Why does my antivirus flag ShaferFilechck.dll as a virus?
Last updated: 2026-10-02
Your antivirus flagged ShaferFilechck.dll? It is a false positive from our licensing partner Nalpeiron, a legitimate DRM and licensing service used by major software vendors.
If your antivirus or security scanner flags a DLL file that ships with the SharePoint Essentials Toolkit as a virus or trojan, the short answer is: it is a false positive, and the file is safe.
This is a false positive
This trigger is caused by a DLL from our licensing partner Nalpeiron: ShaferFilechck.dll.
We have had other reports of this, and it is a false positive.
Nalpeiron is a legitimate, widely used commercial digital rights management (DRM) and software licensing service. It is frequently bundled with authorized programs from major vendors like HP, Logitech, UiPath, Nitro PDF, and AVG to verify product keys and prevent piracy.
Why is it being flagged?
Antivirus programs rely on heuristic analysis (behavioral scanning) to spot threats. Because Nalpeiron needs to run in the background, prevent software tampering, and communicate with licensing servers, its anti-piracy code frequently mimics the behavior of malware, triggering automated security alarms.
What you can do
Add an exclusion for ShaferFilechck.dll (or the SharePoint Essentials Toolkit installation folder) in your antivirus or security software.
If your security tool quarantined the file, restore it and report the detection as a false positive to your antivirus vendor.
If you have any concerns, contact us at support@cognillo.com and we will be happy to help.