On: NirSoft Freeware (2008)

[framp]

I think the issue is that his freeware utilities were used as part of spyware by third parties.

AV back in the days were mainly all blacklists of known actors and a few tricks (eg: when the executable was obfuscated with a compressor like UPX or using some more advanced techniques)