AntiVirus False Positives (Again)

[FuryCell]

I just scanned an AutoItScript I compiled at http://virusscan.jotti.org/ and got these results:

File: MD5.exe

Status: INFECTED/MALWARE

MD5 49874947f9287de91c606c981afc79ed

Packers detected: UPX, AUTOIT

Scanner results

AntiVir Found nothing

ArcaVir Found Trojan.Clicker.Small.Ht

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

UNA Found nothing

VBA32 Found nothing

It appears to be another false postive becuase of careless updates to antivirus definitions.

Edited December 3, 2005 by SolidSnake

[w0uter]

could you give some more info like what was in it and what was it compiled/packed with ?

latest beta gives me this.

POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). This might be a false positive. Therefore, results of this scan will not be stored in the database)

VBA32

Found Trojan-Downloader.Agent.70 (probable variant)

ArcaVir probbly just flagged it becouse it was packed by the default UPX.

Edited December 3, 2005 by w0uter

[FuryCell]

could you give some more info like what was in it and what was it compiled/packed with ?

latest beta gives me this.

I have attached the script which was compiled using the v3.1.1 compiler. It was an MD5 include I downloaded off the forums.

ArcaVir probbly just flagged it becouse it was packed by the default UPX.

I do not understand what you mean by this. Could you please try and explain it in different words.

Thanks for the feedback.

-SolidSnake

MD5.au3

Edited December 3, 2005 by SolidSnake

[SmOke_N]

AutoIt uses a UPX packer by default. w0uter was simply stating that, the anti-virus protection programs, typically find this and label it as a 'potential threat'. That seems to be the consensus here.

[FuryCell]

AutoIt uses a UPX packer by default. w0uter was simply stating that, the anti-virus protection programs, typically find this and label it as a 'potential threat'. That seems to be the consensus here.

Thanks.

[w0uter]

tested it with the latest beta + upx beta

Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). 
            This might be a false positive. Therefore, results of this scan will not be stored in the database)

MD5:            317612dd7eaac711d4bdf698f5b47047

Packers detected:   UPX, AUTOIT

Scanner results:
AntiVir         Found nothing
ArcaVir         Found nothing
Avast           Found nothing
AVG Antivirus       Found nothing
BitDefender     Found nothing
ClamAV          Found nothing
Dr.Web          Found nothing
F-Prot Antivirus    Found nothing
Fortinet        Found nothing
Kaspersky Anti-Virus    Found nothing
NOD32           Found nothing
Norman Virus Control    Found nothing
UNA         Found nothing
VBA32           Found Trojan-Downloader.Agent.70 (probable variant)

Edited December 3, 2005 by w0uter

[FuryCell]

tested it with the latest beta + upx beta

Status:         POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). 
            This might be a false positive. Therefore, results of this scan will not be stored in the database)

MD5:            317612dd7eaac711d4bdf698f5b47047

Packers detected:   UPX, AUTOIT

Scanner results:
AntiVir         Found nothing
ArcaVir         Found nothing
Avast           Found nothing
AVG Antivirus       Found nothing
BitDefender     Found nothing
ClamAV          Found nothing
Dr.Web          Found nothing
F-Prot Antivirus    Found nothing
Fortinet        Found nothing
Kaspersky Anti-Virus    Found nothing
NOD32           Found nothing
Norman Virus Control    Found nothing
UNA         Found nothing
VBA32           Found Trojan-Downloader.Agent.70 (probable variant)

That makes two problems VBA32 and AcraVir. Guess somebody should send an email to both of them so they can fix their definitions.

Thanks for the feedback.

Edited December 4, 2005 by SolidSnake