Are these Nirsoft tools false positives?

[terrypin]

In many runs of Malwarebytes' Anti-Malware over the years I've never seen any of Nirsoft's tools implicated before. But these are the only threats MBAM has found today:

Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\NIRSOFT PACK
ETC\PCANYPASS.EXE, No Action By User, [0], [392686],1.0.2655

PUP.Optional.PasswordViewer, C:\PROGRAM FILES (X86)\NIRSOFT PACK
ETC\ROUTERPASSVIEW.EXE, No Action By User, [324], [426047],1.0.2655

Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\NIRSOFT PACK
ETC\SNIFFPASS.EXE, No Action By User, [0], [392686],1.0.2655

I checked Nisoft's FAQ and its list of reported false positiives, but these three were not included. I've also emailed the Nirsoft author.

I haven't quarantined them yet, awaiting advice please.

FWIW, I've never used any of those tools, but one or more might come in handy some day.

Best wishes,

Terry, East Grinstead, UK

Edited August 25, 2017 by terrypin

[Valinorum]

I think that they are FPs. 

[terrypin]

Thanks for fast reply. I'll see what Nirsoft author replies, but looks like I'll hang on to them.

[Porthos]

Many Nirsoft tools are detected by many vendors not just MB. There are detected rightly so because they can be used for bad purposes. If you wish to keep Nirsoft tool you need to exclude them.

[terrypin]

Thanks. Had this reply from Nir:

"Yes, it's a very common problem with password-recovery tools."

The puzzle is why I've never had these particular FPs identified before. The only reason I can think of is that MBAM has recently 'tightened' its criteria.

[shadowwar]

Two of these were picked up by our Shuriken heuristics.

As recommended above you are welcome to add them to your exclusion list.

 

[terrypin]

OK thanks.