How to remove spyware that captures desktop screenshots

This step-by-step guide to removing spyware that takes screenshots of your desktop is designed for Windows and Mac users in Australia. Screenshot malware may quietly capture banking sessions, work documents, private messages, or customer information, then upload the images to a remote server. It can operate without obvious pop-ups, so unfamiliar background processes, new image files, unusual network activity, or a rapidly draining battery deserve attention.

Avoid using the suspected computer for banking, tax services, email, or password changes until it has been checked. If the device belongs to an employer, school, or small business in Sydney, Melbourne, Brisbane, or elsewhere, contact the administrator before deleting files because the screenshots may form part of a security investigation. The information on this site is educational, as explained in the site disclaimer.

Disconnect the device and preserve useful evidence

First, disconnect Wi-Fi and unplug the Ethernet cable. On a laptop connected through an Australian NBN modem, disabling Wi-Fi from the system settings is preferable to simply closing the lid. Do not connect an external drive or phone to copy files, since malware may spread or collect data from removable storage.

Take note of when the problem began, which applications were open, and whether you noticed image files, flashing command windows, or sudden upload activity. Photographing suspicious messages with another device can help. Do not open unknown screenshots or archives, and do not delete everything immediately if the computer is used for business, medical work, or legal matters.

Run trusted scans in a controlled state

Update the security software on a clean device if the affected computer cannot reach the internet safely. On Windows, start with Microsoft Defender, then run a full scan. If the threat appears persistent, use Microsoft Defender Offline, which restarts the computer and scans before many malicious processes can load. A reputable second-opinion scanner can detect spyware families that the first tool misses.

Windows users can enter Safe Mode from Advanced Startup options and repeat the scan there. Safe Mode loads fewer drivers and startup programs, making it harder for screenshot malware to hide. On macOS, review system updates, run the built-in security checks, and use a reputable Mac security scanner. Be cautious with “cleaner” apps advertised in pop-ups, as some are unwanted programs themselves.

Check startup locations and running processes

After scanning, inspect programs that launch automatically. In Windows, Task Manager’s Startup apps section can reveal an unfamiliar publisher or a recently added executable. Also review installed applications, browser extensions, scheduled tasks, and folders such as AppData. Do not remove a file solely because its name looks technical; verify its publisher, installation date, location, and online reputation first.

On a Mac, check Login Items under System Settings, Activity Monitor, browser extensions, and suspicious files in LaunchAgents or LaunchDaemons. A legitimate Apple process can look unfamiliar, while malware may use a name similar to a trusted application. If you need deeper visibility into processes and connections, these Sysinternals network checks can help Windows users investigate anomalous activity.

Remove confirmed unwanted applications using their official uninstaller or the operating system’s normal removal process. Then restart and scan again. Avoid manually deleting system files, registry entries, or launch agents unless a trusted security professional has identified them, because an incorrect change can make Windows or macOS unstable.

Investigate accounts, browsers, and remote access

Screenshot spyware often arrives through a cracked application, a fake update, a malicious email attachment, or a browser download. Remove extensions you do not recognise, reset the browser, and check whether the homepage, search provider, proxy, or notification permissions changed. Review remote-access programs such as AnyDesk, TeamViewer, or unfamiliar support utilities and uninstall them if they were not authorised.

If you used Skype, Zoom, Teams, or another communication app while the infection was active, assume that related information may be exposed. Review account sessions, revoke unfamiliar devices, and enable multifactor authentication. Guidance on call-recording spyware is also relevant because spyware may collect several forms of screen, audio, and activity data.

Change passwords from a separate, clean device, beginning with email, banking, cloud storage, and social media. Australian users should contact their bank promptly if online banking was open during the suspected infection, and report serious cybercrime or identity concerns through the Australian Cyber Security Centre and Scamwatch channels.

Decide whether cleaning is enough

A clean scan is encouraging, but it does not prove that every persistence mechanism has gone. Check for recurring processes, newly created screenshots, unexpected outbound connections, and altered security settings over the next several days. Keep operating systems, browsers, and applications patched, and download software only from official publishers or established Australian retailers rather than torrents and unofficial “activators.”

If spyware returns after removal, the safest option may be to back up personal documents after scanning them, erase the system drive, and reinstall Windows or macOS from official media. Restore only clean documents, not unknown executables, cracked software, or old browser profiles. The comparison below summarises the main checks for each platform.

Check	Windows	macOS
Offline or controlled scan	Microsoft Defender Offline and Safe Mode	System updates and a reputable Mac security scanner
Startup review	Task Manager, installed apps, scheduled tasks, AppData	Login Items, Activity Monitor, LaunchAgents, LaunchDaemons
Browser inspection	Extensions, proxy, notifications, homepage	Extensions, proxy, notifications, homepage
Network investigation	Firewall logs, active connections, Sysinternals tools	Firewall settings, Activity Monitor, security scanner
Escalation option	Reset or clean reinstall Windows	Erase and reinstall macOS

If the device contains confidential customer records, passwords, payment details, or work material, involve the relevant IT team and preserve logs before wiping it. Prompt isolation, careful scanning, and account protection limit the damage while giving you a clearer path to a secure, usable computer.