Are my AutoIt exes really infected?

[Melba23]

MacScript,

Mobius' suggestion of disabling your AV while you compile a test binary is exactly what I did a few weeks ago when I alerted a company to a false positive. I sent then a simple script (a "Hello world" MsgBox), the compiled exe and a link to the AutoIt download page - they fixed the problem in a few hours.

M23

[mLipok]

Wow

Which the company operates so quickly ?

[mLipok]

Today I find:

ALL VENDORS LIST

ps.

Wiki updated.

[MacScript]

Thanks All for your replies. I use the same AV on two computers. Can some explain to me why all of the sudden the software is flagging ALL items created by autoit?  My third computer which is running different AV then my others seems to have no issues with my applications.  Did the AV computer update their virus file all of a sudden during the day yesterday when this happened (kinda stupid questions imo, but just trying to figure out how the heck this happened all the sudden.)

Thanks All

[JLogan3o13]

Yes, a recent update is the most likely culprit, as it always is. It happens, a lot with some companies. You simply need to inform the AV company and provide them an example of the script, as has been suggested.

[Zedna]

For AVG there is this address for sending false positives:
 
http://kb.avg.com/articles/cs/How_to/How-to-report-a-false-incorrect-detection?l=cs
http://www.avg.com/submit-sample = http://samplesubmit.avg.com/

Edited July 15, 2014 by Zedna

[sammy66]

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

[Dana]

Doing a virus scan last night with Avast while trying to deal with a rootkit infection, it flagged a bunch of .au3 files (not compiled exe's) as something "maloob".  Most of these were (intermediate?) obfuscated files in the recycle bin, but some were my original scripts.  Oddly, it didn't flag any of the compiled (exe) files.

[guinness]

  On 9/10/2014 at 3:35 PM, Dana said:

Doing a virus scan last night with Avast while trying to deal with a rootkit infection, it flagged a bunch of .au3 files (not compiled exe's) as something "maloob".  Most of these were (intermediate?) obfuscated files in the recycle bin, but some were my original scripts.  Oddly, it didn't flag any of the compiled (exe) files.

Report to Avast not here.

[JLogan3o13]

49 entries in this thread, all with pretty much the conclusion that guinness points out - report issues to the AV company. And still people report it here...

[Dana]

Sorry, wasn't so much reporting it here as wondering if anybody else had seen this and/or why a simple text file (which is all an uncompiled script is) could get flagged as malicious while the exe compiled from the same file is ignored.  I will be reporting it to Avast.

[JLogan3o13]

Again, I would suggest reading through this entire thread as to an answer. There are reasons companies begin flagging script, sometimes those reasons have merit but most often they're arbitrary.

[BrewManNH]

Avast sucks, always will, I had it for a little while until it started deleting my scripts and exes made with AutoIt, then I dumped it. Not to mention it's constant nagging to buy the full version and all the other crapware the company puts out.

[Zedna]

@BrewManNH

Good compromise is to add all directories containing AutoIt and AutoIt's scripts to exclusion list of your AV

so it will skip these directories from all scanning.

That way you can have AV protection of your computer without any negative effects on AutoIt's stuff.

I use it that way and I'm happy without any false positives :-)

Edited September 14, 2014 by Zedna

[everseeker]

  On 9/14/2014 at 2:20 PM, Zedna said:

@BrewManNH

Good compromise is to add all directories containing AutoIt and AutoIt's scripts to exclusion list of your AV

so it will skip these directories from all scanning.

That way you can have AV protection of your computer without any negative effects on AutoIt's stuff.

 

I use it that way and I'm happy without any false positives :-)

This only works if you have positive control of your work product.

If you are say, writing code that you compile and distribute within your organization, it is not fun to get 163 messages from assorted peeps saying "zoikes, that cool desktop wigit you wrote has been infected by a mean old nasty virus!"

In any event, it's not autoit, it's the av company that needs to be alerted

[StewartWilkinson]

It seems that some AV Company's have this problem again - here is a link for a test using the one line 'MsgBox(0, "Tutorial", "Hello World!")' that I created and uploaded a few days ago after I found that one of my real programs was stopped from running by someone's AV product:

https://www.virustotal.com/en/file/f8592a4cfc2c4bc6e20bc73e72c9dff7b2d459a6141454a7881604e576701c0e/analysis/1422175811/

[JLogan3o13]

And, as is always the response - contact the AV company in question.

[StewartWilkinson]

I tried to contact one of the AV companies via Facebook last night and just got directed to their support web site, but that is clearly intended for customers using one of their products and was not working very well - looking again just now it seems that I can't contact them by email (via the site) untill 1800 UK (15 minutes or so). I don't want to contact them by Phone as that requires me to provide product details such as product version which is just completely stupid in this situation.

[caramen]

Comunity have to act on this!

We definitly need clean .exe to script in enterprise.

Edited February 3, 2015 by caramen

[JLogan3o13]

There is nothing for "community" to act on, that is the entire point of this thread. If you are having a problem with your scripts causing false positives, you need to work with that AV vendor.