[False Positive] KeyPress OSD (AHK-based tool) blocked by Kaspersky Plus – how to whitelist?

[rbmancini]

Operating System: Windows 10 Pro (version 22H2)
Kaspersky Application: Kaspersky Plus
Issue: Application blocked or disrupted due to false positive detection

---

Hello,

I’m experiencing issues using a legitimate application called KeyPress OSD. It’s an open-source tool that displays on-screen keyboard and mouse input, which is particularly useful for recording tutorial videos where viewers need to see which shortcuts I’m using.

Unfortunately, Kaspersky Plus flags or blocks it, likely because it's built with AutoHotkey (AHK) — a scripting language that’s often wrongly identified as malicious. The tool is completely safe and widely used in educational contexts.

🔗 AutoHotkey forum thread about false positives:
https://www.autohotkey.com/boards/viewtopic.php?f=17&t=62266

---

Product Description:

KeyPress OSD is an On-Screen Display for key and mouse inputs. It shows key presses in large text on-screen, ideal for accessibility, streaming, or tutorials. It uses AutoHotkey as its scripting engine, which sometimes triggers antivirus alerts.

---

What I'm looking for:

• How can I configure Kaspersky Plus to allow this app to run normally?

• Is there a recommended way to exclude a trusted AutoHotkey-based app from scans or monitoring?

• Should I whitelist the .EXE file, the folder, or the AutoHotkey interpreter itself?

If needed, I can attach screenshots showing the detection pop-up or logs.

I’m happy to follow all safety best practices, but I also need to be able to use this tool for my work without constant interruptions.

Thanks in advance for your support!

Best regards,
Rafael

[harlan4096]

Welcome to Kaspersky Community.

 

Can You provide details of the detection?

 

I got a detection when download from that link, but not from this one:

 

https:// github . com /marius-sucan/KeyPress-OSD?tab=readme-ov-file

[harlan4096]

About the detection of the site:

 

Quote

Hello,

Sorry, it was a false detection. It will be fixed.
Thank you for your help.

Best regards, Malware Analyst Team Lead

 

[rbmancini]

Hello. I received the following message from Kaspersky support:

"In this case, you can pause Kaspersky while using the tool: right-click the Kaspersky icon in the lower-right corner and select “Pause Protection.” Then you can use the tool while Kaspersky is paused so that no conflict occurs."

Answering your question, the antivirus simply does not allow the use of the application. It blocks it and automatically deletes the executable file (.exe). The solution proposed by Kaspersky does indeed resolve the problem.

[harlan4096]

Yes, but an unsecure solution -> pausing protection... 

[rbmancini]

Yes, it really isn’t the most secure solution. I tried adding the application to a list of trusted apps, but it didn’t work. If Kaspersky itself suggested pausing protection, I believe there must be a good reason—perhaps it isn’t possible to add this application to the trusted apps list. In any case, I only use the app when I’m recording lessons, so the computer is unprotected for just a short period.

[harlan4096]

Did You try Exclusions via Intrusion Prevention -> Manage applications rules?

 

Example:

 

 

[AlexeyK]

11 минут назад, rbmancini сказал:

I tried adding the application to a list of trusted apps, but it didn’t work.

"Exclusions and actions on object detection", section "Manage exclusions": 

https://support.kaspersky.com/help/Kaspersky/Win21.21/en-US/201385.htm

[rbmancini]

I tried exclusions and actions rules without success... maybe I did something wrong, I'm not sure.

The guy from KeyPress OSD wrote this about virus warnings:
https://keypressosd.com/virus-warnings/

He says there is an old version of the App that does not triggers this virus issues, but it is outdated.

He also says "there is the option to certify the binary files, by obtaining a code signing certificate from a trusted Certificate Authority, e.g., DigiCert. However, this is very expensive and I am not yet ready to invest into it."

[AlexeyK]

30 минут назад, rbmancini сказал:

maybe I did something wrong

In 99% of cases - yes.) If the exception still needs to be configured, attach screenshots of your exception and AV detection - we'll try to help.

Edited Tuesday at 07:13 PM by AlexeyK