Removing spyware that records keystrokes in Windows clipboard history

Spyware that captures keystrokes can expose passwords, messages, banking details, recovery codes and workplace documents. When Windows clipboard history is enabled, copied material may also remain available through the Win+V panel, giving an attacker another way to collect sensitive information.

This type of infection is often associated with a keylogger, remote-access trojan, malicious browser extension or cracked software package. Warning signs can include unexplained clipboard entries, sluggish performance, unknown background processes, new startup items and security alerts that repeatedly return.

The safest response is to stop using the affected computer for email, banking and password changes. Use a separate, trusted device where possible. Australian users should contact their bank promptly if credentials or payment information may have been exposed, especially if unusual activity appears in a CommBank, Westpac, ANZ or NAB account.

The steps below focus on containment, investigation and removal. Some spyware hides deeply or reinstalls itself through scheduled tasks, so a clean Windows installation may eventually be safer than attempting repeated manual repairs.

Recognise clipboard and keylogging symptoms

Open clipboard history with Windows + V and look for copied text you do not recognise. Spyware may collect plain-text passwords, authentication codes, cryptocurrency wallet data or snippets copied from a password manager. Clipboard history itself is a legitimate Windows feature, so unfamiliar entries are a warning sign rather than proof of infection.

Other symptoms include random text appearing in documents, delayed keystrokes, unknown processes in Task Manager and browser sessions that become signed out unexpectedly. Check whether the activity began after installing a free utility, game cheat, unofficial driver or software bundle downloaded from an untrusted website.

Do not paste suspicious clipboard content into a document or online scanner. Treat it as potentially sensitive. Photographing the screen with another device can preserve useful evidence without copying the data into another application.

Contain the infected Windows computer

Disconnect Wi-Fi and unplug Ethernet as soon as practical. This can interrupt communication with a command-and-control server and reduce the chance that the attacker receives newly typed information. If the device is managed by an employer or school, notify the relevant IT team before deleting files or changing system settings.

From a separate clean device, change important passwords, starting with email, banking, cloud storage and password-manager accounts. Revoke active sessions, replace exposed recovery codes and enable multifactor authentication. Avoid changing passwords on the suspected computer because the keylogger could capture every new credential.

If clipboard history contains banking details or identity information, keep records of what may have been exposed. Scamwatch and the Australian Cyber Security Centre provide current guidance for scams, identity theft and account compromise, while IDCARE can assist with identity-related incidents in Australia.

Scan for keyloggers and persistence

Run Microsoft Defender from Windows Security after disconnecting the computer from the internet. Update security intelligence if possible, then select a full scan. Microsoft Defender Offline is useful when malware interferes with normal Windows operation because it scans before the regular desktop and many startup processes load.

A second-opinion scanner from a reputable security vendor can identify adware, spyware and potentially unwanted applications that Defender misses. Download it directly from the vendor’s official website using a clean device if necessary. Avoid “PC cleaner” programs that create alarming detections and demand payment for removal.

Inspect Task Manager’s Startup apps and remove entries you can confidently identify as malicious. You can also review installed applications, browser extensions, scheduled tasks and unfamiliar services. Do not delete random files from the Windows or System32 folders; record their names and research them through trusted security sources first.

Use Safe Mode when normal cleanup fails

Safe Mode loads a limited set of drivers and services, which can prevent some keyloggers from launching. In Windows 11 or Windows 10, open Settings, go to System Recovery, choose Advanced startup and select Restart now. From the recovery menu, choose Troubleshoot, Advanced options, Startup Settings and Restart, then select Safe Mode with Networking only if downloading a trusted scanner is necessary.

Run a full security scan in Safe Mode and remove suspicious applications, browser extensions and scheduled tasks. Check the hosts file and proxy settings if browsers are being redirected, but save a backup before editing system configuration. A restore point can help reverse unwanted changes, although malware may also survive a standard system restore.

If the infection returns after rebooting, scan from a Defender Offline environment or a reputable bootable rescue disk. Persistent spyware may use registry run keys, services or task scheduling to reinstall itself, and manual removal can leave behind components that continue monitoring keyboard input.

Clear exposed clipboard data and accounts

After the computer is considered clean, clear Windows clipboard history by opening Windows + V and selecting Clear all. You can also use Settings to disable clipboard history if you do not need synchronisation across devices. Do not enable cloud clipboard syncing while investigating an active infection, because copied material could be transferred to other devices.

Review browser password stores, autofill information, saved payment cards and active login sessions. Delete credentials that may have been typed while spyware was running and recreate them from the clean device. Work accounts should be reported to the organisation’s security team so they can inspect sign-in logs and revoke tokens.

A keylogger can capture more than passwords. It may record search terms, private messages and text entered into government or health portals. Assume all information typed during the exposure window may be compromised and prioritise accounts according to financial and personal risk.

Compare practical removal options

The best method depends on the malware’s persistence, the importance of the computer and whether reliable backups exist. A simple unwanted extension can often be removed quickly, while a stealthy remote-access trojan deserves a more decisive response.

Removal approach	Best suited to	Main advantage	Important limitation
Full Microsoft Defender scan	Common spyware and keyloggers	Built into Windows and easy to start	May miss heavily obfuscated malware
Second-opinion scanner	Adware, PUPs and overlooked components	Adds independent detection	Requires careful source selection
Safe Mode or Defender Offline	Malware that blocks normal tools	Reduces active interference	Some technical steps are required
Professional forensic review	Work or high-value systems	Preserves evidence and examines persistence	Can be expensive
Clean Windows reinstall	Persistent or uncertain compromise	Provides the strongest reset	Applications and data must be restored safely

File recovery knowledge is also useful when spyware arrives with destructive malware. For example, these Maze recovery steps explain how free tools may help after a ransomware incident, although they do not replace a clean backup or remove an active infection.

Prevent another clipboard spy attack

Keep Windows, browsers and security software updated, and download programs from official publishers or established Australian retailers. Avoid pirated applications, key generators and unofficial streaming utilities, which are common delivery methods for credential-stealing malware.

Use a password manager that fills credentials rather than requiring every password to be typed. Hardware security keys or passkeys provide stronger protection against many forms of password theft, while multifactor authentication limits damage when a password is exposed.

Useful habits for Australian home and small-business users include:

• Disable clipboard history and cloud clipboard synchronisation when they are unnecessary.
• Review browser extensions and startup applications every few months.
• Keep offline or versioned backups disconnected from the computer.
• Use separate accounts for everyday work and Windows administration.
• Report suspicious banking activity immediately to the bank and relevant Australian support services.

If ransomware follows a spyware infection, avoid paying before checking recovery options and preserving encrypted files. Guidance on Medusa file restoration covers a different threat, but its emphasis on backups, evidence preservation and cautious recovery is equally relevant to a compromised Windows system.