what?? I don't care how they do it, as long as they are using a resource I can detect the presence of one, thats all it's supposed to do, not detect "where" or "what" but just if ones there or not -_-'

if I make millions of keypresses per minute and they store to the HDD you will notice the HDD size going up up up, even the ram would be going up up up, or network usage if they broadcast is right away, either way you look at it somethings going to increase so once you know it's there you can take proper steps to finding and removing it, I'll figure out some detection methodes, including the hook detector that RoyK mentioned, mabe a display like Spy++ shows since it shows keyboard hooks threads and everything