NoCapture was flagged by your antivirus. Before you panic, understand why. The flag is almost always a false positive caused by the same technique that makes NoCapture work: DLL injection.
Why DLL Injection Triggers Antivirus
NoCapture applies WDA_EXCLUDEFROMCAPTURE to third-party windows by injecting a small signed DLL into the target process. This is necessary because Windows requires the owning process to call the API. The injection is minimal. It sets one window property and returns.
But DLL injection is also used by malware to:
- Log keystrokes
- Steal credentials
- Hijack browser sessions
- Disable security software
Antivirus vendors use behavioral heuristics. When they see one process injecting a DLL into another, they flag it. They do not analyze what the DLL does. They see the technique and react.
How to Verify NoCapture Is Safe
- Check the digital signature. Right-click the NoCapture executable, select Properties, then the Digital Signatures tab. It should show a valid signature from Membran Digital.
- Verify the hash. Download NoCapture only from nocapture.membran.digital. Compare the file hash if you are paranoid.
- Inspect the DLL. The injected DLL is small and can be examined with any PE viewer. It exports a single function that calls
SetWindowDisplayAffinity. - Monitor network activity. NoCapture does not upload screenshots or window data. Use a network monitor to confirm.
How to Whitelist NoCapture
Windows Defender:
- Open Windows Security → Virus and threat protection
- Click Virus and threat protection settings → Manage settings
- Scroll to Exclusions → Add or remove exclusions
- Add an exclusion for the NoCapture folder (usually
C:\Program Files\NoCapture) - Add an exclusion for the NoCapture executable
Third-party antivirus (Norton, McAfee, Bitdefender, etc.):
- Open the antivirus console
- Find the quarantine or detection log
- Locate the NoCapture entry
- Select "Restore and trust" or "Add to exclusions"
- If prompted, exclude by publisher certificate rather than by file path. This is more secure because it trusts the signed executable even after updates.
EDR / Enterprise endpoint protection (CrowdStrike, SentinelOne, Carbon Black):
Contact your IT security team. Provide them with:
- The NoCapture executable path
- The digital signature thumbprint
- A description of what the tool does and why it uses injection
- A link to this article
Most enterprise security teams can create a policy exception by publisher certificate.
Why We Do Not Avoid Injection
Some users ask why we do not use a driver or a different technique to avoid the flag. The answer is that WDA_EXCLUDEFROMCAPTURE requires the owning process to make the API call. There is no alternative on Windows. Every tool in this category — Evanesco, CaptureGuard, WinHider, Cloakly — uses the same technique. The ones that do not trigger antivirus are usually the ones that are not persistent or are not yet widely distributed enough to be in antivirus databases.
The Bottom Line
A DLL injection flag from antivirus software is a sign that your security software is working. It saw a suspicious technique and alerted you. Your job is to verify that the technique is being used for a legitimate purpose, whitelist the tool if it is, and move on. NoCapture is code-signed, locally processed, and transparent about its architecture.
Read about how we handle data and security here.
NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.
