Keyboard hook causes virus false alarm

If a tool or demo that you have downloaded from here is detected as a virus Dont't Panic just yet, just take a few minutes to read about it and educate yourself first. We have a very clean development environment and use Norton Corporate Anti-Virus on our development machines which is updated daily.  Also, do not take our word for it. You can test any file against 41 of the best virus scanners out by using http://www.virustotal.com When in doubt, Test it.

That said people (usually) use common sense to determine whether a situation warrants an alert. If you took a rifle on a hunting trip, nobody would pay much attention to it - if you took it to the supermarket or a movie theatre, the reactions would be quite different. It's the same rifle, but it is used under different circumstances, which makes a big difference. Your anti-virus software does not have any common sense, it cannot know if you are installing a software willingly or if someone else is installing it. Therefore it will issue an alert, and that's the way it should be.

In addition, many anti-virus programs will warn you about "hook" related dangers. A "hook" is a way for an application to capture keyboard input. This is often used for hotkeys (press some keyboard keys to start the app, or make it do something) and a common programming technique. Unfortunately the same type of technique is used by many keyloggers - they use the "hook" method to capture your keystrokes, instead of keyboard commands.

A lot of the tools here use #UseKeyboardHook so we can detect when the user presses a key on the keyboard. This makes the tools more responsive and is sometimes needed to work with a game at all. Otherwise the game just over rides your hot keys and the tool will ignore the commands you are trying to send it. As a developer we want the tools to work and we do not want them shown as a "virus"... But, that said, we USE these tools ourselves and if we have to choose between them working like we want or failing some random virus scan, we will choose the working side. After all, it is not a virus but an illusion, we just wrote it! And we could just as easily write a program that would "detect" McAfee and Norton as a virus. The way they act, I am not sure we would be wrong...

For instance, the Control Assistant uses hot keys to trigger events. Without the keyboard hook they just do not work reliably. We have tested it 20 different ways. But when we include it some virus scanners then mark it as spyware.  Remember: You can test any file against most scanners out by using http://www.virustotal.com in one shot. It is a really nice site for this. If you have any concerns at all about a file upload it to virustotal and scan it.

 

Here is a test of the Control Assistant with keyboard hook installed. As you can see it failed 1 out of 41 scanners because it "Behaves like spyware" by waiting for you to press a hot key that you set up yourself in remote box controls:

File ControllerDemo.exe received on 2010.05.20 21:10:03 (UTC)

Result: 1/41 (2.44%)

publisher....: www.pcgametools.com
copyright....: PC Game Tools
product......: The Control Assistant
description..: The Control Assistant
original name: Controller.exe
internal name: Controller.exe
file version.: 0.5.0.2

Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.20.01 2010.05.20 -
AntiVir 8.2.1.242 2010.05.20 -
Antiy-AVL 2.0.3.7 2010.05.19 -
Authentium 5.2.0.5 2010.05.20 -
Avast 4.8.1351.0 2010.05.20 -
Avast5 5.0.332.0 2010.05.20 -
AVG 9.0.0.787 2010.05.20 -
BitDefender 7.2 2010.05.20 -
CAT-QuickHeal 10.00 2010.05.20 -
ClamAV 0.96.0.3-git 2010.05.20 -
Comodo 4896 2010.05.20 -
DrWeb 5.0.2.03300 2010.05.20 -
eSafe 7.0.17.0 2010.05.20 -
eTrust-Vet 35.2.7501 2010.05.20 -
F-Prot 4.6.0.103 2010.05.20 -
F-Secure 9.0.15370.0 2010.05.20 -
Fortinet 4.1.133.0 2010.05.20 -
GData 21 2010.05.20 -
Ikarus T3.1.1.84.0 2010.05.20 -
Jiangmin 13.0.900 2010.05.20 -
Kaspersky 7.0.0.125 2010.05.20 -
McAfee 5.400.0.1158 2010.05.20 -
McAfee-GW-Edition 2010.1 2010.05.20 Heuristic.BehavesLike.Win32.Spyware.J
Microsoft 1.5802 2010.05.20 -
NOD32 5133 2010.05.20 -
Norman 6.04.12 2010.05.20 -
nProtect 2010-05-20.02 2010.05.20 -
Panda 10.0.2.7 2010.05.20 -
PCTools 7.0.3.5 2010.05.20 -
Prevx 3.0 2010.05.20 -
Rising 22.48.03.04 2010.05.20 -
Sophos 4.53.0 2010.05.20 -
Sunbelt 6329 2010.05.20 -
Symantec 20101.1.0.89 2010.05.20 -
TheHacker 6.5.2.0.284 2010.05.20 -
TrendMicro 9.120.0.1004 2010.05.20 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.20 -
VBA32 3.12.12.5 2010.05.20 -
ViRobot 2010.5.20.2326 2010.05.20 -
VirusBuster 5.0.27.0 2010.05.20 -

Keywords:

Search | Most Popular | Recent Changes | Wiki Home
Disclaimer: On this website we mention many games from many companies that we respect and have played ourselves. We are not a part of or affiliated with any of these games in any way nor do we claim to be. All their information and names belong to them and we are happy that they write such great games for us to enjoy! Legal Notices