My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE).

Windows Defender is flagging my installer as "malicious":


Same with Symantec, and probably other antivirus/malware detection tools too.

I've had similar false-positive "malware alert" issues before with Symantec, supposedly due to the file being recent and/or having very few downloads, but these older versions didn't use a Win32 low-level keyboard hook, and AFAIK weren't flagged as "malicious" by Windows Defender.

I have NOT implemented a key logger; I do NOT handle WM messages sent anywhere other than the VBE's active code pane, and I have NOT intentionally packaged malware with my installer.

Does merely using a keyboard hook inherently make software "malicious"? Or is there a way to use them that doesn't trigger a malware alert?

Or does "Trojan:Win32/Fathale.B!plock" have completely nothing to do with that and it turns out there is something that somehow managed to sneak into my installer package?

  • FWIW the release page is here, and the software is open-source, if anyone feels like dissecting the actual thing. Apr 30, 2016 at 0:16
  • 1
    I am getting same thing. Did you use innoSetup?
    – user109547
    May 3, 2016 at 20:31
  • @xenon yes, I'm using InnoSetup to create the installer. InstallShield was a complete nightmare with COM registration, and using WiX was going to be a project of its own; InnoSetup made everything relatively simple, and we had an installer that worked for both 32-bit and 64-bit environment and VBA hosts. May 3, 2016 at 20:35
  • 1
    I'm also using a keyboard hook for reasons other than key-logging. I imagine this is happening quite often and to be honest, the fact that a keyboard hook is not detected scares me. This has to make someone wonder how many apps are in fact using keyboard hooks. In my opinion, a keylogger is the worst of malicious software. It is a major violation of privacy. My question is, how would I even detect if an app has a keyboard hook?
    – Michael Z.
    Apr 13, 2017 at 1:49

1 Answer 1


The biggest clue came in a comment:

I am getting same thing. Did you use innoSetup?

And I did.

The conversation here points to a problem involving Inno Setup seemingly generating what appears to be a matching signature for a trojan:Win32/Fathale.B!plock.

Submit the installer to the Microsoft Malware Protection Center.

If your installer is indeed "clean", you should eventually get a response along these lines:

The submitted file is Clean.
We will remove the detection for this sample.

Nothing to do with keyhooks =)

  • 1
    For the record I'm also getting this, though not using innoSetup but writing WiX by hand. The resolution is the same though (submit the installer) ... Jun 14, 2016 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .