I think that your question (Will Antivirus detect keyloggers?) has been answered.
I'd like to take a step back and examine the broader issues - because sometimes the answer to a question isn't really the answer you're seeking.
First, I must respectfully disagree with @Polynomial's opinion. I think your core notion is fantastic. It doesn't matter what security controls you deploy if your users aren't at least tacitly compliant. RSA was brought down because an administrative assistant reached into a sequestered email message and clicked on a link. You're trying to change user behavior by providing a clear feedback cycle; this is a technique which has been proven to be effective. I believe that a keylogger is the wrong "mission" or payload to deploy in this campaign. I believe that a sufficient payload would be a redirect to a page containing your company's policy. If you need to go beyond that, you could include one of the sample viruses used by antivirus companies to test their products. (I can't find a link to one, but if you have a legitimate need, I'm confident that you'll be able to find one).
Second, I'm not sure I understand why you're looking at antivirus. If your goal is to test the effectiveness of your antivirus, then I would suggest you rely on other people's research. There are sites that publish comparitive research. But ultimately 90% of the antivirus products are going to be adequate against 90% of the attacks you find. I don't have the current numbers, but the majority of viruses in the wild are common viruses.
Third, let me combine those two observations. Antivirus is designed to reduce the likelihood that you'll be the victim of opportunistic attack. If you want to test your reslience against opportunistic attack, you need a different test strategy. (simple scans are probably sufficient). Fake Phishing attacks like what you describe are designed to test your resilience against targeted attacks; antivirus programs are worthless against targeted attacks.
I believe you need to take a step back and decide what kind of security policy/implementation you want (what is your risk tolerance). Once you know that, then design threat scenarios and test cases against those. Confusing user behavior with keyloggers with antivirus indicates to me that you don't have a coherent risk management strategy.