Cleaning keylogger spyware that hides logs in plain text files

A growing share of malicious programs targeting Australian households no longer rely on flashy ransom notes or screen-locking screens. Instead, they slip quietly into the background and start recording every keystroke you type, then dump those captured characters into a hidden text file buried somewhere inside your profile folders. These keylogger variants have been detected across home networks from Sydney to Perth, often arriving bundled with pirated software, fake browser updates, or attachments that impersonate Australia Post and the ATO.

The malware author usually configures the log file to use the .dat or .log extension and hides it with the hidden file attribute so it does not show up in a normal File Explorer view. Many strains also rename the file to something bland such as sysinfo.txt or winhelp.log, then ship the contents to a remote server every few hours through HTTPS, bypassing basic firewalls. Because the file is plain text, antivirus software that focuses on encrypted payloads can overlook it for weeks.

For Australian users who manage their superannuation, lodge tax returns through myGov, or move money between Commonwealth Bank, ANZ, Westpac, and NAB accounts, the implications are severe. A keystroke capture that runs for a single evening can hand an attacker session cookies, account passwords, and the answers to security questions used by banks and the ATO. Under the Notifiable Data Breaches scheme governed by the Office of the Australian Information Commissioner, organisations hit by credential theft must report affected customers, but individuals often discover the problem only when money has already moved.

This guide walks through how to recognise this specific type of spyware, how to shut it down on a Windows PC, and how to clean up the trail it leaves behind. It also points to two related resources for readers who want a deeper walkthrough of Safe Mode cleanup and location-tracking spyware removal.

How keylogger spyware stores captured keystrokes in hidden text files

Most commercial-grade keyloggers create a hidden file in a path such as %APPDATA%, %LOCALAPPDATA%, or a subfolder of ProgramData. The file is usually timestamped every few hundred keystrokes, then the malware compresses or encrypts the payload before exfiltration. Some samples, however, skip encryption entirely and write raw UTF-8 characters straight into a hidden text file because plain text is faster to parse and easier for the attacker to sift through later.

Open the Run dialog with Win+R, type appdata, and check whether any unfamiliar folders contain .txt, .dat, or .log files that you did not create. Sort by date modified and focus on files updated within the current session. Even legitimate Windows services sometimes leave traces in similar paths, so cross-reference anything suspicious against the file owner using the Properties dialog.

Recognising the warning signs before damage spreads

A PC infected with keystroke-capture spyware rarely slows dramatically, which makes detection harder than with ransomware or cryptominers. Instead, users notice smaller symptoms: a drop in browser performance, unfamiliar processes inside Task Manager, or hard-drive activity that spikes whenever an idle browser tab loads a banking page. Australian small businesses using Xero or MYOB often spot the problem only after a fraudulent invoice is detected during reconciliation.

Watch for these behavioural clues:

• New .txt or .log files appearing in user folders with timestamps that match your typing sessions.
• Outbound network traffic in Resource Monitor that remains steady even when no application is open.
• Antivirus alerts referencing Win32/Spy or TrojanSpy categories, which Microsoft Defender labels in plain English.
• Battery drain on laptops that suddenly worsens after installing an unknown program.

Preparing the machine before you start cleaning

Before any deletion takes place, disconnect the affected computer from Wi-Fi and unplug the Ethernet cable. Pulling the network forces the spyware to operate blind for a few minutes, which prevents further keystrokes from being uploaded while you work. If you rely on a Telstra, Optus, or TPG home modem, powering it off for the duration of the cleanup is enough.

Next, make a full image or file-level backup of your user folders to an external USB drive you have never plugged into that PC before. The backup lets you recover documents you might accidentally wipe during cleanup and lets security analysts inspect the captured logs afterwards. Skip backing up program files, AppData, or anything inside ProgramData because the malware almost certainly lives there.

If you manage credentials from a password manager such as 1Password, Bitwarden, or Keeper, export your vault to the same offline drive. Web browser saved passwords should be considered compromised and reset from a known-clean device, ideally one running an updated copy of Windows 11 or macOS Sonoma hosted on a separate network.

Booting into Safe Mode to stop the spyware

Standard startup loads every entry in the Run and RunOnce registry keys, and most keyloggers register themselves there so they launch at logon. By booting into Safe Mode with Networking, Windows loads only the drivers and services required for basic operation, which keeps the malware from starting and makes its files easier to delete. A clear walkthrough of this technique is available in the Safe Mode deletion guide for Windows systems.

Once you reach the desktop, open Command Prompt as Administrator and run dir /a:h "%APPDATA%" to surface hidden text files that the malware uses for storage. Delete anything that does not belong to a known application, then clear the Temp folder, the Prefetch directory, and any scheduled tasks created during the infection window. Reboot the machine normally before continuing.

Removing the spyware components fully

With Safe Mode work complete, scan the system from a second, clean device using a bootable antivirus tool such as Kaspersky Rescue Disk or the ESET SysRescue Live environment. These tools mount the file system externally, scan outside Windows, and erase any boot-sector hooks the keylogger may have installed. They also catch driver-level payloads that silently load even in Safe Mode.

After the offline scan, re-enter Windows and run Microsoft Defender along with a second opinion scanner such as Malwarebytes or HitmanPro. Review the Quarantine list, research each flagged file, and remove anything related to keylogging, clipboard capture, or screen scraping. Restart once more, then verify that the hidden text files flagged earlier have not regenerated.

Recovering accounts and resetting credentials

Cleanup is only half the job. Treat every password typed during the infection window as exposed. Rotate the credentials for email, banking, superannuation portals, and any work-related accounts accessed from that machine. The Australian Cyber Security Centre recommends enabling multi-factor authentication on every service that supports it, ideally through an authenticator app rather than SMS because SIM-swap fraud remains common in cities such as Melbourne and Brisbane.

Run a credit history check through Equifax or illion if your PC handled financial applications, and notify your bank if you spot unfamiliar transactions. Citizens worried about identity theft can also contact IDCARE, the national identity and cyber support service funded by the Australian government, for free specialist advice.

Different cleanup tools vary in depth and cost. The comparison below outlines the most common options used by Australian home users and small offices.

Tool	Type	Offline boot capable	Free tier	Best for
Malwarebytes	On-demand scanner	No	Yes	Quick second-opinion scans
Kaspersky Rescue Disk	Bootable ISO	Yes	Yes	Persistent infections
ESET SysRescue	Bootable USB	Yes	Yes	Rootkit and bootkit cleanup
HitmanPro	On-demand scanner	No	30-day trial	Legacy keylogger families
Microsoft Defender	Built-in	Limited	Yes	Day-to-day protection

Stopping the next keylogger from landing

Prevention centres on small habits that Australian households can adopt without buying enterprise software. Keep Windows Update on automatic and apply patches released through Microsoft's Tuesday cycle, even if the update restarts the PC during a workday. Pair this with browser extensions such as uBlock Origin to block malicious ad networks that often deliver keyloggers through compromised news portals.

Habits worth building into a regular routine include:

• Avoiding downloads of "free" copies of paid software, especially utilities advertised on search results above the organic listings.
• Treating every email claiming to be from myGov, the ATO, or Australia Post with caution, and logging in only by typing the address yourself.
• Enabling the built-in credential guard in Windows 11 Pro or the equivalent BitLocker plus TPM combination on supported machines.
• Scheduling a quarterly offline scan as part of a household digital spring clean, much like testing smoke alarms in October.

Readers dealing with a related strain that pairs keystroke logging with location exfiltration can find additional context in the location spyware removal walkthrough.