Also, on Windows, KeePass at least offers the option to always ask for the master password only in the same secure desktop that UAC and login/logout use. (I don't know why this isn't the default behavior, other than maybe cross-platform compat, but it is not the default. First thing I turn on for fresh installs.) That at least helps mitigate against most software keyloggers / remote automation hack attempts. (Leading the threat concerns back to rootkits and physical hardware access.)