Removing spyware that captures screen recordings

Removing spyware that captures screen recordings and uploads them starts with isolation and careful cleanup. Disconnect the affected computer from the internet, unplug external drives, and do not reconnect until the intrusion is contained.

Many Australians move between home broadband, mobile connections and free Wi-Fi around Sydney, Melbourne and Brisbane. A malicious download can exploit that switch, while a convincing pop-up may distract you from the device's compromise.

The intruder may record the whole desktop, capture one browser tab or steal clips already saved on the computer. Recent macOS versions normally request screen-recording permission, but many Windows infections avoid that prompt through other capture methods. A missing permission is therefore not proof that the system is clean.

Removal involves more than deleting the visible application. Scheduled tasks, browser components, cloud accounts and uploaded recordings may remain elsewhere. Preserve relevant evidence and ignore pop-ups demanding payment or remote access to remove the problem.

Contain the infection and protect your accounts

Turn off Wi-Fi, disconnect the Ethernet cable and unplug external storage. On Windows, disabling the network adapter is stronger than airplane mode. Do not reconnect merely to download a cleaner; use a known-clean computer or phone for tools and password changes.

From that device, change your email password first, then banking, cloud storage and other important accounts. Use unique passwords, a password manager and multi-factor authentication. Sign out old sessions, review authorised devices and forwarding rules, and rotate recovery codes where possible. Changing a password does not remove a live keylogger.

Separate real security tools from fake warnings

A trojan can display a fake antivirus interface, claim that the screen is being recorded and demand payment. Treat such messages as hostile. The guide to removing a fake antivirus explains how to handle a lock-screen scam without paying. Never install software or call a number supplied by the warning itself.

Australian shoppers may encounter legitimate offers for Norton, McAfee or Malwarebytes in stores and online marketplaces, but imitation utilities can copy their names. Download scanners only from the vendor's official website. Record the warning and note any file or site named for later investigation.

Remove spyware from Windows and Mac

On Windows, open Settings > Apps > Installed apps and uninstall programs you did not install, especially screen recorders, remote-access tools and unknown installers. Sort by installation date if useful. If uninstall is blocked, use Safe Mode or an offline scan instead of forcing it.

Check Task Manager's Startup tab, Task Scheduler and services for unfamiliar entries. On macOS, inspect Applications, Login Items under Users & Groups, and Privacy & Security > Screen Recording, Accessibility and Full Disk Access. Revoke access for unknown applications, but remember that browser-only capture may not need desktop permission.

Use one reputable on-demand scanner, such as Malwarebytes or ESET, alongside built-in protection. Run a quick scan, a full scan and Microsoft Defender Offline Scan on Windows; on Mac, use a reputable full scan and restart. Recheck after restarting, and avoid stacking real-time cleaners, which can interfere with removal.

Clean downloads, browser extensions and startup items

After the scan is clean, remove browser extensions you cannot explain. Open each browser's extension manager, including hidden or developer-mode items, and revoke permissions for page capture, clipboard access and broad website access. Clear suspicious downloads and temporary files after checking that legitimate documents are backed up. Check shortcuts and default browser settings for unauthorised changes.

On Windows, follow the process for drive-by download cleanup to remove unwanted downloads and persistence. Work through it in order and re-scan after major changes. Reset the browser only if extension and profile checks fail, and check alternate profiles on Mac. If sync restored a malicious extension, change the browser account password and review synced settings.

Assess what the spyware may have exposed

Consider what the spyware was built to capture, not just when it was installed. Full-desktop recording can expose account numbers, one-time codes, medical appointments, work chats and photographs displayed in other windows. Browser-only capture may show less, yet saved passwords, cookies and session tokens can still permit account takeover.

Search for recently created video files, but do not play unknown clips on a clean machine. If the malware remains installed, its temporary capture directory may still exist; a qualified technician can quarantine it without opening the contents. Review cloud accounts for unfamiliar shared folders and active sessions. A clean scan cannot prove that copies uploaded to a remote server were deleted, so keep relevant logs and screenshots.

Follow Australian privacy and reporting requirements

Australian organisations covered by the Privacy Act 1988 must handle personal information under the Australian Privacy Principles. If unauthorised access exposes customer or employee data, the organisation may need to contain the incident, assess the risk and notify affected people and the Office of the Australian Information Commissioner. A screen recording can contain personal information, so the data type and likely harm matter.

Not every home-user infection triggers formal notification, and smaller organisations may have different duties. Guidance published by the Australian Signals Directorate supports containment and recovery, while ReportCyber accepts reports of cybercrime and online scams. eSafety can assist with image-based abuse involving children. Preserve original evidence and use the appropriate reporting channel rather than emailing sensitive recordings.

Recover safely and prevent reinfection

After cleanup, restore trusted software and documents in small batches. Keep separate copies of important files before attempting repairs, and do not reinstall suspicious utilities merely because they carry a familiar brand name. Search for confirmed malware variants and use established recovery tools with current, tested backups.

Update the operating system and browser, remove unused extensions and enable automatic updates. Keep real-time protection active, use FileVault on Mac and a trusted password manager with multi-factor authentication. Back up data to encrypted storage or a reputable cloud service, and test restoration from a clean device. Australians sharing work and home spaces can reduce exposure by separating browsers and avoiding unknown USB drives.