MonitoringTool:Win32/KGBKeylogger!dll

Detected by Microsoft Defender Antivirus

Aliases: KGB Keylogger (Sophos)

MonitoringTool:Win32/KGBKeylogger!dll is a detection for a DLL component of a monitoring tool that records keystrokes and the user's websites-visiting activities.

To detect and remove this program and other unwanted software that may be installed in your computer, run a full-system scan with an up-to-date antispyware product such as the following:

Threat behavior

MonitoringTool:Win32/KGBKeylogger!dll is a detection for a DLL component of a monitoring tool that records keystrokes and the user's websites-visiting activities.

Installation

MonitoringTool:Win32/KGBKeylogger!dll - a part of MonitoringTool:Win32/KGBKeylogger - can be installed as %ProgramFiles%\KGB\MPK.dll and loaded by MonitoringTool:Win32/KGBKeylogger .

Execution

Logs user activities

MonitoringTool:Win32/KGBKeylogger!dll installs multiple window hooks to intercept keystroke events and mouse events.

MonitoringTool:Win32/KGBKeylogger!dll also intercepts the following WINSOCK APIs to monitoring network activities:

ws2_32.dll!send
ws2_32.dll!WSASend
ws2_32.dll!recv
ws2_32.dll!WSARecv

MonitoringTool:Win32/KGBKeylogger!dll records the keystrokes and the websites visited and shares this logged data with its other component.

Analysis by Shawn Wang

Prevention

Follow these general security tips to better protect your computer.

System changes

The following system changes may indicate the presence of this monitoring tool:

The presence of the following file:

%ProgramFiles%\KGB\MPK.dll

MonitoringTool:Win32/KGBKeylogger!dll

Summary

What to do now

Technical information

Threat behavior

Installation

Execution

Prevention

Symptoms

System changes