Jump to content

[Updated!] Quickly Email False Positives to AV Vendors

EmilyLove

By EmilyLove,
in AutoIt Example Scripts

 Share

Recommended Posts

  • Popular Post
EmilyLove Universalist

EmilyLove

Posted
  • Popular Post
Posted (edited)

View the Project at GitHub: https://github.com/BetaLeaf/False-Positive-Reporter

Download False Positive Reporter: https://github.com/BetaLeaf/False-Positive-Reporter/releases

Wiki: https://github.com/BetaLeaf/False-Positive-Reporter/wiki

 

Thanks Jos for your Example Script involving Emailing attachments.

Thanks JohnOne for helping me figure out the Run as Non-Admin Issue.

Thanks Chiron at http://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm for your wonderful post.

Disclaimer: This script is meant for submitting false positives to AntiVirus Vendors so you can deploy your scripts faster. I am not responsible for your misuse of this script.

Edited by BetaLeaf
Updated for Github Releases

 

 

Link to comment
Share on other sites
EmilyLove Universalist

EmilyLove

Posted
  • Author
Posted (edited)

Yes. As long as the Email doesn't fail to deliver because their mailboxes are full, then it will work. AV Vendors usually have some kind of bot monitoring these emails for attachments. Now, I don't have enough test data to know if it works fully. On the tests I have run, it has definitely cut out like 75% of the work I had to do before writing this script.

Edited by BetaLeaf

 

 

Link to comment
Share on other sites
  • 2 weeks later...
Proph Polymath

Proph

Posted
Posted (edited)

It was pretty simple once I got it working.  Hopefully the Antivirus Vendors do their jobs now. ;-)

 

I just checked my email and I have many replys from the AV Vendors.  They all say that the files are clean.  So it looks like it worked well. Thanks! :)  This will come in handy for sure.

Edited by Proph
Link to comment
Share on other sites
  • 5 weeks later...
EmilyLove Universalist

EmilyLove

Posted
  • Author
Posted (edited)

Is there a reason this example needs administrator right?

Why not HKCU instead of HKLM?

Because I didn't know that was the problem. I spent a few hours trying to figure it out but I gave up in the end. I'll fixed it. I'll update the OP as well. Thanks.

Edited by BetaLeaf

 

 

Link to comment
Share on other sites
Chimaera Universalist

Chimaera

Posted
Posted

Ok ive grabbed this thinking to submit my scripts to stop problems with avast etc

Ive filled it in and the little gui has disappeared and all i get is an error about a missing temp folder zip

Is there not a window where i can add the file to upload?

My files are not infected just created with AutoIt

If Ive just helped you ... miracles do happen. Chimaera

CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()

Link to comment
Share on other sites
guinness Universalist

guinness

Posted
Posted

I am not keen on the idea of "spamming" Anti-Virus companies, but I just wanted to point out that versioning exectuables is bad practice.

UDF List:

 
_AdapterConnections() • _AlwaysRun() • _AppMon() • _AppMonEx() • _ArrayFilter/_ArrayReduce • _BinaryBin() • _CheckMsgBox() • _CmdLineRaw() • _ContextMenu() • _ConvertLHWebColor()/_ConvertSHWebColor() • _DesktopDimensions() • _DisplayPassword() • _DotNet_Load()/_DotNet_Unload() • _Fibonacci() • _FileCompare() • _FileCompareContents() • _FileNameByHandle() • _FilePrefix/SRE() • _FindInFile() • _GetBackgroundColor()/_SetBackgroundColor() • _GetConrolID() • _GetCtrlClass() • _GetDirectoryFormat() • _GetDriveMediaType() • _GetFilename()/_GetFilenameExt() • _GetHardwareID() • _GetIP() • _GetIP_Country() • _GetOSLanguage() • _GetSavedSource() • _GetStringSize() • _GetSystemPaths() • _GetURLImage() • _GIFImage() • _GoogleWeather() • _GUICtrlCreateGroup() • _GUICtrlListBox_CreateArray() • _GUICtrlListView_CreateArray() • _GUICtrlListView_SaveCSV() • _GUICtrlListView_SaveHTML() • _GUICtrlListView_SaveTxt() • _GUICtrlListView_SaveXML() • _GUICtrlMenu_Recent() • _GUICtrlMenu_SetItemImage() • _GUICtrlTreeView_CreateArray() • _GUIDisable() • _GUIImageList_SetIconFromHandle() • _GUIRegisterMsg() • _GUISetIcon() • _Icon_Clear()/_Icon_Set() • _IdleTime() • _InetGet() • _InetGetGUI() • _InetGetProgress() • _IPDetails() • _IsFileOlder() • _IsGUID() • _IsHex() • _IsPalindrome() • _IsRegKey() • _IsStringRegExp() • _IsSystemDrive() • _IsUPX() • _IsValidType() • _IsWebColor() • _Language() • _Log() • _MicrosoftInternetConnectivity() • _MSDNDataType() • _PathFull/GetRelative/Split() • _PathSplitEx() • _PrintFromArray() • _ProgressSetMarquee() • _ReDim() • _RockPaperScissors()/_RockPaperScissorsLizardSpock() • _ScrollingCredits • _SelfDelete() • _SelfRename() • _SelfUpdate() • _SendTo() • _ShellAll() • _ShellFile() • _ShellFolder() • _SingletonHWID() • _SingletonPID() • _Startup() • _StringCompact() • _StringIsValid() • _StringRegExpMetaCharacters() • _StringReplaceWholeWord() • _StringStripChars() • _Temperature() • _TrialPeriod() • _UKToUSDate()/_USToUKDate() • _WinAPI_Create_CTL_CODE() • _WinAPI_CreateGUID() • _WMIDateStringToDate()/_DateToWMIDateString() • Au3 script parsing • AutoIt Search • AutoIt3 Portable • AutoIt3WrapperToPragma • AutoItWinGetTitle()/AutoItWinSetTitle() • Coding • DirToHTML5 • FileInstallr • FileReadLastChars() • GeoIP database • GUI - Only Close Button • GUI Examples • GUICtrlDeleteImage() • GUICtrlGetBkColor() • GUICtrlGetStyle() • GUIEvents • GUIGetBkColor() • Int_Parse() & Int_TryParse() • IsISBN() • LockFile() • Mapping CtrlIDs • OOP in AutoIt • ParseHeadersToSciTE() • PasswordValid • PasteBin • Posts Per Day • PreExpand • Protect Globals • Queue() • Resource Update • ResourcesEx • SciTE Jump • Settings INI • SHELLHOOK • Shunting-Yard • Signature Creator • Stack() • Stopwatch() • StringAddLF()/StringStripLF() • StringEOLToCRLF() • VSCROLL • WM_COPYDATA • More Examples...

