Compiled obfuscated seen as Balero-G [Wrm] Alias

[marko001]

Hmm, how to avoid it?

I obfuscate and compile and Avast recognize it as that Worm.

It works if I disable Avast for a while but when/if restarted it recognize again that worm in the compiled executable aswell.

Any way to solve this?

M.

[Jos]

Any way to solve this?

Sure, don;t use Obfuscator or Avast.. . or maybe skip UPX? Edited September 8, 2011 by Jos

[marko001]

any other hint as protector instead of Obfuscator?

[Jos]

The disable UPX suggestion didn't work?

By the way: Obfuscator doesn't protect your code at all, just makes it harder to read.

Jos

Edited September 8, 2011 by Jos

[Zedna]

Another fix is to add directory with Autoit's script as exception to your antivirus

so it will not scan these directories.

I use it this way too.

[marko001]

Skipping UPX doesn't solve it.

Avast will skip folders just for manual scansion.

I disabled Avast and obfuscation worked but once Avast is again active it doesn't allow .exe to run and trashes it.

Looking now for other form of protection instead of Obfuscation, do you hava any hint?

M.

[Tripredacus]

So if you compile without using Obfusicator, Avast doesn't see it as a virus?

[happytc]

About virus, using AUTOIT, we face a dilemma sadly and helplessly.

here the file of aaa.exe only has a blank line(add a Enter), then compiling without UPX.

The result is :

File name:

aaa.exe

Submission date:

2011-08-30 14:24:03 (UTC)

Current status:

finished

Result:

7 /44 (15.9%)

http://www.virustotal.com/file-scan/repo...48ae40f4009d166cc1d9600dc5caf-

[GEOSoft]

First of all; right at the top if the index page for this forum we have

With Avast all you have to do is report it as a false positive and the problem will be solved within hours, often within minutes. They are particularily good about that. It also helps to let them know you are willing to send them the un-obfuscated script so they can check that. For sure they are used to looking at AutoIt scripts.

As a side note; I was looking at the virus updates for the last 30 days and there are 40 that have AutoIt in the virus name. That was yesterday and only for the last 30 days.

[BrewManNH]

I tend to not trust the VirusTotal website for accurate information. For example, I looked at the link that HappyTC posted for his test, and I have had Comodo AV on a system and it never flagged any of my scripts, compiled with or without UPX and with and with Obfuscating them, as a virus.

[WinkleDoodle]

Besides usual case of UPX, I believe the second reason for the virus flag is because of "FileInstall" function.

[Jos]

Looking now for other form of protection instead of Obfuscation, do you hava any hint?

You did see my second line in my post ..right?

What is it you want to protect?

Jos