Microsoft.Win32.TaskScheduler.dll produces Virus Warnings - Why?

Sep 27, 2012 at 1:14 PM
Edited Sep 27, 2012 at 1:34 PM

If you check the DLL using e.g. https://www.virustotal.com/, there are warnings like:

Ikarus   not-a-virus:Monitor.MSIL

Kaspersky           not-a-virus:Monitor.MSIL.KeyLogger.er

Kaspersky (Online)         not-a-virus:Monitor.MSIL.KeyLogger.er

How can I avoid these warnings (hoping they are fals alarms)? Or better: Build a DLL without producing virus warnings!

I have found another diskussion [discussion:390691] for this problem. I'd like to understand, what patterns produce the antivirus-warnings to remove them. But until now I did not found any description for these "KeyLogger" warnings. Do you can think of any code in the library, that could be misunderstood as a KeyLogger?

Coordinator
Sep 28, 2012 at 3:44 PM

I can't think of anything in the code that could be interpretted as a keylogger. Nothing in the library even captures keystrokes. I'm baffled. Interesting that only Kaspersky finds a problem. All the other virus scanners find nothing. Unfortunately, the virustotal site provides no information to help diagnose the problem.

Sep 28, 2012 at 11:39 PM

I have contacted the antivirus companies and wait for their answers. IKARUS has answered very prompt and already removed the detection from their product (signature from 9/28). I did also find no information about the found 'risks'. I agree with you that the library is completely harmless. I tried an "analysis" to see, what the antivirus software might treat as a 'risk', but this did not help me out. Perhaps you can interpret the results better than me: http://anubis.iseclab.org/?action=result&task_id=1e91f277620a55de40df518467ef558df&call=first

Sep 29, 2012 at 11:46 PM

Now also Kaspersky has corrected their false alarm, after I contacted them. If you would like your library be completely free from suspicion, you should contact the other anti-virus companies (at virus total this is Emsisoft - which I contacted, but had no answer until now - and TrendMicro-HouseCall).