How do you look for keyloggers in command prompt?

Answer 1

You have to find it first. This can be difficult because may key loggers are designed to hide and not show up in your task manager, program list, or directory

The best way to find it is to use a software program that has been developed to detect and remove elusive applications, such as keyloggers and rogue antivirus programs. Malwarebytes Anti-Malware (Malwarebytes has free malware removal) is an effective and safe choice. It will remove every associated registry value and file so that hopefully the key logger cannot repair itself and continue operating.

As an example - here are the directions to remove the keylogger Actual Spy Keylogger:

This is the risk that manual removal involves. Because each file name is so similar to another, it is easy to miss one or two. It is just as easy to delete a necessary file inadvertently. In either case, you may damage your computer's performance. It is best to use automatic removal unless you have extensive technical experience. In that case, try the following to remove Actual Spy Keylogger:

Kill Processes:

asmonitor.exe

actualspy.exe

asmonitor.exeunins000.exe

actualspy.exe

unins000.exe

Remove Registry Values:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1urlupdateinfo

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1urlinfoabout

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1uninstallstring

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1quietuninstallstring

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1publisher

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1norepair

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1nomodify

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1installlocation

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:user

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:setupversion

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:selectedtasks

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:icongroup

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:deselectedtasks

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1innosetup:apppath

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1helplink

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1displayname

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1displayicon

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1

HKEY_LOCAL_MACHINE\Software\ActualSpy

HKEY_CURRENT_USER\Software\ActualSpy

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 urlupdateinfoHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ActualSpy

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 urlinfoabout

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 uninstallstring

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 quietuninstallstring

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 publisher

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 norepair

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 nomodify

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 installlocation

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: user

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: setup version

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: selected tasks

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: icon group

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: deselected tasks

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 inno setup: app path

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 helplink

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 displayname

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1 displayicon

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1

HKEY_LOCAL_MACHINE\Software\ActualSpy

HKEY_CURRENT_USER\Software\ActualSpy

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Actual Spy

Delete DLLs:

ssleay32.dll

hprog.dll

hk.dll

libeay32.dll

Delete Files:

f.bat

asmonitor.exe.manifest

actualspy.chm

unins000.dat

url.dat

screenshots.dat

uninstallactualspy.lnk

readme.lnk

actualspy.lnk

actualspyhelp.lnk

ssleay32.dll

hprog.dll

hk.dll

libeay32.dll

asmonitor.exe

actualspy.exe

unins000.exe

file_id.diz

actual spy.lnk

actual spy help.lnk

As you can see, removing it manually is a detailed process and you might still miss something - and there is no guarantee that even THIS keylogger hasn't changed since this answer was posted such that it renders these instructions out-of date.