Author Topic: Virus in AutoIt3  (Read 3020 times)

0 Members and 1 Guest are viewing this topic.

Offline ufkrikke

  • Newbie
  • *
  • Posts: 3
Virus in AutoIt3
« on: December 27, 2007, 12:09:41 PM »
AutoIt3Wrapper_Gui.exe contains sample of Win32:Autorun-LC

Question: Is it a positive or false-positive.

In both cases I am looking forward to a solution.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Virus in AutoIt3
« Reply #1 on: December 27, 2007, 12:20:54 PM »
Most probably a false positive. To be sure, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
Other possibility is JOTTI. VirusTotal and Jotti both have file size limits 10 and 15MB each.

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be carefull, you should 'exclude' that many files that let your system in danger.
After that, please, periodically check it - scan it into Chest, right clicking the file -  there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.
The best things in life are free.

Offline ufkrikke

  • Newbie
  • *
  • Posts: 3
Re: Virus in AutoIt3
« Reply #2 on: December 28, 2007, 09:04:26 PM »
Today I compiled an AutoIt script and did not get a Virus warning. So the problem seems to be solved with today's Avast update.
Thanks anyway for proposed solutions.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Virus in AutoIt3
« Reply #3 on: December 28, 2007, 10:57:21 PM »
Thanks anyway for proposed solutions.
You're welcome.
You can use them in the future if false positives come again.
The best things in life are free.