NirBlog

As you may know, some of the powerful tools on NirSoft Web site, especially the tools that recover passwords, are constantly targeted by many Antivirus programs.
In order to find out which Antivirus programs cause more troubles with the tools of NirSoft, I decided to generate a report with the number of false positive alerts of every Antivirus program. I have created a small program that downloads the Antivirus scans result of all .exe files of NirSoft from VirusTotal Web site and then processes the collected information and generates the desired report. I have also decided to generate score for every Antivirus program according to their false positive issues.

Before I continue with more information about this report… let me say a few words about the term “False Positive”: There are people who say that I don’t use the term “False Positive” correctly, simply because the alerts about my tools are not a mistake and the Antivirus programs have to display an alert about a program that can be used by hackers for bad purposes (like my password-recovery tools).
So here’s my opinion…. It’s somewhat legitimate that Antivirus program will display a warning about my password-recovery tools, as long as it’s done with full explanation about the alert, which means that the Antivirus program must explain the user that the program is completely legitimate and it’s not bad by itself, but it can be also used by hackers to steal passwords and that’s why the warning is displayed.
Also… the alerts on password-recovery tools should not be detected in VirusTotal Web site, unless this Web site will start to make full separation between Viruses/Trojans/Malwares and non-malicious tools, so people who check the file in VirusTotal will not think that my tool is an horrible  Virus.

Unfortunately, Antivirus programs and VirusTotal Web site don’t provide clear explanation about the alerts they display and many people are confused, thinking that my tools are infected with Virus/Trojan, and As long as there are users who think that my programs are infected, I consider it as a “False Positive”. The right definition of “False Positive”, in my opinion, is a situation that a user thinks a file is infected with a Trojan/Virus/Malware according to an alert displayed by Antivirus software, while the file is not infected at all.
It doesn’t really matter that the Antivirus developers only wanted to warn the user about a software that can be used by hacker, if the Antivirus program doesn’t deliver the message to the end user correctly, then it’ still a false positive.

It’s important to say that some of the Antivirus programs imply that my tools are not a Virus by adding “not-a-virus” or “Hacktool” or “Riskware” strings to the alert name, but many
users don’t understand the meaning of these strings and still think that the file is infected. Nevertheless, in my score calculation , Antivirus programs that do it got an higher score.

Explanation about the report

The report contains 6 columns and one line for every Antivirus software/engine, here’s the description of every column:

• AV Name – The name of the Antivirus
• Total Alerts – The total number of NirSoft files that the specified Antivirus display alerts.
• No Virus – Number of alerts that contain the following strings, implying that NirSoft software is not a Virus/Trojan/malware: not-a-virus, tool, pup (potentially unwanted program) , pua (potentially unwanted application) , riskware, unwanted, passwordrevealer, not  malicious, passwordviewer
• NO PR – Number of alerts for programs that are not a password recovery tool.
• Trojan Alerts – Number of alerts that contain the following strings, implying that NirSoft software is a Virus/Trojan (So these alerts are severe false positives): trojan, spyware, malware, adware.
• Score – Total score calculated for this Antivirus. Read the ‘How the score is calculated’ for more information.

How the score is calculated

Here’s a full explanation about how the Antivirus score is calculated:

1. Every Antivirus engine starts with 100 points.
2. For every alert displayed for a password-recovery tool, 1.5 points are reduced from the Antivirus score.
3. For every alert displayed for a tool that doesn’t recover passwords, 3 points are reduced from the Antivirus score.
4. When one of the following strings appear inside the alert name, 0.5 points are added to the Antivirus score: not-a-virus, tool, pup (potentially unwanted program) , pua (potentially unwanted application) , riskware, unwanted, passwordrevealer, not malicious, passwordviewer
   That’s because the Antivirus does a good thing here, implying the my tool is not a Virus/Trojan/Malware.
5. When one of the following strings appear inside the alert name, 5 points are reduced from the Antivirus score: Trojan, spyware, malware, adware
   That’s because the Antivirus does a bad thing here, implying the my tool is a Trojan/malware, which is completely a lie.  Comodo, for example, displays ‘UnclassifiedMalware’ alert for 11 NirSoft files, which is totally misleading, because the “Malware” term is mostly used for programs that are designed to be bad , and  that’s why they got very low score.
   ViRobot and Antiy-AVL also got low score from the same reason.

