Are my AutoIt EXEs really infected?

128 posts in this topic

#1 ·  Posted (edited)

If you have been using AutoIt for any length of time you will know that it is a great, and powerful scripting language. As with all powerful languages there comes a downside. Virus creation by those that are malicious.

AutoIt has no virii installed on your system, and if a script you have created has been marked as a virus, (and you're not malicious) then this is a false positive. They found a set of instructions in an AutoIt EXE out there somewhere, took the general signature of the file, and now all AutoIt EXE's are marked (or most of them). This can be due to several reasons.

  • AutoIt is packed with UPX. UPX is an open source software compression packer. It is used with many virii (to make them smaller).
  • Malicious scripter got the AutoIt script engine recognized as a virus.
And I am sure there are more ways your executable could be marked, but that covers the basics.

Now I am sure you are wanting to know what you can do to get back up and running without being recognized as a virus. You have to send in a report to the offending AV company alerting them to the false positive they have made. It never hurts to send in your source code along with a compiled exe, to help them realize their mistake.

You may have to wait up to 24 hours for them to release an update. The time it takes really depends on the offending AV company.

Anti-Virus Links

Edit: Added Website links and Contact links.

I hope this helps you understand why your AutoIt executables are marked as virii.

JS

Edited by JSThePatriot
3 people like this

AutoIt Links

File-String Hash Plugin Updated! 04-02-2008 Plugins have been discontinued. I just found out.

ComputerGetInfo UDF's Updated! 11-23-2006

External Links

Vortex Revolutions Engineer / Inventor (Web, Desktop, and Mobile Applications, Hardware Gizmos, Consulting, and more)

Share this post


Link to post
Share on other sites



#2 ·  Posted

Thanks JS, does anybody have anything else to add before I lock this?

Share this post


Link to post
Share on other sites

#3 ·  Posted (edited)

I would like to propose a workaround.

For those of you who can, downgrading from the newest version to version 3.1.1 does seem to work. Apparently there's something in the new AutoIt3.bin file included in versions after 3.1.1 that's creating a "lookalike" pattern during the compile and UPX compression.

I noticed this during the first round of false-positves with Norton's AV client. I'd not recompiled all my programs with the new version, but I did compile a few of the COM aware scripts that I'd written with the 3.1.1 betas. I also did some work on some old scripts, compiling them with the new version. All newly compiled scripts were eventually whacked, but those compiled with 3.1.1 were untouched.

This is the solution that I've decided to run with at this time. Though the new features in 3.2 (COM and whatnot) are absolutely awesome, I don't have any scripts that utelize said features and I don't want to deal with the hassle of 400 users saying "My xyz program doesn't work anymore! Fix it!" because of a false positive.

Edited by Blue_Drache

Lofting the cyberwinds on teknoleather wings, I am...The Blue Drache

Share this post


Link to post
Share on other sites

#4 ·  Posted

Rather than hacking upx or the runtime engine we should (as JS points out when he provided the contact information) make a request to the Antivirus maker to fix their scanner such that it does not detect our files as false positives.

Make sure to send them a copy of the file. If you are the author of the file it would benefit the comunity if you added instructions on how to decompile it to let them peek at the source.

So in your request:

  • Use a real mail address. They should be able to contact you to get further information.
  • Be polite. It is a business your dealing with. Negative wording and disrespectfull behaviour will not benefit you or us.
  • Only use objective arguments.
  • State clearly if you are the author of the file detected as a false positive.
  • If you can, let them have a peek at the source (instructions on how to decompile).
  • Let them know that you and most of the comunity are eager to find a solution. And will, as fare as our knowledge goes, do wathever we can to do so.

Share this post


Link to post
Share on other sites

#5 ·  Posted

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Share this post


Link to post
Share on other sites

#6 ·  Posted

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Only just seen this. So. Oi! :P

"If you can post in the forum, that there is an issue with the forum, then the forum is working spectacularly. All else is cosmetics, and can totally suck it."
- boththose, April 2015.

Share this post


Link to post
Share on other sites

#7 ·  Posted

This thread will be replaced with a pointer to the wiki: http://www.autoitscript.com/wiki/AutoIt_and_Malware

So that the community can update it as required. I've copied the first post into the wiki, but it's pretty out of date (I believe) - hopefully someone can update it/wikify it/reword it :D


"If you can post in the forum, that there is an issue with the forum, then the forum is working spectacularly. All else is cosmetics, and can totally suck it."
- boththose, April 2015.

Share this post


Link to post
Share on other sites

#8 ·  Posted

I've only just found this web page

How to Report Malware or False Positives to Multiple Antivirus Vendors

Updated 5. January 2013

From a quick read through it looks like exactly what we need.

Maybe the WIKI could be cut down to an explaination WHY AutoIt isn't a virus and a link to that page so they can send in false positives to the vendor(s). :)

It's 2am so off to bed

John Morrison

Share this post


Link to post
Share on other sites

#9 ·  Posted

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.


Dealing with end users: "Every day I play hide-and-seek with Stupid. Usually it finds me."

