Monday, July 2, 2012

WirelessKeyView and AntiVirus False Positive Detection

If you don't know about WirelessKeyView, let me give you a little back story. WirelessKeyView is a small program made by Nirsoft. It allows you to see your wireless passwords entered into Windows, especially for Windows XP, as XP does not allow you to see your entered passwords after you have successfully connected to a wireless network.


WirelessKeyView uses the Windows Registry (for XP), and a directory in your user folder (for Vista) to see your wireless passwords, and display them to you. As this tool is effective, but this tool can also be used for malicious purposes. Due to this effect, many anti virus vendors out there have detected this program as spyware/potentially unwanted programs. Sometimes, this can be considered a false positive, as there is no real threat virus wise, and many also say that this is the result of the anti virus engines/people being to sensitive to potential threats.


If you use this program, and have saw this alert from your AV, I suggest you tell them about this program. Many AV's still detect this program as a false positive.


I can confirm that both Microsoft Security Essentials (and other AV products powered by Microsoft's AV engine/definitions), as well as MalwareBytes' Anti Malware.


Here is some screenshots that I took while extracting the archive in my downloads folder in Windows XP. As you can see, Microsoft Security Essentials detects this before WinRAR can even finish extracting the file. After ignoring MSE for a minute, you can see that when I fire up MalwareBytes', it detects this program as a threat as well.
Compressed Archive, right before extraction using WinRAR software
Just after extraction, MSE detects WirlessKeyView (WinRAR window disappeared before I could take the snapshot)
Microsoft Security Essential's Detection Info. Here, it is classified as a HackTool.
MalwareBytes' Anti Malware has finished its scan, and shows that it has detected something
MalwareBytes' Anti Malware Displays its results. Here I inserted that PUP meant if you forgot :)
Below is some info for WirelessKeyView directly from the publisher.

No comments:

Post a Comment

Note: This is Blogger's comment system. This system is a backup for when Disqus can't be reached by your computer, such as when your network blocks connections to disqus.com. The comment policy still applies regardless.