Are my AutoIt exes really infected?

[Exit]

@obiwanceleri 
It is best not to use an EXE file, but a CMD file.
This is very easy to do with Au3toCmd. Just look in my signature.

[Skeletor]

I had this issue until I came across @argumentum digital signing tool.

Digitally Signing Your executable

[gi_jimbo]

I'm not a regular contributor here but if the @argumentum digital signing tool works, I think it would be good to add it to the "AutoIt and Malware" page (https://www.autoitscript.com/wiki/AutoIt_and_Malware) as well as the "solution" post on this thread.

Edited November 16, 2022 by gi_jimbo
clarification

[62mkv]

See for example here:
https://www.joesandbox.com/analysis/722827/0/html

and here:
https://www.virustotal.com/gui/file/8b7098c44275d0203c23f2ce56c0e913c0d6b6d2264bc537e8a9f0a9f07badc9/community

and here:
https://cuckoo.cert.ee/analysis/3853341/summary/

Maybe it makes sense to mention on the Downloads page and/or Wiki? So people are not getting too frustrated.

 

Or even reach out (if possible) to at least some of community resources to ask them to whitelist the AutoIt itself, by SHA256 maybe

[JLogan3o13]

7 hours ago, 62mkv said:

Maybe it makes sense to mention on the Downloads page and/or Wiki? So people are not getting too frustrated.

Wouldn't curb things as much as you might think. We have tried things like that in the past; there is even an entire thread dedicated to false positives that people see, why the occur, and what to do about them. Yet people continue to post issues they encounter because the don't stop to read.