[P5ych0Gigabyte]

I just scanned an AutoItScript I compiled at http://virusscan.jotti.org/ and got these results:

Quote

File: MD5.exe
Status: INFECTED/MALWARE
MD5 49874947f9287de91c606c981afc79ed
Packers detected: UPX, AUTOIT
Scanner results
AntiVir Found nothing
ArcaVir Found Trojan.Clicker.Small.Ht
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

It appears to be another false postive becuase of careless updates to antivirus definitions. :(

This post has been edited by SolidSnake: 03 December 2005 - 02:34 PM

[w0uter]

could you give some more info like what was in it and what was it compiled/packed with ?
latest beta gives me this.

Quote

POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). This might be a false positive. Therefore, results of this scan will not be stored in the database)

VBA32
Found Trojan-Downloader.Agent.70 (probable variant)

ArcaVir probbly just flagged it becouse it was packed by the default UPX.

This post has been edited by w0uter: 03 December 2005 - 03:35 PM

[P5ych0Gigabyte]

w0uter, on Dec 3 2005, 09:29 AM, said:

could you give some more info like what was in it and what was it compiled/packed with ?
latest beta gives me this.

I have attached the script which was compiled using the v3.1.1 compiler. It was an MD5 include I downloaded off the forums.

w0uter, on Dec 3 2005, 09:29 AM, said:

ArcaVir probbly just flagged it becouse it was packed by the default UPX.

I do not understand what you mean by this. Could you please try and explain it in different words.


Thanks for the feedback.
-SolidSnake

Attached File(s)

•  MD5.au3 (21.72K)
  Number of downloads: 154

This post has been edited by SolidSnake: 03 December 2005 - 05:02 PM

[SmOke_N]

AutoIt uses a UPX packer by default. w0uter was simply stating that, the anti-virus protection programs, typically find this and label it as a 'potential threat'. That seems to be the consensus here.

[P5ych0Gigabyte]

SmOke_N, on Dec 3 2005, 11:10 AM, said:

AutoIt uses a UPX packer by default. w0uter was simply stating that, the anti-virus protection programs, typically find this and label it as a 'potential threat'. That seems to be the consensus here.

Thanks.

[w0uter]

tested it with the latest beta + upx beta

[ code='text' ]    ( ExpandCollapse - Popup )

Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). 
            This might be a false positive. Therefore, results of this scan will not be stored in the database)

MD5:            317612dd7eaac711d4bdf698f5b47047

Packers detected:   UPX, AUTOIT

Scanner results:
AntiVir         Found nothing
ArcaVir         Found nothing
Avast           Found nothing
AVG Antivirus       Found nothing
BitDefender     Found nothing
ClamAV          Found nothing
Dr.Web          Found nothing
F-Prot Antivirus    Found nothing
Fortinet        Found nothing
Kaspersky Anti-Virus    Found nothing
NOD32           Found nothing
Norman Virus Control    Found nothing
UNA         Found nothing
VBA32           Found Trojan-Downloader.Agent.70 (probable variant)

This post has been edited by w0uter: 03 December 2005 - 08:12 PM

[P5ych0Gigabyte]

w0uter, on Dec 3 2005, 02:10 PM, said:

tested it with the latest beta + upx beta

[ code='text' ]    ( ExpandCollapse - Popup )

Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). 
            This might be a false positive. Therefore, results of this scan will not be stored in the database)

MD5:            317612dd7eaac711d4bdf698f5b47047

Packers detected:   UPX, AUTOIT

Scanner results:
AntiVir         Found nothing
ArcaVir         Found nothing
Avast           Found nothing
AVG Antivirus       Found nothing
BitDefender     Found nothing
ClamAV          Found nothing
Dr.Web          Found nothing
F-Prot Antivirus    Found nothing
Fortinet        Found nothing
Kaspersky Anti-Virus    Found nothing
NOD32           Found nothing
Norman Virus Control    Found nothing
UNA         Found nothing
VBA32           Found Trojan-Downloader.Agent.70 (probable variant)

That makes two problems VBA32 and AcraVir. Guess somebody should send an email to both of them so they can fix their definitions.

Thanks for the feedback.

This post has been edited by SolidSnake: 04 December 2005 - 04:40 AM