Main Page
Blog
Search
FAQ
TOP 10
Pad Files
Contact
About...
Donate
All Utilities
Password Tools
System Tools
Browser Tools
Programmer Tools
Network Tools
Outlook/Office
64-bit Download
Panel
Forensics
Pre-Release Tools
Articles

  
 
Antivirus "False Positive" Problems

Sometimes Antivirus scanner reports that a program is infected with a Virus or Trojan, even when the program is not really infected with any malicious code. This kind of problem is known as "False Positive" or "False Alert", and it's quite a common problem in some of the password recovery tools provided in NirSoft Web site.

The following table contains the latest "False Positive" problems reported by users of NirSoft utilities. If your Antivirus scanner reports that a program you downloaded from NirSoft is infected with a Virus or Trojan, and that virus/trojan is not listed in the table below, please report about that to nirsofer@yahoo.com, and specify the name of your Antivirus scanner, and the name of the Virus/Trojan that it detects. It's also recommended to contact your Antivirus company, and ask them to fix this "False Positive" problem.

Notice: Due to large amount of false positives I receive on daily basis, I decided to stop updating this list.
Instead, I posted this article on my Blog: Antivirus companies cause a big headache to small developers
I hope it'll eventually help me and other developers to decrease the false positives problems. If you want to check the current false positives issues for specific utility, you can use VirusTotal Web site to get virus alerts list in 40 Antivirus programs.

If you want to send a report about a false positive to the Antivirus company, read the following article that explains how to do it:
How to Report Malware or False Positives to Multiple Antivirus Vendors

