Are my AutoIt EXEs really infected?

97 posts in this topic

Posted (edited)

If you have been using AutoIt for any length of time you will know that it is a great, and powerful scripting language. As with all powerful languages there comes a downside. Virus creation by those that are malicious.

AutoIt has no virii installed on your system, and if a script you have created has been marked as a virus, (and you're not malicious) then this is a false positive. They found a set of instructions in an AutoIt EXE out there somewhere, took the general signature of the file, and now all AutoIt EXE's are marked (or most of them). This can be due to several reasons.

  • AutoIt is packed with UPX. UPX is an open source software compression packer. It is used with many virii (to make them smaller).
  • Malicious scripter got the AutoIt script engine recognized as a virus.
And I am sure there are more ways your executable could be marked, but that covers the basics.

Now I am sure you are wanting to know what you can do to get back up and running without being recognized as a virus. You have to send in a report to the offending AV company alerting them to the false positive they have made. It never hurts to send in your source code along with a compiled exe, to help them realize their mistake.

You may have to wait up to 24 hours for them to release an update. The time it takes really depends on the offending AV company.

Anti-Virus Links

Edit: Added Website links and Contact links.

I hope this helps you understand why your AutoIt executables are marked as virii.

JS

Edited by JSThePatriot
Alexxander, oapjr and IgImAx like this

Share this post


Link to post
Share on other sites



Posted

Thanks JS, does anybody have anything else to add before I lock this?

Share this post


Link to post
Share on other sites

Posted (edited)

I would like to propose a workaround.

For those of you who can, downgrading from the newest version to version 3.1.1 does seem to work. Apparently there's something in the new AutoIt3.bin file included in versions after 3.1.1 that's creating a "lookalike" pattern during the compile and UPX compression.

I noticed this during the first round of false-positves with Norton's AV client. I'd not recompiled all my programs with the new version, but I did compile a few of the COM aware scripts that I'd written with the 3.1.1 betas. I also did some work on some old scripts, compiling them with the new version. All newly compiled scripts were eventually whacked, but those compiled with 3.1.1 were untouched.

This is the solution that I've decided to run with at this time. Though the new features in 3.2 (COM and whatnot) are absolutely awesome, I don't have any scripts that utelize said features and I don't want to deal with the hassle of 400 users saying "My xyz program doesn't work anymore! Fix it!" because of a false positive.

Edited by Blue_Drache

Share this post


Link to post
Share on other sites

Posted

Rather than hacking upx or the runtime engine we should (as JS points out when he provided the contact information) make a request to the Antivirus maker to fix their scanner such that it does not detect our files as false positives.

Make sure to send them a copy of the file. If you are the author of the file it would benefit the comunity if you added instructions on how to decompile it to let them peek at the source.

So in your request:

  • Use a real mail address. They should be able to contact you to get further information.
  • Be polite. It is a business your dealing with. Negative wording and disrespectfull behaviour will not benefit you or us.
  • Only use objective arguments.
  • State clearly if you are the author of the file detected as a false positive.
  • If you can, let them have a peek at the source (instructions on how to decompile).
  • Let them know that you and most of the comunity are eager to find a solution. And will, as fare as our knowledge goes, do wathever we can to do so.

Share this post


Link to post
Share on other sites

Posted

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Share this post


Link to post
Share on other sites

Posted

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Only just seen this. So. Oi! :P

Share this post


Link to post
Share on other sites

Posted

This thread will be replaced with a pointer to the wiki: http://www.autoitscript.com/wiki/AutoIt_and_Malware

So that the community can update it as required. I've copied the first post into the wiki, but it's pretty out of date (I believe) - hopefully someone can update it/wikify it/reword it :D

Share this post


Link to post
Share on other sites

Posted

I've only just found this web page

How to Report Malware or False Positives to Multiple Antivirus Vendors

Updated 5. January 2013

From a quick read through it looks like exactly what we need.

Maybe the WIKI could be cut down to an explaination WHY AutoIt isn't a virus and a link to that page so they can send in false positives to the vendor(s). :)

It's 2am so off to bed

John Morrison

Share this post


Link to post
Share on other sites

Posted

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

Share this post


Link to post
Share on other sites

Posted

I still think the ultimate (That can be achived at this moment) solution is what I suggested here

Basically a tool that we (autoit programmers) can run our latest creations through to see if it triggers any virus alerts (Using Virus total).

If it triggers and alert the tool will email the antivirus company to "try" and have it removed.

I looked into it and got lost in controlling the VirusTotal JSON API.

https://www.virustotal.com/documentation/public-api/

It seems simple but I just can't get my head around it.

If I can get help with doing that then the rest is just tieing together some basic items.

It really doesn't have ot be anything extra special just a tool to help.

Here to help

John Morrison

Share this post


Link to post
Share on other sites

Posted (edited)

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority. Edited by Jon

Share this post


Link to post
Share on other sites

Posted

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority.

I'd agree with that. I did go through and check all the links; updated a couple of dead ones. Maybe list the top 5 or so explicitly, and then provide the link from storme's post #8 with a line "if you do not see the offending AV company, click here for instructions on submitting to other companies, etc. etc."?

Share this post


Link to post
Share on other sites

Posted

John T. Halley of PortableApps.com wrote on 2013-02-22 5:57pm (at http://portableapps.com/node/36508#new)

"DropIT is written in AutoIT. AutoIT is not a compiled language. It merely takes the closed source AutoIT EXE and sticks the script onto the end of it in encrypted form, making it very difficult for tools to analyze is goodware vs badware-ness. AutoIT is also very popular with malware writers since it is relatively easy to use and relatively powerful, with access to most of the Windows API. Since every AutoIT-based EXE is basically the same EXE, false positives run rampant across all kinds of antivirus engines.

