11

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE).

Windows Defender is flagging my installer as "malicious":

Trojen:Win32/Fathale.B!plock

Same with Symantec, and probably other antivirus/malware detection tools too.

I've had similar false-positive "malware alert" issues before with Symantec, supposedly due to the file being recent and/or having very few downloads, but these older versions didn't use a Win32 low-level keyboard hook, and AFAIK weren't flagged as "malicious" by Windows Defender.

I have NOT implemented a key logger; I do NOT handle WM messages sent anywhere other than the VBE's active code pane, and I have NOT intentionally packaged malware with my installer.

Does merely using a keyboard hook inherently make software "malicious"? Or is there a way to use them that doesn't trigger a malware alert?

Or does "Trojan:Win32/Fathale.B!plock" have completely nothing to do with that and it turns out there is something that somehow managed to sneak into my installer package?

  • FWIW the release page is here, and the software is open-source, if anyone feels like dissecting the actual thing. – Mathieu Guindon Apr 30 '16 at 0:16
  • 1
    I am getting same thing. Did you use innoSetup? – user109547 May 3 '16 at 20:31
  • @xenon yes, I'm using InnoSetup to create the installer. InstallShield was a complete nightmare with COM registration, and using WiX was going to be a project of its own; InnoSetup made everything relatively simple, and we had an installer that worked for both 32-bit and 64-bit environment and VBA hosts. – Mathieu Guindon May 3 '16 at 20:35
  • 1
    I'm also using a keyboard hook for reasons other than key-logging. I imagine this is happening quite often and to be honest, the fact that a keyboard hook is not detected scares me. This has to make someone wonder how many apps are in fact using keyboard hooks. In my opinion, a keylogger is the worst of malicious software. It is a major violation of privacy. My question is, how would I even detect if an app has a keyboard hook? – Michael Z. Apr 13 '17 at 1:49
3

The biggest clue came in a comment:

I am getting same thing. Did you use innoSetup?

And I did.

The conversation here points to a problem involving Inno Setup seemingly generating what appears to be a matching signature for a trojan:Win32/Fathale.B!plock.

Submit the installer to the Microsoft Malware Protection Center.

If your installer is indeed "clean", you should eventually get a response along these lines:

The submitted file is Clean.
We will remove the detection for this sample.

Nothing to do with keyhooks =)

  • 1
    For the record I'm also getting this, though not using innoSetup but writing WiX by hand. The resolution is the same though (submit the installer) ... – Fetchez la vache Jun 14 '16 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.