My Scripts: SCCM UDFInclude Source with Compiled Script, Disk Maintenance for Windows XP, "Deal-A-Day" Sites, Windows Firewall UDF

Share this post


Link to post
Share on other sites

#10 ·  Posted

I still think the ultimate (That can be achived at this moment) solution is what I suggested here

Basically a tool that we (autoit programmers) can run our latest creations through to see if it triggers any virus alerts (Using Virus total).

If it triggers and alert the tool will email the antivirus company to "try" and have it removed.

I looked into it and got lost in controlling the VirusTotal JSON API.

https://www.virustotal.com/documentation/public-api/

It seems simple but I just can't get my head around it.

If I can get help with doing that then the rest is just tieing together some basic items.

It really doesn't have ot be anything extra special just a tool to help.

Here to help

John Morrison

Share this post


Link to post
Share on other sites

#11 ·  Posted (edited)

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority. Edited by Jon

"If you can post in the forum, that there is an issue with the forum, then the forum is working spectacularly. All else is cosmetics, and can totally suck it."
- boththose, April 2015.

Share this post


Link to post
Share on other sites

#12 ·  Posted

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority.

I'd agree with that. I did go through and check all the links; updated a couple of dead ones. Maybe list the top 5 or so explicitly, and then provide the link from storme's post #8 with a line "if you do not see the offending AV company, click here for instructions on submitting to other companies, etc. etc."?


Dealing with end users: "Every day I play hide-and-seek with Stupid. Usually it finds me."

My Scripts: SCCM UDFInclude Source with Compiled Script, Disk Maintenance for Windows XP, "Deal-A-Day" Sites, Windows Firewall UDF

Share this post


Link to post
Share on other sites

#13 ·  Posted

John T. Halley of PortableApps.com wrote on 2013-02-22 5:57pm (at http://portableapps.com/node/36508#new)

"DropIT is written in AutoIT. AutoIT is not a compiled language. It merely takes the closed source AutoIT EXE and sticks the script onto the end of it in encrypted form, making it very difficult for tools to analyze is goodware vs badware-ness. AutoIT is also very popular with malware writers since it is relatively easy to use and relatively powerful, with access to most of the Windows API. Since every AutoIT-based EXE is basically the same EXE, false positives run rampant across all kinds of antivirus engines.

We had allowed an AutoIT-based app into the app directory, EraserDrop Portable, quite some time ago. We have had numerous issues with false positives in that time. The author even created an updated version last year, but it was detected as a virus by several major antivirus engines, so we have not released it. The end result was that users complain to us that downloads have viruses in them even when they don't.

Due to the issues with AutoIT-based EXEs, we instituted a policy against any new AutoIT apps a few years ago. As the same issues persist, we're unlikely to change that policy."

Do the AutoIt devs have any comments on this?

Share this post


Link to post
Share on other sites

#14 ·  Posted

I'm not a developer, but I'd have to say that John T. Halley is a moron.

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?


If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.
Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag Gude
How to ask questions the smart way!

I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from.

Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays.  -  ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script.  -  Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label.  -  _FileGetProperty - Retrieve the properties of a file  -  SciTE Toolbar - A toolbar demo for use with the SciTE editor  -  GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI.  -   Latin Square password generator

Share this post


Link to post
Share on other sites

#15 ·  Posted (edited)

I would add that, personally anyway, I have never had great luck with PortableApps. When I want something I can run from a thumbdrive, I fire up Cameyo (free), SVS (free) or ThinApp (Not free but worth it), and do it myself.

Edited by JLogan3o13

Dealing with end users: "Every day I play hide-and-seek with Stupid. Usually it finds me."

My Scripts: SCCM UDFInclude Source with Compiled Script, Disk Maintenance for Windows XP, "Deal-A-Day" Sites, Windows Firewall UDF

Share this post


Link to post
Share on other sites

#16 ·  Posted

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?

1. I'd say more than in autoit.

2. I'd say nowhere near as many as autoit.

They're tossers for banning autoit programs, but his point is valid.

You have seen how it can be, I certainly have when I awoke to find my av had flagged every single compiled script on my machine as virus.

It's not their fault, and it's not ours, the burden of responsibility, to me, sits squarely on the shoulders of the AV companies, they are the ones making the big money and claiming to protect machines from viruses.

When a person downloads an app from there, and it's flagged, they don't generally come here, they complain to them, they don't know what we do, they don't even know what language it's written in, or what even a programming language is, and they've never heard of autoit.

Should they accept the workload of dealing with it all? I certainly wouldn't.


AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt

Monkey's are, like, natures humans.

Share this post


Link to post
Share on other sites

#17 ·  Posted

uninstall the autoit. fix isue registry with ccleaner. restart computer. install agains.

DONE

Share this post


Link to post
Share on other sites

#18 ·  Posted

I am very low in coding things but i noticed that ...

may this can help)

i used compilation of a false detected malwar by avast and it solved my issue with these parameters

Default settings:

Compression > Normal

UPX compresse .exe stub

Used settings to not get anymore my script as a malwar:

Compression > lowest

Share this post


Link to post
Share on other sites

#19 ·  Posted

I discovered that sometimes if you remove the ICON at compiler time, or change it,  it works (Av=kaspberry v6)

I hope this can help someone

On my case, compression= lowest didn´t solve it.

Jose

Share this post


Link to post
Share on other sites

#20 ·  Posted

kaspberry

Are you sure?


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now