Example for score calculation

AVG display alerts for 13 files, 12 of them are password recovery tools, so 1.5 * 12 = 18 points are reduced, 1 tool is not password recovery, so additional 3 points are reduced.
All 13 alerts contain ‘hacktool’ and ‘passwordviewer’ strings, so 13 * 0.5 = 6.5 points are added.

100 – 1.5 * 12 – 3 * 1 + 13 * 0.5 = 85.5

Finally… Here’s the report.

The report is based on Virus scanners results downloaded from VirusTotal on October 4, 2015. The NirSoft files taken from NirLauncher package 1.19.53. Be aware that Antivirus signatures changes every day, so it’s possible that if you check the virus alerts from today you’ll get a little different result. You can download a csv file containing all alerts found on this day from here. This file contains the Antivirus Name, the alert name, the NirSoft file that triggered the alert and the SHA-256 hash of this file, and you can optionally view this file with CSVFileView…

The good news in this report is that there are 12 Antivirus engines without any false positive and they got the best score possible (100)
The bad news – There are 2 Antivirus engines that show alerts for more than 100 files of NirSoft (!!) – Bkav and TheHacker, and they got very low negative score…

It’s possible that I’ll generate another  false positives report within a few months in order to check whether the Antivirus companies improve their software or they are getting worse…

AdvancedRun is a new tool for Windows that allows you to run a program with different settings that you choose, including – low or high priority, start directory, main window state (Minimized/Maximized), run the program with different user or permissions, Operating system compatibility settings, and environment variables. You can also save the desired settings into a configuration file and then run the program automatically from command-line with the desired settings.

AdvancedRun

Here’s some examples of what you can do with AdvancedRun:

• Run the RegEdit of Windows as normal user on Windows 10/8/7/Vista, without elevation. In this mode, you’ll not be able to access or modify Registry keys that require admin rights.
• Run the RegEdit of Windows as SYSTEM user on Windows 10/8/7/Vista. In this mode, you’ll be able to access the HKEY_LOCAL_MACHINE\SECURITY key.
• Run a program with a user of another running process.
• Run a program in high priority.
• Run a specific instance of program in Windows XP compatibility mode, without making global changes in the Registry.
• Run a specific instance of program with different PATH environment string, but without modifying the PATH string of the entire system and without using batch files or command prompt window.
• Run a program with a full set of environment variables you choose, ignoring the system environment variables completely.

You can download this new utility from this Web page.

TaskSchedulerView is a new tool for Windows Vista/7/8/10 that displays in a single table the list of all tasks from the Task Scheduler of Windows. It also allows you to easily disable/enable mutiple tasks at once. For every task, the following information is displayed: Task Name, Description, Status, Hidden (Yes/No), Last Run/Next Run Times, Task Folder, EXE filename or COM handler of the task, number of missed runs, and more…

TaskSchedulerView

You can download this new tool from this Web page.

SimpleWMIView is a new tool for Windows that displays the result of WMI queries in a simple table, and allows you to easily export the data to text/csv/tab-delimited/html/xml file, or to copy the selected items to the clipboard and then paste them to Excel or other spreadsheet application. With SimpleWMIView you can get extensive information about your system, like a list of running processes, services, drivers, user accounts, hardware, and so on…
SimpleWMIView works on any version of Windows, starting from Windows XP and up to Windows 10 and  both 32-bit and 64-bit systems are supported.

SimpleWMIView

You can download this new tool from this Web page.

SecuritySoftView is a new tool for Windows that displays the AntiVirus, AntiSpyware, and Firewall programs that are currently installed on your system and registered with the security center of Windows operating system.  This tool works on any version of Windows, starting from Windows XP and up to Windows 10, and both 32-bit and 64-bit systems are supported. However, on Windows XP, SecuritySoftView displays less information than Windows Vista or later.

SecuritySoftView

You can download this new tool from this Web page.

