Jump to content

Are my AutoIt exes really infected?


Recommended Posts

I would like to propose a workaround.

For those of you who can, downgrading from the newest version to version 3.1.1 does seem to work. Apparently there's something in the new AutoIt3.bin file included in versions after 3.1.1 that's creating a "lookalike" pattern during the compile and UPX compression.

I noticed this during the first round of false-positves with Norton's AV client. I'd not recompiled all my programs with the new version, but I did compile a few of the COM aware scripts that I'd written with the 3.1.1 betas. I also did some work on some old scripts, compiling them with the new version. All newly compiled scripts were eventually whacked, but those compiled with 3.1.1 were untouched.

This is the solution that I've decided to run with at this time. Though the new features in 3.2 (COM and whatnot) are absolutely awesome, I don't have any scripts that utelize said features and I don't want to deal with the hassle of 400 users saying "My xyz program doesn't work anymore! Fix it!" because of a false positive.

Edited by Blue_Drache

Lofting the cyberwinds on teknoleather wings, I am...The Blue Drache

Link to comment
Share on other sites

Rather than hacking upx or the runtime engine we should (as JS points out when he provided the contact information) make a request to the Antivirus maker to fix their scanner such that it does not detect our files as false positives.

Make sure to send them a copy of the file. If you are the author of the file it would benefit the comunity if you added instructions on how to decompile it to let them peek at the source.

So in your request:

  • Use a real mail address. They should be able to contact you to get further information.
  • Be polite. It is a business your dealing with. Negative wording and disrespectfull behaviour will not benefit you or us.
  • Only use objective arguments.
  • State clearly if you are the author of the file detected as a false positive.
  • If you can, let them have a peek at the source (instructions on how to decompile).
  • Let them know that you and most of the comunity are eager to find a solution. And will, as fare as our knowledge goes, do wathever we can to do so.
Link to comment
Share on other sites

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Link to comment
Share on other sites

  • 1 month later...
  • Administrators

Talk to Jon, he's the one who wrote it, named it and mis-informed everybody with the above post.

However, I would argue that it shouldn't take more than 2 seconds to figure this out. If you know enough to want to disable UPX, you should know it's a compressor therefore a quick look at the options will provide only one with "UPX" and "compress" in the name. Maybe it is mis-named and not implemented right, but I don't think it takes a computer science degree to figure out what it's for if you know enough about UPX to want to disable it in the first place.

Only just seen this. So. Oi! :P
Link to comment
Share on other sites

  • 6 years later...
  • Administrators

This thread will be replaced with a pointer to the wiki: http://www.autoitscript.com/wiki/AutoIt_and_Malware

So that the community can update it as required. I've copied the first post into the wiki, but it's pretty out of date (I believe) - hopefully someone can update it/wikify it/reword it :D

Link to comment
Share on other sites

I've only just found this web page

How to Report Malware or False Positives to Multiple Antivirus Vendors

Updated 5. January 2013

From a quick read through it looks like exactly what we need.

Maybe the WIKI could be cut down to an explaination WHY AutoIt isn't a virus and a link to that page so they can send in false positives to the vendor(s). :)

It's 2am so off to bed

John Morrison

Link to comment
Share on other sites

  • Moderators

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

"Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball

How to get your question answered on this forum!

Link to comment
Share on other sites

I still think the ultimate (That can be achived at this moment) solution is what I suggested here

Basically a tool that we (autoit programmers) can run our latest creations through to see if it triggers any virus alerts (Using Virus total).

If it triggers and alert the tool will email the antivirus company to "try" and have it removed.

I looked into it and got lost in controlling the VirusTotal JSON API.

https://www.virustotal.com/documentation/public-api/

It seems simple but I just can't get my head around it.

If I can get help with doing that then the rest is just tieing together some basic items.

It really doesn't have ot be anything extra special just a tool to help.

Here to help

John Morrison

Link to comment
Share on other sites

  • Administrators

I made some minor spelling and grammatical updates to the page.. I think storme's idea is a good one, but I'm going through all the site links now to ensure there are no dead ones until we decide to go that route.

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority. Edited by Jon
Link to comment
Share on other sites

  • Moderators

Maybe we just have most popular AV vendors explicitly (just in case an external link to a more in depth guide gets removed). Easier for us to maintain that way but still useful for the majority.

