program or stop it.
• A one-click security check: it lists what to fix, for example firewall rules for programs that no longer exist in folders users can write to, with an explanation and fixes you can undo.
• At any time, not just once: this is not a one-time check. Open Coinetic whenever you like and see which programs connect out now, which asked before and what you decided. The Overview shows green when you are protected.
• Your AI security analyst (Pro + AI): right-click any line, program or connection and choose Ask AI, e.g. “Which programs on this PC send data to the internet, and is any of them new or unsigned?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

Coinetic runs on Windows 7 to 11 and Windows Server 2008 R2 to 2025, in any Windows language.

More guides: all Coinetic guides.

Frequently asked

Can Windows Security find keyloggers?

Yes, it finds known keylogger programs. A full scan, and if in doubt an offline scan, is a good first step. It cannot find a hardware keylogger, and a brand-new program may not be known yet. That is why looking at startup programs and controlling what sends data out also help.

Is a slow or laggy keyboard a sign of a keylogger?

Rarely. A weak wireless keyboard battery, a busy PC or a driver problem are far more likely. Check the steps above instead of guessing.

Can a keylogger see passwords that I paste or fill in automatically?

A simple keylogger records only keys, so a password manager that fills in passwords helps. More capable spyware can also read the clipboard or the screen. Two-step sign-in protects your accounts even if a password is stolen.

Does a firewall stop keyloggers?

The standard Windows Firewall mostly controls what comes in; it lets programs send data out freely. A firewall that makes new programs ask before they connect out can stop a keylogger from sending what it recorded. It does not remove the keylogger; use your antivirus program for that.