Produkey malware detection

[cammo445]

Hi there, I recently obtained the premium edition of Malwarebytes.

I did a full system scan and it came up showing five Hack.tools for Nirosoft produkeys.
I've quarantined and deleted the files.

However, I'm unsure if this means my computer is infected or requires further attention.
In your experiences should further action be taken?

Any assistance in this matter would be greatly appreciated.

[David H. Lipman]

That is a proper detection.  It is not because the tool is malicious but it can be used maliciously.  With that utility it can capture software Product Keys in a nefarious action.  Some malware package such tools and use them to obtain information and then exfiltrate that information.  That is why it is detected as a HackTool.  All of Nir Sofer's utilities are safe to use as long as you knowingly download and use them for yourself.  The detection is for when the tool may be used in a nefarious or malicious action that may be unknown or unwanted by the PC owner.

 

Edited June 13, 2023 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[cammo445]

Thanks for letting me know.

Do you have any insight into what my next steps should be? 

[David H. Lipman]

If you downloaded it yourself - nothing.  If you want to continue to use it when MBAM next flags it, have MBAM make and exception for it so it won't be detected in the future.

 

[cammo445]

I don't have any recollection of downloading these items.

However, they were sitting in unique locations such as my desktop (in another hard drive) or in my documents folder. 

[David H. Lipman]

It sounds like you did it a while back.

I don't think you have anything to worry about and by what you wrote, you don't need it in the near future.

[cammo445]

Cheers Dave, appreciate your help.

Would you know if these Nirsoft produkeys are typically included when downloading other applications or programs?

Only because I've never heard of Nirosoft or produkeys until today.

 

[David H. Lipman]

No. It is not included with legitimate packaged software.

[cammo445]

Understood, I'm not sure how I would've obtained these files then.

In saying that, as mentioned, I've already quarantined/deleted the files. Would you recommend any further action?

[David H. Lipman]

None.

[drdas]

Unclear if this is related but this morning I had a Microsoft office product key that has been on my desktop for years also detect positive as Sandbox.48. Since prior scans have not detected this I suspect that this is related to a definition update. Quarantined it to be safe any way. 

[David H. Lipman]

No correlation @drdas

[drdas]

K thanks. Should I upload the detection to another thread? I am not certain whether uploading a product key is a good idea. Can it be seen (or used) by others in the forum? It is old and may not be usable anymore, but I want to follow best practices.

Thanks!

[David H. Lipman]

Yes.  Please start a new thraad if you think there is a False Positive.