Computer spyware and malware inspection

What computer spyware looks like

Software placed on a computer to gather information often doesn’t look like a “virus”. In many cases the tool is legitimate: remote support programs, parental control software or employee monitoring tools. Installed without the owner’s knowledge, they let someone watch your screen, log your typing and reach your files. Antivirus often won’t flag them because technically they aren’t malicious; the problem is how, and by whom, they are used.

We also look for remote access trojans, keyloggers, malicious browser extensions and compromised email accounts.

Hardware is checked too

Not all monitoring is software. A small hardware keylogger between the keyboard cable and the computer records everything you type to its own memory and never shows up in a software scan. So we start physically: keyboard and mouse connections, USB ports, adapters, docking stations and, on desktops, inside the case. For wireless keyboards we check the receiver too.

What the system review covers

• User accounts and admin rights, including accounts added later
• Startup programs, scheduled tasks and background services
• Remote access and support tools, their install dates and connection logs
• Browser extensions, saved sessions and synced accounts
• Email forwarding rules, filters and connected apps
• Security software status and changes to its settings
• Network connections and the addresses the computer regularly contacts

Forwarding rules matter. Someone who gets into your mailbox once can create a rule that copies every incoming message to them, and it keeps working after you change your password.

Forensics and data integrity

Where needed we analyse logs and suspicious files with forensic tools while preserving data integrity. If the findings might be used in legal proceedings, tell us before we start so we can document how data is acquired and stored; see our digital evidence and technical reporting service.

In a corporate environment

We work alongside your IT team, agreeing which devices are in scope, which permissions apply and how to coordinate with your security tooling. Typical triggers are an employee departure, a suspected leak or a sensitive project. If discretion matters, involve only the IT staff who need to know.

Before the inspection

• Contact us from a device and email account you don’t suspect.
• Don’t reset the computer, delete suspicious programs or run a system restore.
• Don’t change passwords from the suspected computer; a keylogger would record the new ones.
• If you notice unfamiliar hardware, don’t touch or move it. Photograph it.

Outcome

You receive the findings in writing, with file paths and timestamps. If something is found, we plan the order of clean-up and account security, typically securing accounts from a clean device first and cleaning the suspect system after. If nothing is found we list what was examined and note that this is not absolute proof against advanced threats.