processes like Notepad or browser have legit reasons for accessing clipboard in short bursts, typically associated with keyboard and mouse activity. The vast majority of processes have no business accessing clipboard whatsoever. Is there a way to monitor the "process reads clipboard" events in order to identify potential spyware?

  • 1
    What version of Windows are we talking about? In Vista an Windows 7 you must give permission to an application to access the contents of the system clipboard. – Ramhound Apr 13 '12 at 13:34
  • 1
    @Ramhound, I don't believe this to be the case. My own apps access clipboard on Windows 7 without any permissions setting popup. Similarly, when I install other people's apps like Notepad++ they access clipboard (to do paste) again without any permissions. – EndangeringSpecies Apr 14 '12 at 10:35

Try Debugviewer, from Microsoft Sysinternals Suite:

DebugView is an application that lets you monitor debug output on your local system, or any computer on the network that you can reach via TCP/IP. It is capable of displaying both kernel-mode and Win32 debug output, so you don't need a debugger to catch the debug output your applications or device drivers generate, nor do you need to modify your applications or drivers to use non-standard debug output APIs.

  • I'm not seeing clipboard events. Is there a particular setting and filter for that? That would make this an answer. – Vimes Oct 22 '14 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.