Symantec AntiVirus Quarantines AutoIT Files

[zeevid]

SAV (version 10 at least) with today's 9/20/2006 Rev. 18 Signatures is quarantining the following files:

• UpdateDefs.exe from c:\program files\autoit3\scite\defs
• AutoIt3Wrapper.exe from c:\program files\autoit3\scite\autoit3wrapper
• SciteConfig.exe from c:\program files\autoit3\scite\

SAV thinks that these files are infected with the "Downloader" trojan.

HELP!

Edited September 20, 2006 by zeevid

[Kreatorul]

3rd post with this problem...contact symantec or use ZoneAlarm never had a problem with it

[Michael McNally]

http://www.f-secure.com/weblog/

See item dated Monday, September 18, 2006

[JSThePatriot]

  Kreatorul said:

3rd post with this problem...contact symantec or use ZoneAlarm never had a problem with it

ZoneAlarm isnt really a anti-virus scanner.

Thanks,

JS

[newton1171]

Unfortunately we are stuck with this as it is the "Corporate standard". We're about half way through a roll-out of a new application and now we're 'f'd as it were. Looking at Symantec's site it would appear that Jon can post a dispute at :

https://submit.symantec.com/security_risks/dispute/

and we can all hope it get's fixed. How long before other anti-virus providers block Autoit???

UPDATE!

I just used the latest BETA for my scripts and a quick test shows it working for my purposes. We've called Symantec about a fix for the other version as well.. What a PAIN!

Edited September 20, 2006 by newton1171

[theChad]

We have platinum support with Symantec. We submitted a false-positive report earlier this afternoon and are waiting on a response.

... holding my breath

[Angel]

  theChad said:

We have platinum support with Symantec. We submitted a false-positive report earlier this afternoon and are waiting on a response.

... holding my breath

I just had the same problem! I will contact our IT department but these things go very slowly in a big company like mine. I am also afraid that they may ban our use of AutoIt!

I hope Jon can contact Symantec and get this sorted out. This would be as if they banned the Python interpreter because you can write malicious python scripts! :-(

Angel

[Skruge]

One of our server engineers contacted our TAM and opened a support case. He's still on the phone with a rep (on hold), but the initial indication I got is that this will be fixed in tomorrow's definitions, 9/21/06 10:00am. (didn't think to ask about the timezone)

Fingers crossed...

[nikink]

buggerbuggerbuggerbuggerbuggerbuggerdamn

[jacky_ckw]

sucks, its not only detecting it as downloader virus. its deleting it! must be due to the policy to delete all virus files detected.

hope this issue is resolved... they cant ban Autoit?!

[flanque]

Run LiveUpdate again and update to definitions "20/09/2006 rev. 52" and that should clear it up. Has here.

[Jmtyra]

  flanque said:

Run LiveUpdate again and update to definitions "20/09/2006 rev. 52" and that should clear it up. Has here.

Ditto, works great.

http://www.autoitscript.com/forum/index.php?showtopic=20546

[Bert]

Is it possible to put these files in a exception list in the anti virus software? That way, even if Symantec f's up, you won't have your stuff deleted.

[jacky_ckw]

  flanque said:

Run LiveUpdate again and update to definitions "20/09/2006 rev. 52" and that should clear it up. Has here.

hurray! updated virus def and its ok now. but it had deleted some of the autoit program files. had to reinstall the program back.

[jacky_ckw]

  vollyman said:

Is it possible to put these files in a exception list in the anti virus software? That way, even if Symantec f's up, you won't have your stuff deleted.

neh, i don think so. NAV and McAfee does not have such an option.

its not like the firewall rules where we can add exception lists...

:">

[big_daddy]

  jacky_ckw said:

hurray! updated virus def and its ok now. but it had deleted some of the autoit program files. had to reinstall the program back.

Why not just go into your quarantine and restore them.

[GaryFrost]

Thanks, worked on my pc, notfied the admin to get the symantec servers updated so all pcs get updated, then they have to back thru and start restoreing all my installation apps that were removed.

Sitting with my hands tied till they get everything updated.

[GaryFrost]

  big_daddy said:

Why not just go into your quarantine and restore them.

Some locations may not have it set to quarantine, they might have it set to delete.

[Bert]

Dollars for donuts - we will see this again. You would think the folks who make antivirus stuff would know this by now.

[Angel]

Good news!

The latest symantec virus definition file (from today, september 21st 2006) fix the issue.

Cheers,

Angel