Keyboard hook causes virus false alarm
If a tool or demo that you have downloaded from here is detected as a virus Dont't Panic just yet, just take a few minutes to read about it and educate yourself first. We have a very clean development environment and use Norton Corporate Anti-Virus on our development machines which is updated daily. Also, do not take our word for it. You can test any file against 41 of the best virus scanners out by using http://www.virustotal.com When in doubt, Test it.
That said people (usually) use common sense to determine whether a situation warrants an alert. If you took a rifle on a hunting trip, nobody would pay much attention to it - if you took it to the supermarket or a movie theatre, the reactions would be quite different. It's the same rifle, but it is used under different circumstances, which makes a big difference. Your anti-virus software does not have any common sense, it cannot know if you are installing a software willingly or if someone else is installing it. Therefore it will issue an alert, and that's the way it should be.
In addition, many anti-virus programs will warn you about "hook" related dangers. A "hook" is a way for an application to capture keyboard input. This is often used for hotkeys (press some keyboard keys to start the app, or make it do something) and a common programming technique. Unfortunately the same type of technique is used by many keyloggers - they use the "hook" method to capture your keystrokes, instead of keyboard commands.
A lot of the tools here use #UseKeyboardHook so we can detect when the user presses a key on the keyboard. This makes the tools more responsive and is sometimes needed to work with a game at all. Otherwise the game just over rides your hot keys and the tool will ignore the commands you are trying to send it. As a developer we want the tools to work and we do not want them shown as a "virus"... But, that said, we USE these tools ourselves and if we have to choose between them working like we want or failing some random virus scan, we will choose the working side. After all, it is not a virus but an illusion, we just wrote it! And we could just as easily write a program that would "detect" McAfee and Norton as a virus. The way they act, I am not sure we would be wrong...
For instance, the Control Assistant uses hot keys to trigger events. Without the keyboard hook they just do not work reliably. We have tested it 20 different ways. But when we include it some virus scanners then mark it as spyware. Remember: You can test any file against most scanners out by using http://www.virustotal.com in one shot. It is a really nice site for this. If you have any concerns at all about a file upload it to virustotal and scan it.
Here is a test of the Control Assistant with keyboard hook installed. As you can see it failed 1 out of 41 scanners because it "Behaves like spyware" by waiting for you to press a hot key that you set up yourself in remote box controls:
File ControllerDemo.exe received on 2010.05.20 21:10:03 (UTC)
Result: 1/41 (2.44%)
publisher....: www.pcgametools.com
copyright....: PC Game Tools
product......: The Control Assistant
description..: The Control Assistant
original name: Controller.exe
internal name: Controller.exe
file version.: 0.5.0.2
a-squared | 4.5.0.50 | 2010.05.10 | - |
AhnLab-V3 | 2010.05.20.01 | 2010.05.20 | - |
AntiVir | 8.2.1.242 | 2010.05.20 | - |
Antiy-AVL | 2.0.3.7 | 2010.05.19 | - |
Authentium | 5.2.0.5 | 2010.05.20 | - |
Avast | 4.8.1351.0 | 2010.05.20 | - |
Avast5 | 5.0.332.0 | 2010.05.20 | - |
AVG | 9.0.0.787 | 2010.05.20 | - |
BitDefender | 7.2 | 2010.05.20 | - |
CAT-QuickHeal | 10.00 | 2010.05.20 | - |
ClamAV | 0.96.0.3-git | 2010.05.20 | - |
Comodo | 4896 | 2010.05.20 | - |
DrWeb | 5.0.2.03300 | 2010.05.20 | - |
eSafe | 7.0.17.0 | 2010.05.20 | - |
eTrust-Vet | 35.2.7501 | 2010.05.20 | - |
F-Prot | 4.6.0.103 | 2010.05.20 | - |
F-Secure | 9.0.15370.0 | 2010.05.20 | - |
Fortinet | 4.1.133.0 | 2010.05.20 | - |
GData | 21 | 2010.05.20 | - |
Ikarus | T3.1.1.84.0 | 2010.05.20 | - |
Jiangmin | 13.0.900 | 2010.05.20 | - |
Kaspersky | 7.0.0.125 | 2010.05.20 | - |
McAfee | 5.400.0.1158 | 2010.05.20 | - |
McAfee-GW-Edition | 2010.1 | 2010.05.20 | Heuristic.BehavesLike.Win32.Spyware.J |
Microsoft | 1.5802 | 2010.05.20 | - |
NOD32 | 5133 | 2010.05.20 | - |
Norman | 6.04.12 | 2010.05.20 | - |
nProtect | 2010-05-20.02 | 2010.05.20 | - |
Panda | 10.0.2.7 | 2010.05.20 | - |
PCTools | 7.0.3.5 | 2010.05.20 | - |
Prevx | 3.0 | 2010.05.20 | - |
Rising | 22.48.03.04 | 2010.05.20 | - |
Sophos | 4.53.0 | 2010.05.20 | - |
Sunbelt | 6329 | 2010.05.20 | - |
Symantec | 20101.1.0.89 | 2010.05.20 | - |
TheHacker | 6.5.2.0.284 | 2010.05.20 | - |
TrendMicro | 9.120.0.1004 | 2010.05.20 | - |
TrendMicro-HouseCall | 9.120.0.1004 | 2010.05.20 | - |
VBA32 | 3.12.12.5 | 2010.05.20 | - |
ViRobot | 2010.5.20.2326 | 2010.05.20 | - |
VirusBuster | 5.0.27.0 | 2010.05.20 | - |
Keywords: