What is Stalkerware? How to Detect and Remove It on Windows

Stalkerware is software secretly installed on someone's device so another person can watch what they do, often a current or former partner. On Windows it can record keystrokes, take screenshots, log websites and messages, or give remote access to the screen. This guide explains how stalkerware works, how to check a Windows PC for it, and why your safety should come before stalkerware removal on Windows.

What stalkerware is, and what it isn't#

Stalkerware is defined by how it is used, not by a specific technology. The same capabilities appear in legitimate products:

That last row matters. A lot of what feels like stalkerware is actually account access: someone knows your Microsoft, Google or Apple password, or is still signed in to your browser sync, and sees your activity from their own device. No software on your PC is involved at all.

Warning signs on a Windows PC#

None of these prove stalkerware is present, but together they are worth investigating:

• Someone knows things they could only know from your messages, searches or documents.
• Settings changed that you did not change, such as Windows Defender being turned off or exclusions added.
• A program, service or scheduled task you never installed, especially with a vague name.
• Remote access software installed, or a remote session indicator appearing.
• Unknown devices or sign-ins in your Microsoft, Google or email account activity.
• Another user account on the PC that you did not create.
• The PC was out of your possession, even briefly, before the problems started.

Safety planning before you remove anything#

This is the step most guides skip. If the person who installed the software is controlling or abusive, removing it can escalate the situation, because they lose access suddenly and may realize you found it.

Before you act:

1. Use a safe device for research and support, one the other person has never had access to, such as a friend's phone or a library computer.
2. Contact a support service. The Coalition Against Stalkerware lists organizations that help. In the US, the National Domestic Violence Hotline is 1-800-799-7233. In the UK, the National Domestic Abuse Helpline is 0808 2000 247. Elsewhere, look for local domestic abuse services.
3. Consider documenting evidence. Screenshots or photos of the software, its folder and its install date may be useful if you decide to involve the police or seek a protective order.
4. Decide on timing with your support worker. Sometimes it is safer to leave the software in place and use a different device for sensitive things until you are ready.

How to check a Windows PC for stalkerware#

When it is safe to do so, these checks cover the places stalkerware usually hides.

Run a security scan

Open Windows Security → Virus and threat protection and run a Full scan, then a Microsoft Defender Offline scan, which restarts the PC and scans before Windows loads. Also check Manage settings → Exclusions for folders or files someone may have excluded from scanning.

Review installed programs and accounts

Sort Settings → Apps → Installed apps by install date and look for programs you do not recognize, particularly remote access tools, keyloggers, "monitoring" or "parental control" software. Then check Settings → Accounts → Other users for accounts you did not create, and Settings → Accounts → Access work or school for an unexpected connected account.

Check services, startup items and tasks

Stalkerware needs to start automatically, so check the Task Manager Startup apps tab, services.msc, and Task Scheduler Library for entries pointing to unfamiliar programs, often in C:\ProgramData or your AppData folder. Our guide on finding hidden programs on a laptop covers hidden uninstall entries and auto-start locations in detail.

Check network settings

Look at Settings → Network and internet → Proxy for a proxy you did not set, and open certmgr.msc to check Trusted Root Certification Authorities for unfamiliar certificates, which can allow traffic interception.

See what was installed, and when, with UniClean#

Stalkerware relies on going unnoticed in long, cluttered lists. UniClean's Audit Log shows the full installation history of the PC in one place: install date, publisher, install location and who or what installed each program, including entries hidden from Installed apps. Matching an install date to a time when someone else had access to the PC can be revealing, and the Audit Log view is also easy to photograph as evidence.

UniClean runs fully offline, sends no telemetry and needs no account, so using it does not send anything to a third party. It can also run in Portable Mode from a USB drive without installing. Risk Tiers flag drivers and system components as High Risk so you do not remove something Windows needs by mistake.

Removing stalkerware once you are ready#

When you and your support worker decide it is safe:

1. Secure your accounts first, from a safe device. Change passwords for your Microsoft account, email and anything sensitive, turn on two-step verification, and sign out of all other sessions. Review signed-in devices for your Microsoft account.
2. Uninstall the software from Installed apps, or with UniClean, which also removes leftover services, tasks, folders and registry keys and keeps a vault backup.
3. Remove other accounts, proxies, certificates and remote access tools you did not set up.
4. Consider a full reset using Settings → System → Recovery → Reset this PC with Remove everything if you cannot be sure the PC is clean.
5. Change your Windows sign-in PIN and password afterward, and keep the PC physically secure.

If the software turns out to be work-related rather than personal, our guide on detecting employer monitoring software explains the difference and what to do next.