10

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE).

Windows Defender is flagging my installer as "malicious":

Trojen:Win32/Fathale.B!plock

Same with Symantec, and probably other antivirus/malware detection tools too.

I've had similar false-positive "malware alert" issues before with Symantec, supposedly due to the file being recent and/or having very few downloads, but these older versions didn't use a Win32 low-level keyboard hook, and AFAIK weren't flagged as "malicious" by Windows Defender.

I have NOT implemented a key logger; I do NOT handle WM messages sent anywhere other than the VBE's active code pane, and I have NOT intentionally packaged malware with my installer.

Does merely using a keyboard hook inherently make software "malicious"? Or is there a way to use them that doesn't trigger a malware alert?

Or does "Trojan:Win32/Fathale.B!plock" have completely nothing to do with that and it turns out there is something that somehow managed to sneak into my installer package?

Improve this question
4
  • FWIW the release page is here, and the software is open-source, if anyone feels like dissecting the actual thing.
    – Mathieu Guindon
    Commented Apr 30, 2016 at 0:16
  • 1
    I am getting same thing. Did you use innoSetup?
    – user109547
    Commented May 3, 2016 at 20:31
  • @xenon yes, I'm using InnoSetup to create the installer. InstallShield was a complete nightmare with COM registration, and using WiX was going to be a project of its own; InnoSetup made everything relatively simple, and we had an installer that worked for both 32-bit and 64-bit environment and VBA hosts.
    – Mathieu Guindon
    Commented May 3, 2016 at 20:35
  • 1
    I'm also using a keyboard hook for reasons other than key-logging. I imagine this is happening quite often and to be honest, the fact that a keyboard hook is not detected scares me. This has to make someone wonder how many apps are in fact using keyboard hooks. In my opinion, a keylogger is the worst of malicious software. It is a major violation of privacy. My question is, how would I even detect if an app has a keyboard hook?
    – Michael Z.
    Commented Apr 13, 2017 at 1:49

1 Answer 1

Reset to default
3

The biggest clue came in a comment:

I am getting same thing. Did you use innoSetup?

And I did.

The conversation here points to a problem involving Inno Setup seemingly generating what appears to be a matching signature for a trojan:Win32/Fathale.B!plock.

Submit the installer to the Microsoft Malware Protection Center.

If your installer is indeed "clean", you should eventually get a response along these lines:

The submitted file is Clean.
We will remove the detection for this sample.

Nothing to do with keyhooks =)

Improve this answer
1
  • 1
    For the record I'm also getting this, though not using innoSetup but writing WiX by hand. The resolution is the same though (submit the installer) ...
    – Fetchez la vache
    Commented Jun 14, 2016 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .