sodcalculator

10 Tech How-To

Remove Snake Keylogger Malware: PC Cleanup Guide

Guide 10-6225 · Updated · Step by step

Snake Keylogger is a stealthy info-stealer that records keystrokes, captures clipboard data, and exfiltrates credentials and files. This guide walks you through removing it from a Windows PC using built-in tools and free utilities, then locking down your accounts. You’ll need a second device (phone or another computer) to download tools and change passwords, and a USB drive if your PC is severely infected.

What You’ll Need

  • A second device (phone/tablet/other PC) with internet access
  • A USB flash drive (8GB or larger) if you need to transfer tools offline
  • Your Microsoft account credentials (for password reset)
  • Patience – full removal can take 1–2 hours

Step-by-Step

  1. Disconnect from the internet. Unplug Ethernet or turn off Wi-Fi. This stops the keylogger from sending your data and prevents remote commands.
  2. Boot into Safe Mode with Networking. Restart your PC, press and hold Shift while clicking Restart, then go to Troubleshoot → Advanced options → Startup Settings → Restart. Press 5 or F5 for Safe Mode with Networking. Safe Mode loads only essential drivers, which often stops the malware from auto-starting.
  3. Back up critical files (optional but smart). Copy important documents to an external drive or cloud storage (only if you’re sure they’re not already compromised). Do not back up executables or scripts.
  4. Run Windows Defender offline scan. Open Windows Security (shield icon in system tray), go to Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. This scans before Windows fully loads, catching rootkit-like components. Allow it to remove anything found.
  5. Install and run Malwarebytes (from a clean device). On your second device, download Malwarebytes Free, transfer via USB (or download directly if you’re in Safe Mode with Networking). Install, update, then run a full scan. Quarantine all detections, especially anything named “SnakeKeylogger” or “Keylogger”.
  6. Check startup entries and scheduled tasks. Press Ctrl+Shift+Esc to open Task Manager → Startup tab. Disable any suspicious entries (unknown publishers, random names). Then open Task Scheduler (Win+R, type taskschd.msc) and look for tasks that run at logon or every few minutes – right-click and disable/delete anything you didn’t create.
  7. Review installed programs. Go to Settings → Apps → Installed apps. Sort by install date and uninstall anything unrecognized. Also check browser extensions (Chrome/Edge: chrome://extensions) and remove unknown ones.
  8. Check network connections. Open Command Prompt as admin (Win+X → Terminal (Admin)), type netstat -b and look for suspicious external IPs. Note any process names you don’t recognize – research them later.
  9. Run a second opinion scanner. Use HitmanPro (free trial) or Kaspersky Virus Removal Tool (free). These catch what others miss. Let them clean.
  10. Reset browser settings and clear data. In each browser, go to settings → Reset/restore settings. This removes malicious proxies, homepages, and injected scripts.
  11. Change all passwords from a clean device. After confirming the malware is gone, change passwords for email, banking, social media, and any site you used on that PC. Use a password manager. Enable two-factor authentication (2FA) wherever possible.
  12. Monitor your accounts. Watch for unauthorized transactions or login alerts for the next few weeks. Consider a credit freeze if financial data was exposed.

Common Mistakes

  • Reconnecting to the internet too soon. If you go online before removal, the keylogger can send new data and download more malware.
  • Only running one scanner. No single tool catches everything. Use at least two different engines.
  • Ignoring browser extensions. Keyloggers often hide as extensions. They survive a Windows reinstall if you sync browsers.
  • Changing passwords on the infected PC. The keylogger will capture the new passwords. Always use a different device.
  • Skipping Safe Mode. Running scans in normal mode lets the malware defend itself and hide.

Tips

  • Use a clean boot. If Safe Mode doesn’t work, use msconfig to disable all non-Microsoft services, then run scans.
  • Back up your registry before editing. If you manually delete entries, export a backup first (regedit → File → Export).
  • Keep Windows and software updated. Keyloggers often exploit known vulnerabilities.
  • Use a standard (non-admin) account daily. Limits the damage malware can do.
  • Consider a fresh OS install if you can’t be sure. If scans keep finding nothing but you still see suspicious activity, reinstalling Windows is the most reliable fix.

Troubleshooting

Scans keep finding the same file. The malware may be protected by a service or driver. Boot into Safe Mode (without networking) and run the scan again. If it persists, use the tool’s “force removal” or boot from a rescue disk (e.g., Kaspersky Rescue Disk).

You can’t boot into Safe Mode. Try Windows Recovery Environment (WinRE) by interrupting boot 3 times (power off during boot). Or use a Windows installation USB to access Startup Repair.

Malwarebytes won’t install. The keylogger might block installation. Rename the installer file (e.g., to “fix.exe”) and try again. Or run it from a USB drive in Safe Mode.

You see new processes spawning after cleanup. This indicates a leftover component. Check scheduled tasks again, and scan with HitmanPro. If it continues, back up data and do a clean install.

Passwords were already stolen. Immediately contact your bank and email provider. Change passwords from a clean device and enable 2FA. Watch for identity theft signs.

Frequently Asked Questions

Q: How did I get Snake Keylogger?
A: Usually via phishing emails with malicious attachments (like a fake PDF or Word doc), cracked software, or drive-by downloads from compromised websites.

Q: Can Snake Keylogger be removed without reinstalling Windows?
A: Yes, in most cases using safe mode and multiple scanners. But if you can’t be 100% sure it’s gone, a clean install is safer.

Q: Does Snake Keylogger steal passwords saved in browsers?
A: Yes, it can extract saved credentials from Chrome, Edge, Firefox, and other browsers, along with cookies and autofill data.

Q: Will a factory reset remove it?
A: Yes, but only if you reset the entire drive (not just “refresh”). Use the “Reset this PC” option and choose “Remove everything”. Note: Some malware can persist in firmware, but that’s rare.

Q: How do I know if my PC is infected?
A: Signs include slow performance, unexpected pop-ups, new toolbars, unusual network activity, or if your accounts get compromised. But keyloggers often run silently – if you suspect, scan.

Q: Should I pay a ransom if ransomware appears?
A: No. Snake Keylogger is not ransomware, but if you see a ransom note, don’t pay. Restore from backups or use decryption tools.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →