Jump to content
Sign in to follow this  
FaridAgl

how to fix this false positives?

Recommended Posts

FaridAgl

First take a look on this report:

http://www.virustotal.com/file-scan/report.html?id=338d59b4e084b7f342929049383ca4c049167248370311f124e10346ff488ef1-1317642888

I exactly know what i write in my script and i really don't know why the Virus Scan result is 4/43.

i want to know what can be the reason of this, i mean what codes maybe will coz this result?

my script's includes:

WindowsConstants.au3

StaticConstants.au3

GUIConstantsEx.au3

ComboConstants.au3

EditConstants.au3

_UskinLibrary.au3

GuiTreeView.au3

NomadMemory.au3

String.au3

Misc.au3

If any one interested to help me i will share the script, it's about 2000 line.

Share this post


Link to post
Share on other sites
rcmaehl

I don't see anything includes that would trigger those results, so please post the script.

EDIT: Then again it might just be UPX being sassed again.

Edited by rcmaehl

My UDFs are generally for me. If they aren't updated for a while, it means I'm not using them myself. As soon as I start using them again, they'll get updated.

My Projects
Cisco FinesseGithubIRC UDFWindowEx UDF

 

Share this post


Link to post
Share on other sites
kaotkbliss

A while back, AVG started flagging a few of my scripts.

The things they had in common were FileInstall and ReWrite/RegDelete that weren't in other scripts. (At least not both)

When I could not find a "submit file for review" as they once had and it would still constantly flag files I marked as safe, I finally removed AVG and am now looking for a new AV.

Anyways, my point was

Maybe it's not the includes but something your script is doing (like fileinstall or reg edits) that your AV consideres Viral behavior?

I'm also suspicious of the NomadMemory as I could see messing with the ram as being a flag...


010101000110100001101001011100110010000001101001011100110010000

001101101011110010010000001110011011010010110011100100001

My Android cat and mouse game
https://play.google.com/store/apps/details?id=com.KaosVisions.WhiskersNSqueek

We're gonna need another Timmy!

Share this post


Link to post
Share on other sites
FaridAgl

I was using fileinstall, it coz 1 other false positive. i just removed fileinstall and now it has a result of 4/43

i will take a look at regwrite & regdelete.

tnx.

Share this post


Link to post
Share on other sites
BrewManNH

3 of those 4 ding reports are telling you that it's an AutoIt3 script, I don't see a problem there most likely those POS AV softwares will flag anything that's an AU3 script as a possible problem. Note it says generic heuristic, not that it's any kind of virus. The other one is just because that AV software probably sucks.


If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.
Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag Gude
How to ask questions the smart way!

I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from.

Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays.  -  ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script.  -  Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label.  -  _FileGetProperty - Retrieve the properties of a file  -  SciTE Toolbar - A toolbar demo for use with the SciTE editor  -  GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI.  -   Latin Square password generator

Share this post


Link to post
Share on other sites
Mobius

Hello D4RKON3,

If your project is not packed with upx I assume you are using no software armoring tools at all, so those 4 flags are just the standard flags for AutoIt3 interpreted executables.

Here is a little trick that might deter some of those flags for a while (assuming the flags are based on static and not behavioural analysis)

When you build your product instead of letting Aut2Exe append the a3x data to the tail of the interpreter as normal, create an a3x file.

Aut2Exe.exe /in MyProd.au3 /out MyProd.a3x

Then add the a3x file to the resource table of your interpreter with a resource editor. (or api)

Run it to see that the interpreter detects the a3x. (it will :graduated:)

Then send / scan it yourself to see the results.

On an unrelated side note this method also allows for further editing of the resource table after your products build without risk of corrupting the a3x data. (unless of course you decide to pack it and forget to tell the packer not to pack the resource table entrance in which the a3x resides)

Of course this will not help you if said tools are simply looking for certain default components that make up the a3x file, and or the interpreter in its unpacked state or as said before they are getting hot under the collar because of your products actions and not its content.

Vlad

Edited by Mobius

Share this post


Link to post
Share on other sites
Skitty

Or make a complaint to the AV fabricator and tell them how shitty their AV is and that your new mission in life is to spread the word about how crappy and fraudulent their product is due to the fact that (instead of developing the AV correctly) they are lazy good for nothing pricks that would rather flag everything you download as a threat as an excuse for bad development, that way, if you did end up as a part of a botnet and some one hacks Microsoft's server using your PC, they say "Oh, well we warned you buddy!".


Things that I've done..

Icon Resource Editor: icon resource editor 

AutoIt Piano: a piano

AutoIt Unlocker: unlocks files when you want to delete them

Colorful tooltips: a wrapper for the tool tips UDF

Rouge GoogleBot: a full screen animation

ASciTE text editor: a text editor written in autoit

Warning: Posts by this user are subject to change or may disappear without notice.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×