I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick up the windows of one of the instances and drag it around quickly. The CPU usage on one of the processes goes up, presumably as that process' paint message is rapidly called (assuming your system does "Show window contents while dragging").

Today I wondered if my system has a keylogger. I imagined a hardware keylogger using the OS for its software components and thought there might be some way to detect it without dismantling my computer, but the search hits I got were mostly for software keyloggers and using anti-Malware software to detect them. If you activate Windows Task Manager and then just hit lots of keys on the keyboard (gently!), then any process that is recording them would presumably start using some CPU. I wondered if it would use enough CPU to bring it to the top. When I try it, I can get dwm.exe and csrss.exe and taskhost.exe to come up. I think this shows that it is possible to use this method to find a process that is watching the keyboard, but it takes some discernment.

Does this seem plausible, and is this technique one that is resilient to camouflage methods that malware authors might take?

  • 2
    You asked about a hardware keylogger; by definition a hardware keylogger has an independent CPU and an independent process table. Suggest you modify the question to ask about software keyloggers.
    – MCW
    Commented Dec 3, 2012 at 12:14
  • @MarkC.Wallace An independent process table? Why would a hardware keylogger need an entire operating system and not just an event loop in firmware for a microcontroller?
    – forest
    Commented May 29, 2019 at 4:20

3 Answers 3


Efficient malware will manipulate the kernel internal structure so as not to appear at all in the list of process (then again, a hide-and-seek game between malware and malware detectors; see for instance this page for some information). Thus, you will not see anything in the task manager.

Even if the keylogger does appear as a task in the task manager, key logging, in its basic forms, is extremely inexpensive. My first computer could keep track of all I typed with its 6809E CPU, running at the blazing speed of 1 MHz. A basic PC is more than 10000 times faster than that, and will thus need no more than 1/10000th of its CPU to log key strokes. To see that in the task manager, you will need sharp eyes... To complicate the setup, there are a lot of process which exhibit some regular activity even when nominally idle; this is typical of process with background garbage collection activity.

And, of course, when you look at the task manager, you observe, among the list of process, the task manager itself, which uses CPU to update the list as graphically rendered on the screen...

  • Agreed - there are a lot of better ways to find such activity. As a good example of how little CPU this will need - I can stream 1080p video over my WiFi and display it at full resolution (whilst decoding it from H.264) and use only ~15% of my CPU's entire throughput. I hardly think saving a few ASCII characters to disk will reach enough cycles to make Task Manager display even 1% for the process.
    – Polynomial
    Commented Dec 2, 2012 at 23:43
  • Yeah, would be better to look for IO on network or the filesystem (depending if it saves it to a log or sends it straight out, and it would still be very hard to detect the increase).
    – ewanm89
    Commented Dec 3, 2012 at 0:29
  • @ewanm89 Agreed, and at that point why not just use Wireshark and tcpview? :)
    – Polynomial
    Commented Dec 3, 2012 at 9:43

Completely useless against anything but the university project of a computer security student.

You can make processes appear another process's name or not at all without too much difficulty. Also you can get hardware key loggers which can take the raw signal from your keyboard and store it to a memory stick or broadcast it over wifi.

  • 4
    You must have a pretty dim view of university students.
    – lynks
    Commented Dec 3, 2012 at 18:57

To detect a keylogger on PC, open task manager and search for processes other than the programmes you have installed. You can also search on the web for it .This is the most effective way. The reason why keyloggers are so hard to detect is that they're not illegal. Most people think they are because of the ways hackers use them (which is illegal). However it is not illegal to install keyloggers on your own computer to monitor your kids, or to monitor your employees for business. Due to those reasons, They are allowed to be sold legally, and are protected from being detected easily. There are some methods of detection, but programmers know them and change them to go undetected from those methods.

  • Keylogger processes can be named like known Windows processes, or can inject themselves into valid Windows processes.
    – schroeder
    Commented Jun 24, 2014 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .