A program that monitors and records all actions on a computer, including keystrokes entered.
Based on the settings of your F-Secure security product, it may block the file from running, move it to the quarantine where it cannot spread or cause harm, or ask you to select an action.
Monitoring-Tool:W32/PCDM.A is a riskware application designed to perform monitoring activities in a computer. The program must be manually installed on the computer system.
According to the application's product page, the program has the following features/functionalities:
Log Report and Emailing
Here is a screenshot of its user interface:
The default installation is to the following location:
At this location are saved the program's main binary files and components:
Collected Log files for each users are stored in the following folder:
Note:%Program Files% is the environment variable for the Program Files Directory, which is typically the C:\Program Files folder.
%Documents and Settings% is the environment variable for the Documents and Settings Directory, which is typically the C:\Documents and Settings folder.
Though the program claims to be running in stealth mode, it does not implement any high level techniques to hide its process and folders, the former being easily identified using freely available tools, as seen in this screenshot of three different tools used to view the processes (click for larger view):
Folders can be made visible by making certain changes to the Windows Folder Options settings, as can be seen in the image below (click for larger view):
The following are the registry entries created by the program:
Where "=" is the installation directory of the program and "hd" is its parameter indicating that the program be run as hidden.
Date Created: 2010-06-29 05:57:41.0
Date Last Modified: 2010-07-01 04:21:56.0