Program Description Report Date
MessenPass DrWeb antivirus detects MessenPass as infected with Trojan.Inject.4580 01/12/2008
AdapterWatch ClamAV detects AdapterWatch as infected with Trojan.Pigeon 04/11/2008
ProduKey AVG McAfee VirusScan Enterprise 8.50 detect ProduKey as infected with Generic PWS.y (Trojan) 26/10/2008
IE PassView Avast! 4 Home Edition reports that IE PassView is infected with "Win32:Netpass-D [Tool]". 22/10/2008
PasswordFox Antivir reports that PasswordFox is infected with "TR/Spy.ProAgent.U.31". 17/10/2008
RegScanner Antivir reports that RegScanner is infected with "SPR/PSW.ProductKey.W". 15/10/2008
RegScanner McAfee reports that RegScanner is infected with "Generic PUP.z". 15/10/2008
RegScanner ZoneAlarm Internet Security Suite reports that RegScanner is infected with "not-a-virus:PSWTool.Win32.ProductKey.u". 14/10/2008
AdapterWatch F-Secure Client security reports that awatch.exe is infected with "PSWTool.Win32.NetPass.cc". 11/10/2008
DriverView McAfee Antivirus reports that DriverView is infected with "Generic PWS.y". 01/10/2008
RunAsDate AVG Antivirus reports that RunAsDate is infected with "Trojan horse Generic 10.THK". 05/05/2008
WebVideoCap AVG Antivirus reports that WebVideoCap is infected with "Trojan Horse Proxy ABKU". 28/04/2008
Mail PassView AVG Free 7.5 Antivirus reports that Mail PassView is infected with "HackTool.EEH". 17/04/2008
WirelessKeyView AVG Free 7.5 Antivirus reports that WirelessKeyView is infected with "HackTool.EEJ". 17/04/2008
Dialupass AVG Antivirus reports that Dialupass is infected with Dialer.REM trojan. 08/02/2008
WebVideoCap AVG detect WebVideoCap as Trojan Horse Proxy.XJS. 12/01/2008
ProduKey AVG Anti-Virus Professional Edition detect ProduKey as infected with HackTool.CHZ 10/01/2008
ProduKey Symantec Antivirus detect ProduKey utility as 'Security Assessment Tool'. 07/12/2007
MozillaCookiesView Avast antivirus reports that MozillaCookiesView utility is infected with Win32:Spyware-gen [Trj]. 05/12/2007
IE PassView AVG AntiSpyware reports that iepv.exe is infected with Dropper.Agent.IU 03/09/2007
IE PassView Trend Micro PC-cillin Internet Security 2007 reports that iepv.exe is infected with Spyware_Keyl_Astlog. 01/09/2007
Protected Storage PassView Trojan Hunter reports that Protected Storage PassView is infected with PWSteal.ICQSmiley.102 14/06/2007
NirCmd Bitdefender reports that NirCmd is infected with win32.nircmdc.a 06/04/2007
ShellExView Bitdefender reports that ShellExView is infected with Win32.Freetrip.C@mm. 04/04/2007
Dialupass AVG Antivirus reports that Dialupass is infected with PSW.generic3.CYQ 10/02/2007
CurrPorts Norton Antivirus Corporate reports that CurrPorts utility is infected with backdoor.trojan 05/02/2007
Protected Storage PassView Trend Micro Antivirus reports that pspv.exe is infected with HKTL_PASSVW.A 05/02/2007
Network Password Recovery Trend Micro Antivirus reports that netpass.exe is infected with PE_Generic virus. 05/02/2007
ZipInstaller Zone Alarm Pro Anti-Spyware engine reports that zipinst.exe is infected with Win32.PassView 25/12/2006
Network Password Recovery McAfee VirusScan Enterprise reports that Network Password Recovery utility is infected with PWCrack-NetPass. 22/12/2006
Protected Storage PassView The anti-spyware online scanner at http://www.ewido.net reported that Protected Storage PassView is infected with Trojan.IcqSmiley.e 24/09/2006
Protected Storage PassView BitDefender 8 reports that Protected Storage PassView is infected with Trojan.PWS.Iqsmile.A 06/09/2006
Protected Storage PassView Kaspersky Antivirus 6.0 reports that Protected Storage PassView is infected with Trojan-PSW.Win32.IcqAmiley.e 22/08/2006
IPNetInfo Trend Micro Antivirus detect IPNetInfo utility as a keylogger. 12/05/2006
Protected Storage PassView Trend Micro PC-cillin Internet Security 2006 reports that Protected Storage PassView is infected with HKTL_PASSVW.A 07/05/2006
Mail PassView AVG 7.1 Pro Antivirus reports that Mail PassView is infected with "BackDoor.Generic2.Joo" trojan. 02/03/2006
Mail PassView Avast! Home Edition report about sign of "Win32:Trojan-gen. {UPX!}" in mailpv.exe 17/02/2006
Dialupass Avast! 4.6 Home Edition antivirus detects Dialupass utility as Malware: 'Win32:Dialer-gen.' 16/01/2006
Mail PassView McAfee VirusScan reports that Mail PassView is infected with 'Generic PWS.f' Trojan. 05/01/2006
Dialupass Bitdefender 8 antivirus reports that Dialupass is infected with bakdoor.mosucker.06.1 05/01/2006
Protected Storage PassView Bitdefender 8.x/9.x antivirus reports that Protected Storage PassView is infected with Application.passview.A 05/01/2006
CurrPorts Trend Micro Antivirus detect CurrPorts utility as a keylogger - KEYL_SE.71724 18/12/2005
Protected Storage PassView AVG Antivirus reports that Protected Storage PassView is infected with Downloader.Generic.KZA Trojan 13/12/2005
MessenPass TrendMicro Officescan reports that MessenPass utility is infected with HKTL_PASSGET.A virus. 17/11/2005
Protected Storage PassView Norton Antivirus Corporate Edition identifies Protected Storage PassView as Hacktool.Passreminder. 17/11/2005
SysExporter McAfee Antivirus reports that SysExporter utility is infected with malware.j Trojan. 26/10/2005
Protected Storage PassView NOD32 Antivirus (v2.50) detect Protected Storage PassView as Win32/PassView.1_62. 23/09/2005
Protected Storage PassView Avast! reports that Protected Storage PassView is infected with "Win 32: Trojan-gen. {UXP!}" 23/08/2005
MessenPass Panda Antivirus detects MessenPass utility as infected with Hacktool/MSNpass.B virus. 23/06/2005
IconsExtract McAfee VirusScan detects IconsExtract as infected with PassDump.b Trojan. 23/06/2005
Protected Storage PassView "AntiVir" reports that Protected Storage PassView is infected with PMS/NSoft.PassRec.3 13/03/2005
ZipInstaller ZipInstaller is detected as infected with PMS/PSWTool.MSN.102 by AntiVir. 03/03/2005
StartupRun "Spybot Search And Destroy" reports that StartupRun utility is a malware. 09/12/2004
Protected Storage PassView "Spybot Search And Destroy" reports that Protected Storage PassView is a spyware. 03/12/2004
IECookiesView McAfee GroupShield Exchange reports that iecv.zip is infected with 'PassDump.b' 30/11/2004
Protected Storage PassView McAfee VirusScan Enterprise 7.1.0 reports that pspv.exe is infected with 'Generic PWS.f' Trojan. 10/11/2004
Protected Storage PassView McAfee scanner reports that pspv.exe is infected with PassDump.b 25/09/2004
Dialupass Norton Anti-Virus reports that dialupass.exe is infected with PWSteal.Trojan 09/09/2004
Dialupass NOD32 Antivirus reports that Dialupass v2.41 is infected with Win32/PSW.Stealer.C Trojan. 18/06/2004