Andreas Bräu Posted October 4, 2006 Share Posted October 4, 2006 Hi people, since this morning i have a strange problem using compiled autoit-scripts with the default icon. Everytime i want to compile the script mcAfee pops up with a virus alert "Startpage-JR". If I use another icon than the default one, there are no problems. Does anyone know this problem too? Andi Link to comment Share on other sites More sharing options...
franvarona Posted October 4, 2006 Share Posted October 4, 2006 Hey, I have the same problem (see next topic), but I didn't know that it had something to do with the icon... How do you change the icon *before* compiling? Thanks, Fran Varona Link to comment Share on other sites More sharing options...
Andreas Bräu Posted October 4, 2006 Author Share Posted October 4, 2006 use %program files%\AutoIt3\Aut2Exe\Aut2Exe.exe, there you can give some options to compile your script... Andi Link to comment Share on other sites More sharing options...
Swent Posted October 4, 2006 Share Posted October 4, 2006 Hi people,since this morning i have a strange problem using compiled autoit-scripts with the default icon. Everytime i want to compile the script mcAfee pops up with a virus alert "Startpage-JR". If I use another icon than the default one, there are no problems.Does anyone know this problem too?Andior you just get a better virusscanner. Link to comment Share on other sites More sharing options...
franvarona Posted October 4, 2006 Share Posted October 4, 2006 Ok, I have tested it and if you use a custom icon, then McAfee doesn't detect the exe file as a virus. Incredible!! At least, I have a solution... Link to comment Share on other sites More sharing options...
Andreas Bräu Posted October 4, 2006 Author Share Posted October 4, 2006 thank you for your answer...but i have no chance because McAfee was bought by our university, so I have to use it... Link to comment Share on other sites More sharing options...
Kreatorul Posted October 4, 2006 Share Posted October 4, 2006 Use the BETA Link to comment Share on other sites More sharing options...
ChrisL Posted October 4, 2006 Share Posted October 4, 2006 I always replace the upx.exe file in my installations with a dummy exe which does nothing and I have never touch wood had any virus scanner pick out an AutoIT file as a virus. I'm not bothered about the little bit of extra size in my compiled scripts [u]Scripts[/u]Minimize gui to systray _ Fail safe source recoveryMsgbox UDF _ _procwatch() Stop your app from being closedLicensed/Trial software system _ Buffering Hotkeys_SQL.au3 ADODB.Connection _ Search 2d Arrays_SplashTextWithGraphicOn() _ Adjust Screen GammaTransparent Controls _ Eventlogs without the crap_GuiCtrlCreateFlash() _ Simple Interscript communication[u]Websites[/u]Curious Campers VW Hightops Lambert Plant Hire Link to comment Share on other sites More sharing options...
MHz Posted October 4, 2006 Share Posted October 4, 2006 (edited) I always replace the upx.exe file in my installations with a dummy exe which does nothing and I have never touch wood had any virus scanner pick out an AutoIT file as a virus. I'm not bothered about the little bit of extra size in my compiled scriptsI have rarely lost a compiled executable UPXed. The blind blame game just continues without thought. Virus makers use UPX but so does the 95 percent or so of other users so in the short term in saying it is a solution is weak. The option now is that a different packer can be used to make a different signiture for the common bin file used which is the more suitable solution, but on the odd chance,so can the virus makers. Edited October 4, 2006 by MHz Link to comment Share on other sites More sharing options...
wkeeter Posted October 4, 2006 Share Posted October 4, 2006 (edited) McAfee released a dat yesterday 4865 that started to delete my scripts. Not good at all. Roll back your dats to 4864. I have a call in with McAfee and they are looking into it. Short term solution. I will post back the results when McAfee gives me feed back. Wayne Edited October 4, 2006 by wkeeter Link to comment Share on other sites More sharing options...
