Editing Keystroke logging (section)

=== Anti-spyware / Anti-virus programs ===
Many [[anti-spyware]] applications can detect some software based keyloggers and quarantine, disable, or remove them. However, because many keylogging programs are legitimate pieces of software under some circumstances, anti-spyware often neglects to label keylogging programs as spyware or a virus. These applications can detect software-based keyloggers based on patterns in [[Subroutine|executable code]], [[heuristics]] and keylogger behaviors (such as the use of [[Hooking|hooks]] and certain [[Application programming interface|API]]s).

No software-based anti-spyware application can be 100% effective against all keyloggers.<ref>{{Cite journal|last=Creutzburg|first=Reiner|date=2017-01-29|title=The strange world of keyloggers - an overview, Part I|url=https://www.ingentaconnect.com/content/ist/ei/2017/00002017/00000006/art00019|journal=Electronic Imaging|volume=2017|issue=6|pages=139–148|doi=10.2352/ISSN.2470-1173.2017.6.MOBMU-313}}</ref> Software-based anti-spyware cannot defeat non-software keyloggers (for example, hardware keyloggers attached to keyboards will always receive keystrokes before any software-based anti-spyware application).

The particular technique that the anti-spyware application uses will influence its potential effectiveness against software keyloggers. As a general rule, anti-spyware applications with [[Ring (computer security)|higher privileges]] will defeat keyloggers with lower privileges. For example, a hook-based anti-spyware application cannot defeat a kernel-based keylogger (as the keylogger will receive the keystroke messages before the anti-spyware application), but it could potentially defeat hook- and API-based keyloggers.