I'd agree with that. I did go through and check all the links; updated a couple of dead ones. Maybe list the top 5 or so explicitly, and then provide the link from storme's post #8 with a line "if you do not see the offending AV company, click here for instructions on submitting to other companies, etc. etc."?

"Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball

How to get your question answered on this forum!

Link to comment
Share on other sites

  • 1 month later...

John T. Halley of PortableApps.com wrote on 2013-02-22 5:57pm (at http://portableapps.com/node/36508#new)

"DropIT is written in AutoIT. AutoIT is not a compiled language. It merely takes the closed source AutoIT EXE and sticks the script onto the end of it in encrypted form, making it very difficult for tools to analyze is goodware vs badware-ness. AutoIT is also very popular with malware writers since it is relatively easy to use and relatively powerful, with access to most of the Windows API. Since every AutoIT-based EXE is basically the same EXE, false positives run rampant across all kinds of antivirus engines.

We had allowed an AutoIT-based app into the app directory, EraserDrop Portable, quite some time ago. We have had numerous issues with false positives in that time. The author even created an updated version last year, but it was detected as a virus by several major antivirus engines, so we have not released it. The end result was that users complain to us that downloads have viruses in them even when they don't.

Due to the issues with AutoIT-based EXEs, we instituted a policy against any new AutoIT apps a few years ago. As the same issues persist, we're unlikely to change that policy."

Do the AutoIt devs have any comments on this?

Link to comment
Share on other sites

I'm not a developer, but I'd have to say that John T. Halley is a moron.

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?

If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.
Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag Gude
How to ask questions the smart way!

I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from.

Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays.  -  ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script.  -  Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label.  -  _FileGetProperty - Retrieve the properties of a file  -  SciTE Toolbar - A toolbar demo for use with the SciTE editor  -  GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI.  -   Latin Square password generator

Link to comment
Share on other sites

  • Moderators

I would add that, personally anyway, I have never had great luck with PortableApps. When I want something I can run from a thumbdrive, I fire up Cameyo (free), SVS (free) or ThinApp (Not free but worth it), and do it myself.

Edited by JLogan3o13

"Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball

How to get your question answered on this forum!

Link to comment
Share on other sites

How many viruses are there that are written in C++, C#, Lisp, etc.? How many false positives from shitty AV software do legitimate exes have, that aren't written in AutoIt?

1. I'd say more than in autoit.

2. I'd say nowhere near as many as autoit.

They're tossers for banning autoit programs, but his point is valid.

You have seen how it can be, I certainly have when I awoke to find my av had flagged every single compiled script on my machine as virus.

It's not their fault, and it's not ours, the burden of responsibility, to me, sits squarely on the shoulders of the AV companies, they are the ones making the big money and claiming to protect machines from viruses.

When a person downloads an app from there, and it's flagged, they don't generally come here, they complain to them, they don't know what we do, they don't even know what language it's written in, or what even a programming language is, and they've never heard of autoit.

Should they accept the workload of dealing with it all? I certainly wouldn't.

AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt   ipify 

Monkey's are, like, natures humans.

Link to comment
Share on other sites

  • 4 months later...

I am very low in coding things but i noticed that ...

may this can help)

i used compilation of a false detected malwar by avast and it solved my issue with these parameters

Default settings:

Compression > Normal

UPX compresse .exe stub

Used settings to not get anymore my script as a malwar:

Compression > lowest

My video tutorials : ( In construction )  || My Discord : https://discord.gg/S9AnwHw

How to Ask Help ||  UIAutomation From Junkew || WebDriver From Danp2 || And Water's UDFs in the Quote

Spoiler

 Water's UDFs:
Active Directory (NEW 2018-10-19 - Version 1.4.10.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (2018-10-31 - Version 1.3.4.1) - Download - General Help & Support - Example Scripts - Wiki
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
PowerPoint (2017-06-06 - Version 0.0.5.0) - Download - General Help & Support
Excel - Example Scripts - Wiki
Word - Wiki
 
Tutorials:

ADO - Wiki

 

Link to comment
Share on other sites

  • 3 months later...

kaspberry

Are you sure?

This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Link to comment
Share on other sites

  • Melba23 changed the title to Are my AutoIt exes really infected?
  • Melba23 pinned this topic

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...