We had allowed an AutoIT-based app into the app directory, EraserDrop Portable, quite some time ago. We have had numerous issues with false positives in that time. The author even created an updated version last year, but it was detected as a virus by several major antivirus engines, so we have not released it. The end result was that users complain to us that downloads have viruses in them even when they don't.

Due to the issues with AutoIT-based EXEs, we instituted a policy against any new AutoIT apps a few years ago. As the same issues persist, we're unlikely to change that policy."

Do the AutoIt devs have any comments on this?

Share this post


Link to post
Share on other sites

Posted

I'm not a developer, but I'd have to say that John T. Halley is a moron.

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?

Share this post


Link to post
Share on other sites

Posted (edited)

I would add that, personally anyway, I have never had great luck with PortableApps. When I want something I can run from a thumbdrive, I fire up Cameyo (free), SVS (free) or ThinApp (Not free but worth it), and do it myself.

Edited by JLogan3o13

Share this post


Link to post
Share on other sites

Posted

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?

1. I'd say more than in autoit.

2. I'd say nowhere near as many as autoit.

They're tossers for banning autoit programs, but his point is valid.

You have seen how it can be, I certainly have when I awoke to find my av had flagged every single compiled script on my machine as virus.

It's not their fault, and it's not ours, the burden of responsibility, to me, sits squarely on the shoulders of the AV companies, they are the ones making the big money and claiming to protect machines from viruses.

When a person downloads an app from there, and it's flagged, they don't generally come here, they complain to them, they don't know what we do, they don't even know what language it's written in, or what even a programming language is, and they've never heard of autoit.

Should they accept the workload of dealing with it all? I certainly wouldn't.

Share this post


Link to post
Share on other sites

Posted

uninstall the autoit. fix isue registry with ccleaner. restart computer. install agains.

DONE

Share this post


Link to post
Share on other sites

Posted

I am very low in coding things but i noticed that ...

may this can help)

i used compilation of a false detected malwar by avast and it solved my issue with these parameters

Default settings:

Compression > Normal

UPX compresse .exe stub

Used settings to not get anymore my script as a malwar:

Compression > lowest

Share this post


Link to post
Share on other sites

Posted

I discovered that sometimes if you remove the ICON at compiler time, or change it,  it works (Av=kaspberry v6)

I hope this can help someone

On my case, compression= lowest didn´t solve it.

Jose

Share this post


Link to post
Share on other sites

Posted

kaspberry

Are you sure?

Share this post


Link to post
Share on other sites

Posted

:ILA2:

Thanks to the helpfull info and support here...

I have quickly looked through the posts and replies here and did not notice anything on the following. Maybe somebody has an answer to this or a pointer to where I can find an answer. I refer to my post on AVIRA's Q&A:

"AVIRA alerts when packing my scripts with AutoIt v3 Obfuscator"
"I develop applications using the AutoIt Scripting language. Recently I started getting AVIRA virus alerts when packing my scripts using the built in AutoIt v3 Obfuscator tools. AVIRA now reports my scripts (.exe) as "dr/autoit.gen" suspicious. When I don't use the script obfuscator when compiling scripts to .exe then AVIRA doesn't pop up saying it's a suspicious file. Why? The scripts/ programs I compile are clean. Online virus scans like VirusTotal and VirSCAN.org shows nothing."

AVIRA will obviously scan the file I've uploaded to them and analyse my code. Fair enough, so that sorts my problem when making softwares available to end-users, but still, I need to know why it's happening...as a scriptor/programmer..

Share this post


Link to post
Share on other sites

Posted

MetalloSoft,

 

I need to know why it's happening

It is happening because the AV companies are too lazy/stupid/incompetent to do anything other than look at a basic signature when analysing compiled AutoIt scripts. ;)

Just for interest, it is probably not Obfuscator being flagged (that just scrambles the code), but the upx compressor. In the next release this will not be run by default, but you could always add #AutoIt3Wrapper_UseUpx=n to your script to stop it running if you are still using 3.3.8.1. :)

And now please drop the subject and do not let the poor old Oozlum bird out again - there are multiple (locked) threads on this very subject already which you can find if you search. ;)

M23

Share this post


Link to post
Share on other sites

Posted

seems pretty obvious to me, that the problem is UPX, or, rather the choice to use UPX that is the problem - not the AV companies nor anyone else. if you choose to use tools that are common with nefarious types, then you are likely going to get caught up in that (as AutoIt has). I'm very happy to see this is fixed in the next release, but common guys, lets stop pushing the blame. AutoIt has/had a problem that made it appear questionable to majority of AV programs, that's no skin off their back - only off the back of this community.

Share this post


Link to post
Share on other sites

Posted

You don't understand the problem at all. The UPX program is a compressor that is used by a lot of software not just AutoIt. The problem is that the AV companies see all AutoIt scripts with the belief that it's "probably" a virus so lets flag it as such. The problem has been beaten to death, and the issue is that the AV companies are lazy.

Share this post


Link to post
Share on other sites

Posted

Way to live up to your moniker, KnowsNothing ;) AV companies block many programs, written in and compressed with different software, based on what a minority of individuals do with that software. It is foolish to blame the AutoIt language in its entirety for what a few individuals do with it.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now