AutoIt3Wrapper.exe identifies as a trojan in McAfee

[Tippex 0]

When attempting to install SciTE4AutoIt3.exe latest update (14-8-2008 for "AutoIt v3.2.12.1 and BETA v3.2.13.7") McAfee detects AutoIt3Wrapper.exe as a trojan and quarantines it. I know other AutoIT users with the same problem. I don't know how to report this back to the Scite team to that they can fix the problem or (if false positive) so that they can contact McAfee to get the problem fixed.

Tippex

[Jos 1,057]

As I answered to your report you submitted via the suggestions form: You will have to get with your AV provider as this is a false positive of your AV software.

Jos

[herewasplato 0]

... I don't know how to report this back to the Scite team to that they can fix the problem or (if false positive) so that they can contact McAfee to get the problem fixed. ...

As Jos said, that will be your task. AutoIt and SciTE4AutoIt3 are both free - developed and maintaned by volunteers. You can help yourself and others by using the contact info for McAfee listed in this post :-)

http://www.autoitscript.com/forum/index.php?showtopic=34658

[arekkusu82 0]

As Jos said, that will be your task. AutoIt and SciTE4AutoIt3 are both free - developed and maintaned by volunteers. You can help yourself and others by using the contact info for McAfee listed in this post :-)

http://www.autoitscript.com/forum/index.php?showtopic=34658

Where can we find older versions of the AutoIt Wrapper in the meantime???

[Jos 1,057]

What happens when you use this version of AutoIt3Wrapper.exe which is compiled without UPX?

http://www.autoitscript.com/autoit3/scite/...oIt3Wrapper.exe

Jos

[spudw2k 141]

What happens when you use this version of AutoIt3Wrapper.exe which is compiled without UPX?

http://www.autoitscript.com/autoit3/scite/...oIt3Wrapper.exe

Jos

Muy Bien Edited September 22, 2008 by spudw2k

[arekkusu82 0]

What happens when you use this version of AutoIt3Wrapper.exe which is compiled without UPX?

http://www.autoitscript.com/autoit3/scite/...oIt3Wrapper.exe

Jos

Thanks, that worked.

[joseLB 1]

What happens when you use this version of AutoIt3Wrapper.exe which is compiled without UPX?

http://www.autoitscript.com/autoit3/scite/...oIt3Wrapper.exe

Jos

My AVG is telling that:

Virus identified Worm/Autoit.DDH

it's on AuoIt3Wrapper.exe

detected on close (during installation).

This hapens today when I tried to sintax chek an au3, in the version I had installed on my PC for about 2-3 weeks.

So I uninstalled AU3, download a new version and during instalation it gave the same message for the wrapper (scite instalation, AU3 instalation was OK).

In AVG is simple to ignore the message, but I'm insecure if the copy I just downloaded from http://www.autoitscript.com/autoit3/scite/...iTE4AutoIt3.exe is ok or not.

edit: ===> I superseded the wrapper with the above link and it worked OK with AVG.

Thanks

Jose

Edited September 23, 2008 by joseLB

[joseLB 1]

Hi

Any news on this issue? As we can see, there is something strange with scite, as it's related to macafee and avg...

[Tippex 0]

Fixed!!

A.V.E.R.T. Sample Analysis

Issue Number: 4848495

Virus Research Analyst: Patricia Ammirabile

Filename: autoit3wrapper.exe

Detected as Generic.dx in DAT: 5388/5389

Identified: No Virus/Trojan

AVERT Labs, Sao Paulo, SP

You will need to update your McAfee then AutoIt3Wrapper.exe will be left alone!

----- Original Message -----

From: "Virus Research" <Virus_Research@avertlabs.com>

Sent: Tuesday, September 23, 2008 9:35 PM

Subject: RE: Escalated - 4848495: Webimmune

Synopsis -

Our Senior Virus Research Engineers have examined the file in question

and no virus was found.

This detection has been corrected in the current DAT set.

Solution -

Please update your DAT files to correct detection of these files.

Engine and DAT updates are available at:

<http://www.mcafee.com/apps/downloads/security_updates/dat.asp>

[herewasplato 0]

Hi

Any news on this issue? As we can see, there is something strange with scite, as it's related to macafee and avg...

Normally, I would just install AVG and get my own answer to what I'm about to ask you - but I cannot install AVG right now for reasons that I'll not bore you with.

So - update you AVG to the latest AV signatures and contribute to the whole AutoIt community by answering the question that Jos posed in his post above:

What happens when you use this version of AutoIt3Wrapper.exe which is compiled without UPX?

http://www.autoitscript.com/autoit3/scite/...oIt3Wrapper.exe

Jos

If you need help turning off UPX compression, do this:

Start > Programs (All Programs) > AutoIt v3 > Compile Script to .exe

Once that program loads, select "Options" and then - if there is a check by "Use UPX Compress .exe stub" - click once on that option to remove that check.

Now close the window with the title ...

"Aut2Exe v3 - AutoIt Script to EXE Converter"

... and create a new au3 file with only one character in it:

;

Save that file and right-click on it from within the Windows file explorer.

Select "Compile Script" from the context menu.

If you AVG software allows the file to stay around long enough, the file size of your new compiled uncompressed file should be about 515KB using AutoIt v3.2.12.1.

If need be, force a scan with AVG and report your findings in this tread. Does AVG still consider that uncompressed file to be "bad"?

[joseLB 1]

So - update you AVG to the latest AV signatures and contribute to the whole AutoIt community by answering the question that Jos posed in his post above:

Thanks herewasplato.

With JOS update, AVG does not report virus anymore, as I told 3 posts above.

My worry was, why standard scite was giving alarm on both macafee and AVG. It coud be that some "hacker" could have changed the download scite file in main page? Anyway, it's working ok with JOS link.

Jose

Edited September 24, 2008 by joseLB

[herewasplato 0]

... With JOS update, AVG does not report virus anymore, as I told 3 posts above. ...

Yes - I saw that your problem was fixed. I was just looking for some info that I asked about. I can test it myself now. :-)