Monitoring-Tool

Threat description

Details

Category: Riskware
Type: Monitoring-Tool
Platform: W32

Summary

A program that monitors and records all actions on a computer, including keystrokes entered.



Removal

Automatic action

Once detected, the F-Secure security product will block the suspect file until further user confirmation is received.

Exclusion

If you are aware of and accept the potential risks associated with a program classed as Riskware, you may choose to exclude it from future scans by the F-Secure security product.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:



Technical Details

Monitoring-tools are programs that allow a user to monitor the activities taking place on a computer system where the software is installed. Monitoring may either be done in real time, or the data may be logged in a file for later retrieval.

Usage of monitoring-tools in a business environment may be considered legal, depending on the workplace policies or legal guidelines applicable in that particular country.

In a malicious context, monitoring-tools may be dropped onto a target machine by trojans and spyware, which carry them as part of their payload.

More

The Type designation 'Monitor' was previously used by F-Secure to identify a program that can monitor and record all computer activities, including each keystroke typed on the keyboard.

With changes in the threat landscape today, programs previously identified as 'Monitor' would now be classified under the Riskware Category, with the Type designation 'Monitoring-Tool'.

The update in naming better clarifies the program's overall security profile in the current, more complex threat landscape.





Description Created: 2009-11-05 07:52:11.0

Description Last Modified: 2011-11-10 3:00:00.0


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More