ChrisL Posted October 4, 2006 Share Posted October 4, 2006 I have rarely lost a compiled executable UPXed. The blind blame game just continues without thought. Virus makers use UPX but so does the 95 percent or so of other users so in the short term in saying it is a solution is weak. The option now is that a different packer can be used to make a different signiture for the common bin file used which is the more suitable solution, but on the odd chance,so can the virus makers.Well it seems to me that most of the idiots who try to write viruses with AutoIT are compiling them with the UPX packager, so it is the lame way in which the anti Virus software is detecting them, by not using the UPX packager so far mine have not been detected as a virus.I can however tell you that someone else in our office had the issue of scripts being deleted and when he remade them without the UPX he had no problem.So I do not think that I am playing the blind blame game as you put it. [u]Scripts[/u]Minimize gui to systray _ Fail safe source recoveryMsgbox UDF _ _procwatch() Stop your app from being closedLicensed/Trial software system _ Buffering Hotkeys_SQL.au3 ADODB.Connection _ Search 2d Arrays_SplashTextWithGraphicOn() _ Adjust Screen GammaTransparent Controls _ Eventlogs without the crap_GuiCtrlCreateFlash() _ Simple Interscript communication[u]Websites[/u]Curious Campers VW Hightops Lambert Plant Hire Link to comment Share on other sites More sharing options...
MHz Posted October 4, 2006 Share Posted October 4, 2006 So I do not think that I am playing the blind blame game as you put it.My particular AV being used does not complain, so you tell me the difference. Link to comment Share on other sites More sharing options...
dj9866 Posted October 4, 2006 Share Posted October 4, 2006 (edited) Starting 10/03/2006, I also had the problem with McAfee detecting 'Startpage-JR' and deleting the AutoIT exe's. Recompiles fail. Turned off McAfee and turned on AVG Free Edition and the trojan isn't detected. Following SmOke_N's recommendaton to use the latest beta release, I was able to return to McAfee and execute the compiles without any problem. Edited October 4, 2006 by dj9866 Link to comment Share on other sites More sharing options...
MrBeatnik Posted October 4, 2006 Share Posted October 4, 2006 Just to confirm:http://vil.nai.com/vil/content/v_140658.htmI am in contact with McAfee and AVERT now to try and resolve the issue; I'm not sure McAfee Gold support has that type of clout tho'. Please correct me if I am wrong in any of my posts. I like learning from my mistakes too. Link to comment Share on other sites More sharing options...
wkeeter Posted October 4, 2006 Share Posted October 4, 2006 Update!! Ok today at 10:30am Mcafee has sent me an extra.dat file that resolved this issue with dat version 4865. My scripts are no longer being deleted. I guess you should contact them for this file. Wayne Link to comment Share on other sites More sharing options...
ZipleR Posted October 4, 2006 Share Posted October 4, 2006 (edited) Update!!Ok today at 10:30am Mcafee has sent me an extra.dat file that resolved this issue with dat version 4865.My scripts are no longer being deleted.I guess you should contact them for this file.WayneWould you be able to tell us anything else about the extra.dat so we can specifically request it when we call them?.. I sent them several compiled scripts they can "pick apart" the website you can submit .exe's to is www.webimmune.netJust create an account, and click submit a file. In there under Virus Name enter 'StartPage-JR Trojan-FALSE DETECTION'The more people submit scripts (with out your domain passwords ) the quicker the problem will get resolved in a future dat release. Edited October 4, 2006 by ZipleR Link to comment Share on other sites More sharing options...
lawson23 Posted October 4, 2006 Share Posted October 4, 2006 As I have made a submission to webimmune Analysis ID: 2566204 I have now found that newly released dats today 4866 no longer detect this as a virus. Link to comment Share on other sites More sharing options...
ZipleR Posted October 4, 2006 Share Posted October 4, 2006 (edited) As I have made a submission to webimmune Analysis ID: 2566204 I have now found that newly released dats today 4866 no longer detect this as a virus.Just got off the phone with them. You are Correct. 4866 fixes the problem.Apparently if there is an extra.dat those all get included in the next .dat release Edited October 4, 2006 by ZipleR Link to comment Share on other sites More sharing options...
lawson23 Posted October 4, 2006 Share Posted October 4, 2006 I know if I right click on my shield it says 'update now'. Link to comment Share on other sites More sharing options...
wkeeter Posted October 4, 2006 Share Posted October 4, 2006 If update now don't work then go here.http://www.mcafee.com/apps/downloads/secur...updates/dat.aspWayne Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now