AutoIt Installer False Positive

[cembry90]

About AutoIt:     (Copied from here)

Code: [Select]

AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI and general
scripting. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation in order
to automate tasks in a way not possible or reliable with other languages (e.g. VBScript and SendKeys). AutoIt is also
very small, self-contained and will run on all versions of Windows out-of-the-box with no annoying "runtimes"
required!

AutoIt was initially designed for PC "roll out" situations to reliably automate and configure thousands of PCs. Over
time it has become a powerful language that supports complex expressions, user functions, loops and everything else
that veteran scripters would expect.

Features:

    * Easy to learn BASIC-like syntax
    * Simulate keystrokes and mouse movements
    * Manipulate windows and processes
    * Interact with all standard windows controls
    * Scripts can be compiled into standalone executables
    * Create Graphical User Interfaces (GUIs)
    * COM support
    * Regular expressions
    * Directly call external DLL and Windows API functions
    * Scriptable RunAs functions
    * Detailed helpfile and large community-based support forums
    * Compatible with Windows 95 / 98 / ME / NT4 / 2000 / XP / 2003 / Vista / 2008
    * Unicode and x64 support
    * Digitally signed for peace of mind
    * Works with Windows Vista's User Account Control (UAC)

AutoIt has been designed to be as small as possible and stand-alone with no external .dll files or registry entries
required making it safe to use on Servers. Scripts can be compiled into stand-alone executables with Aut2Exe.

Also supplied is a combined COM and DLL version of AutoIt called AutoItX that allows you to add the unique features
of AutoIt to your own favourite scripting or programming languages!

Best of all, AutoIt continues to be FREE - but if you want to support the time, money and effort spent on the
project and web hosting then you may donate using the link to your left in the menu.

..... (the page continues)

Avast detects the installer for AutoIt as 'Win32:Rootkit-gen [Rtk]'. I have used
this programming language and the installer for several years with no problem
of any sort. I find it odd that today I attempted to download the installer
executable, and Avast terminates the connection before it could finish.

Being the inquisitive person I am, as well as wondering why the installer would
cause a red flag to be thrown, I then downloaded it to my laptop ( via Linux )
and archived it into .tar format. I transferred it to my Windows machine ( via
Samba ) and after adding the directory F:\Files\*.* to my 'ignore list' in Avast,
extracted it. I scanned the file manually, and got this:

                                                                Click me for a larger version!
                                                               

I know for a fact that this is not a virus, and the author of the program uses
a digital signature in the installer, signed as 'Jonathan Bennett',  to prevent
'fake' installers that may contain malicious code.

Here is the official link to the download page: DL page
Here is the installer executable:                   Setup

The solution I am looking for is a correction in the virus definition, so that a
security hole is not created by the addition of a path to the 'ignore list' in
Avast. This is much needed for the community of people - whether that be
10 people, or whether that be 1,000,000 people - that use Avast while also
scripting with AutoIt.

Thank you for your time, effort, and for your excellent antivirus software.



~Chris

[Lisandro]

A false positive for sure. I got it here...