If Bitcoin is not stolen from an address for some months does it suggest that malware did not capture the key?
It is a fallacy of the alternative disjunct to assume that your private key is in fact private, just because a potential other party has not used it: The two events "somebody has gained access to my private key" and "nobody has used my private key" are not disjunct.

If you are uncertain whether your private key has been compromised, you should move your bitcoins to a securely created new address.