Keyman updates come with virus

Keyman
1

Since several months, all keyman updates that I get come with viruses. Is it possible for the developer team to get those viruses out of them? Last time, it contained 6 (!) infected files, and I am now scared to update keyman. Running Malware bites after installing the update worked, but there is still a time in between when the viruses can harm my laptop. What do you say or recommend for me to do, so that this will no longer be a risk?

2

Hi @Astrid,

I am sorry you have experienced this issue. We are confident that Keyman does not contain any viruses or malware. What can happen is that over-zealous security software sees that Keyman works with the keyboard at a low level (as it has to – that’s Keyman’s job!) and considers that Keyman could be a keylogger, and raises as a false positive report “out of an abundance of caution” :slight_smile:.

When this arises, we like to get in touch with the security software vendor so that they can verify that Keyman is safe and add a whitelist exception for Keyman to their software. Can you let us know the name of your security software and the exact details of the report (screenshot or copy/paste from the report)?

More information: KMKB0013 - My antivirus or security software reports Keyman is a potential key logger, trojan or spyware

1 Like
3

My antivirus is Eset Endpoint Antivirus, currently 11.1.2052.0. Unfortunately, I can only create a screenshot right when that happens, which is only when a new keyman update arrives.

4

Thanks for the additional info. @mengheng or @nyny are you able to test Eset Endpoint Antivirus and see if it raises a false positive for Keyman now?

5

Update to that virus occurrence: Today, when a new keyman update came, the file reported as faulty was in MSI3D87.tmp and was called “Eicar”.

6

Thanks for the update. “EICAR” is a test file; you can read more about it at EICAR test file - Wikipedia. This really suggests that the antivirus software is going wrong, because we don’t distribute the EICAR test file!

I suggest you report the issue to Eset as a false positive ([KB141] Submit a virus, website, or potential false positive sample to the ESET Research Lab) and we’ll continue to investigate here as well.