FirmwareTablesView is a new tool for Windows that displays a list of firmware tables (ACPI, SMBIOS) stored on your system. You can view the content of these tables in Hex-dump format and export them to a binary file.

FirmwareTablesView

You can download this tool from this Web page.

WirelessConnectionInfo is a simple tool for Windows Vista/7/8/2008 that displays general information and statistics about the active wifi connection, including the SSID, BSSID, PHY Type, Signal Quality, Receiving rate, Transmission Rate, Authentication Algorithm, Channel Number, Total number of transmitted/received frames, and more…

WirelessConnectionInfo

You can download this new tool from this Web page.

ExecutedProgramsList is a new tool that displays a list of programs and batch files that you previously executed on your system. For every program, ExecutedProgramsList displays the .exe file, the created/modified time of the .exe file, and the current version information of the program (product name, product version, company name) if it’s available. For some of the programs, the last time execution time of the program is also displayed.

ExecutedProgramsList

You can download this new tool from this Web page.

OpenSaveFilesView is a new tool that displays the list of files that you previously opened with the standard open/save dialog-box of Windows. For every file in the list, the following information is displayed: Filename, Extension, Order (The order that the files were opened for every file extension), Open Time (Available only for the last opened file of every file type), File Modified/Created Time, File Size, and File Attributes.
OpenSaveFilesView works on any version of Windows, starting from Windows 2000 and up to Windows 8.

OpenSaveFilesView

You can download this new utility from this Web page.

As you may already know, the password recovery tools provided by NirSoft are constantly detected by many Antivirus programs as malware/Trojan/Virus or as a security risk.
Usually, the detection is not done by mistake. The Antivirus companies deliberately add these utilities to their database, because in addition to their legitimate use of recovering passwords, these programs can also be used for malicious purposes, like stealing passwords from another person, and thus the Antivirus companies see them as a threat to the user.

In the past, the Virus alerts problem only affected users who have Antivirus program running in the background, but today… the problem is much more complicated.
It started 2 years ago, when Google acquired VirusTotal, a known Web site that scans files with all major Antivirus engines, and displays the result from all of them in one page.
It seems that now Google uses VirusTotal technology to decide whether a file is good or bad. If a file is detected by a lot of Antivirus engines, then it’s considered as Malware by the Malware detection system of Google.

Chrome and Firefox, the 2 most popular Web browsers today, already use the Malware detection system of Google for every downloaded file, so if Google system detects the downloaded file as malware, the Web browser blocks the download and displays a warning saying that the file is malicious. Recently, I constantly get messages from people like “My Web browser blocks your software, please sent it to me by email”, which is quite annoying. In additional to the password-recovery tools downloaded separately, NirLauncher package is also frequently blocked by Chrome and Firefox, simply because it contains the same password-recovery tools.

But this is not the only problem… In the last week, I had 3 days that my Web site was blocked for people who search my utilities  in Google, and “This site may harm your computer” message was displayed in the search result.  The automatic systems of Google falsely detected that I have multiple malwares on my Web site, and blocked the access to my Web site  from Google search results in order to protect the users from malwares that  didn’t  really exist…
All files that Google detected as malwares were simply my password recovery tools, and Google detected them as malware simply because many Antivirus programs target them.

The command-line options of my password recovery tools are the major feature that allows hackers and Trojans to use these tools for bad purposes, because it’s possible to export the passwords into a file and then optionally send them to a remote location (using another software) without displaying any user interface. Removing the command-line options from these tools will cause the Antivirus companies to see them as a lower security risk than before, and hopefully some of them will remove them from their virus detection database.  If a few Antivirus companies will remove the detection of my password-recovery tools from their system, the total number of VirusTotal detection will be lower,  and the chance of getting into troubles as described above will be lower too.

I know that some of you,  who are using the command-line options of my password-recovery tools for legal purposes, will be disappointed from this change, but in our ridiculous world where combination of Antivirus companies, VirusTotal service and Google may lead to blocking many users from accessing my Web site or from downloading software provided in it, I don’t have other choice.

I’m still looking for a way to provide command-line version of these tools for users who need this feature for legal purposes, but it must be done in a separated Web site ,so NirSoft web site won’t be affected from them.