Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows-XP machine as my desktop system at work. Is there any way to tell if there is keystroke logging software running on my system or any other software that may be monitoring my system for my activity?

share|improve this question

closed as off topic by Zoredache, Chris S, Scott Pack, Iain, Ben Pilbrow Jan 5 '11 at 20:11

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Discuss this issue with your system administrator. – John Gardeniers Jan 5 '11 at 20:50

Ask your admin. Hopefully, you're not the admin.

share|improve this answer

If you can (or if you're really really paraniod), ctrl-alt-delete and look for processes you're not sure about under Task Manager. Name of the .exe + google is your friend.

Then again, if you think you shouldn't be doing it at work, don't.

If you have agreed to a ToS while using their IT systems they may have a paragraph about keyloggin or screen monitering, but ultimately your IT department should have more important things to worry about.

share|improve this answer
It's not necessarily a program that will show up in the processes list; might a device driver for the "keyboard" or something similar. There's plenty of ways to hide what's really going on. – Chris S Jan 5 '11 at 19:55
@Chris, of course this wouldn't protect aginst a hardware keylogger or something like that, it was just an idea. – tombull89 Jan 5 '11 at 21:12

No, if a system has been compromised, there is no way to tell while the system is running.

Testing windows from offline media can be very difficult since there isn't really a good source of checksums for all standard files.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.