[Info] Are my AutoIt EXEs really infected?

[Kubiatsu]

Many AutoIt EXEs sometimes show that they are infected when scanned, and people are wrongly accused when they post a new program/bot so I thought I would share some information for people who do not understand why AutoIt EXEs can show as infected when they are infact not infected at all.

Taken from the official AutoIt forums:

If you have been using AutoIt for any length of time you will know that it is a great, and powerful scripting language. As with all powerful languages there comes a downside. Virus creation by those that are malicious.

AutoIt has no virii installed on your system, and if a script you have created has been marked as a virus, (and you're not malicious) then this is a false positive. They found a set of instructions in an AutoIt EXE out there somewhere, took the general signature of the file, and now all AutoIt EXE's are marked (or most of them). This can be due to several reasons.

1. AutoIt is packed with UPX. UPX is an open source software compression packer. It is used with many virii (to make them smaller).
2. Malicious scripter got the AutoIt script engine recognized as a virus.

And I am sure there are more ways your executable could be marked, but that covers the basics.

Now I am sure you are wanting to know what you can do to get back up and running without being recognized as a virus. You have to send in a report to the offending AV company alerting them to the false positive they have made. It never hurts to send in your source code along with a compiled exe, to help them realize their mistake.

You may have to wait up to 24 hours for them to release an update. The time it takes really depends on the offending AV company.

Anti-Virus Links

• AntiVir
  • Website
  • Contact
• Avast!
  • Website
  • Contact
• McAfee
  • Website
  • Contact (email address)
• Symantec (Norton)
  • Website
  • Contact
• AVG
  • Website
  • Contact (It says sales or other ?'s I assume this will work)
• ClamWin
  • Website
  • Contact
• ClamAV
  • Website
  • Contact (I would only contact the ones with "virusdb maintainervirus submission management")
• BitDefender
  • Website
  • Contact
• ZoneLabs
  • Website
  • Contact
• Norman
  • Website
  • Contact (email address)
• eSafe
  • Website
  • Contact (login required)
• A2 (A-Squared)
  • Website
  • Contact (email address)

I hope this helps you understand why your AutoIt executables are marked as virii.

I hope this clears a few things up.

[King_yoshi]

nice explanation + rep

[qwertymana]

Nice explanation dude + rep

[lag]

Good infos, although I think it is still good to run AutoIt applications in a sandbox environment first if you are unsure.

+rep when I can again

[Brandaho]

One this up and make it a sticky. So people can easily find it.