Threat Description



Aliases: Monitor, monitoring-tool, not-a-virus:Monitor, Monitoring-Tool:​w32/, Monitor.win32
Category: Riskware
Type: Monitoring-Tool
Platform: W32


A program that monitors and records all actions on a computer, including keystrokes entered.


Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Exclude from scanning

If the user is aware of the security risks involved and wishes to proceed with installing and using a program identified as Riskware, they may elect to exclude (whitelist) the application's folder from subsequent scanning. Product documentation for various versions of F-Secure products are available on the Documentation section of the website.

Technical Details

When searching our Virus Descriptions database for a specific program (e.g., Monitoring-Tool:W32/Example.A), you may be directed to this page if the overview below sufficiently describes the program.

Alternatively, you may be directed to this page if no description matching that specific query is currently available. You can submit a sample of the suspect file to our Response Lab for further analysis via:

About Monitoring-Tools

Monitoring-tools are programs that allow a user to monitor the activities taking place on a computer system where the software is installed. Monitoring may either be done in real time, or the data may be logged in a file for later retrieval.

Usage of monitoring-tools in a business environment may be considered legal, depending on the workplace policies or legal guidelines applicable in that particular country.

In a malicious context, monitoring-tools may be dropped onto a target machine by trojans and spyware, which carry them as part of their payload.


The Type designation 'Monitor' was previously used by F-Secure to identify a program that can monitor and record all computer activities, including each keystroke typed on the keyboard.

With changes in the threat landscape today, programs previously identified as 'Monitor' would now be classified under the Riskware Category, with the Type designation 'Monitoring-Tool'.

The update in naming better clarifies the program's overall security profile in the current, more complex threat landscape.


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More