Why My script detected by NOD32 as virus?

[TeraBit]

When I checked my script by NOD32 antivirus then I received this warning:

ScriptName.exe » AUTOIT » script.au3 - Possibly modified Win32/Autoit.EI worm.

But when I submit this script to Kaspersky Online antivirus center then It didn't see virus inside.

Why My script classified as virus by NOD32 ?

How that sort of viruses can harm system?

[TehWhale]

This has been gone over a million times. Use the search feature of this forums.

[Andreik]

http://www.autoitscript.com/forum/index.ph...st&p=253367

[TeraBit]

Should I use alternative packer to avoid this antivirus fake warning detection?

[Andreik]

Should I use alternative packer to avoid this antivirus fake warning detection?

I think you can compile without UPX.

If you use Compile script to .exe , in Compression menu, you will find this option.

Try it and then tell us if is a change or not.

[Mobius]

Should I use alternative packer to avoid this antivirus fake warning detection?

Kind of depends what sort of packer you chose, Pm me if you want to know more.

Mostly false positives given by Av's that cannot keep up with current trends.

Edited November 9, 2008 by Mobius

[trancexx]

http://www.autoitscript.com/forum/index.ph...st&p=253367

That's for viruses and NOD32 warned for worm.

This link:

http://www.autoitscript.com/forum/index.ph...st&p=253367

... no wait, that's the same one.

[Mobius]

http://www.autoitscript.com/forum/index.ph...st&p=253367

... no wait, that's the same one.

trancexx, master at work.

@Emiel

Respect++

Edited November 11, 2008 by Mobius

[Emiel Wieldraaijer]

@Mobius

Hi

@TeraBit

Send NOD an email ... to create a real virusscanner..

How to reduce false positives

- Don't use a beta version of AutoIt

- Don't use filepackers

- Don't use hotkeys in a script

- Don't use _IsPressed in a script

- Don't use autodownloads in a script

Edited November 9, 2008 by Emiel Wieldraaijer

[TeraBit]

I have tried to pack my script.exe file with themida packer and now NOD32 don't detect my program as virus!

Hacker's favorite method.

Isn't it?

[Mobius]

I have tried to pack my script.exe file with themida packer and now NOD32 don't detect my program as virus!

Hacker's favorite method.

Isn't it?

But at what cost to the size of the packed binary?

I mean ::

Unpacked size =

Packed size =

Edited November 9, 2008 by Mobius

[TeraBit]

Unpacked size = 784 KB

Packed size = 1,76 MB

Why the size of Packed file exceeds many times over the Unpacked size?

[Andreik]

I have tried to pack my script.exe file with themida packer and now NOD32 don't detect my program as virus!

Hacker's favorite method.

Isn't it?

Try to scan with another antivirus, not surprise you to be detected as a virus by different antivirus.

[Mobius]

Unpacked size = 784 KB

Packed size = 1,76 MB

Why the size of Packed file exceeds many times over the Unpacked size?

OUCH Dude, that is a considerable increase in filesize for something that

is not going to protect your source at all.

Uber packers such as Themida and Armadillo and many others offer additional

header tricks, that are designed to Protect at all costs, against the many

tools that are out there to probe a binary.

Such packers are designed for major, often corporate applications, or for people

that do not care about the overall binary size. You might want to play around

with various settings to possibly trim this down a bit but don't get your hopes up.

Ed

Like Emiel said, Packers are really optional unless you wish to embed

sensitive data in the resource table, and require a packer to protect this

Edited November 9, 2008 by Mobius

[Cw2K1]

@Mobius

Hi

@TeraBit

Send NOD an email ... to create a real virusscanner..

How to reduce false positives

- Don't use a beta version of AutoIt

- Don't use filepackers

- Don't use hotkeys in a script

- Don't use _IsPressed in a script

- Don't use autodownloads in a script

- Don't use AutoIt

[TeraBit]

I think it is not big increase in size for ours fast pc

and it is acceptable for me =)

[TeraBit]

And you are using a Packer FOR????

Ed:

Protecting images and other data used by your binary?

I use it to avoid immediate deletion by my favorite antivirus

[Mobius]

I use it to avoid immediate deletion by my favorite antivirus

Then why pack at all, that is what I was asking really.

If you do not care about filesize then why bother packing,

unless like I said, you wish to protect images and other data

used by your program.

Edited November 11, 2008 by Mobius

[Armand]

- Don't use AutoIt

hhh - sad but true ...

[Mobius]

hhh - sad but true ...

So a couple of Av company's aren't up to scratch on current events (Won't mention NOD32 )

And you guys advocate not using AutoIt at all because of THIS!!!!

You are not releasing a commercial app anyway so get over yourself.

Dammit, Lost me big green Lazer.....Has anyone seen it?

Edited November 9, 2008 by Mobius