Any well-behaved keystoke logger is going to hide the process, hook itself to another process (winlogin.exe, explorer.exe) so you are not going to see it. Even the really dumb ones do things like naming themselves similar to other processes.
Over the years I've seen many, many viruses and keystroke loggers that evade or even actively disable AV/anti-spyware programs. Some do things like patching explorer.exe in memory, installing a hacked version of IE, or similar shenanigans.
I've done some investigative work using the eBlaster app which, at the time, was ignored by AV and anti-spyware vendors as a legit program. It ran as a hidden process, and unless somebody was really, really good, they could not spot that program on the PC.