Updated: 22/04/2018

Link to comment
Share on other sites
EmilyLove Universalist

EmilyLove

Posted
  • Author
Posted

I am not keen on the idea of "spamming" Anti-Virus companies, but I just wanted to point out that versioning exectuables is bad practice.

The intended use for this script is not to spam Anti-Virus Vendors. I also don't understand what you mean about versioning executables. I thought tracking the version of a program helps people keep track of changes. What should I be doing? What do you recommend?

Ok ive grabbed this thinking to submit my scripts to stop problems with avast etc

Ive filled it in and the little gui has disappeared and all i get is an error about a missing temp folder zip

Is there not a window where i can add the file to upload?

My files are not infected just created with AutoIt

The Temp folder is @TempDir & "\" & @MON & "-" & @MDAY & "-" & @YEAR & "-" & @HOUR & "-" & @MIN & "-" & @SEC & "\" where @TempDir is your %localappdata%\Temp. This program works via Drag and Drop the file you want to upload onto the Exe. I made a fork with my first attempt at fixing your issue. You can try it at https://github.com/BetaLeaf/False-Positive-Reporter/tree/Issue-1. If this fixed work for you, let me know so I can pull it into the Master Project.

 

 

Link to comment
Share on other sites
JohnOne Universalist

JohnOne

Posted
Posted

It might be prudent to allow user to select their antivirus vendor, usually it is only one or two vendors flagging, not all.

Sending to all could be considered spamming, and might just be wasting their time.

AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt   ipify 

Monkey's are, like, natures humans.

Link to comment
Share on other sites
guinness Universalist

guinness

Posted
Posted (edited)

git and other version control systems are intended to be used for versioning non-binary files i.e. source code, because they are easily created via the source code. Not to mention each time you commit a new binary file, say 1MB, that goes towards your GitHub repository quota, which is a finite amount for FREE users.Your best bet is to look at creating incremental releases in which you can upload a compiled version of your script once in a while. Search online for more about using git and GitHub properly.

Edited by guinness

UDF List:

 
_AdapterConnections() • _AlwaysRun() • _AppMon() • _AppMonEx() • _ArrayFilter/_ArrayReduce • _BinaryBin() • _CheckMsgBox() • _CmdLineRaw() • _ContextMenu() • _ConvertLHWebColor()/_ConvertSHWebColor() • _DesktopDimensions() • _DisplayPassword() • _DotNet_Load()/_DotNet_Unload() • _Fibonacci() • _FileCompare() • _FileCompareContents() • _FileNameByHandle() • _FilePrefix/SRE() • _FindInFile() • _GetBackgroundColor()/_SetBackgroundColor() • _GetConrolID() • _GetCtrlClass() • _GetDirectoryFormat() • _GetDriveMediaType() • _GetFilename()/_GetFilenameExt() • _GetHardwareID() • _GetIP() • _GetIP_Country() • _GetOSLanguage() • _GetSavedSource() • _GetStringSize() • _GetSystemPaths() • _GetURLImage() • _GIFImage() • _GoogleWeather() • _GUICtrlCreateGroup() • _GUICtrlListBox_CreateArray() • _GUICtrlListView_CreateArray() • _GUICtrlListView_SaveCSV() • _GUICtrlListView_SaveHTML() • _GUICtrlListView_SaveTxt() • _GUICtrlListView_SaveXML() • _GUICtrlMenu_Recent() • _GUICtrlMenu_SetItemImage() • _GUICtrlTreeView_CreateArray() • _GUIDisable() • _GUIImageList_SetIconFromHandle() • _GUIRegisterMsg() • _GUISetIcon() • _Icon_Clear()/_Icon_Set() • _IdleTime() • _InetGet() • _InetGetGUI() • _InetGetProgress() • _IPDetails() • _IsFileOlder() • _IsGUID() • _IsHex() • _IsPalindrome() • _IsRegKey() • _IsStringRegExp() • _IsSystemDrive() • _IsUPX() • _IsValidType() • _IsWebColor() • _Language() • _Log() • _MicrosoftInternetConnectivity() • _MSDNDataType() • _PathFull/GetRelative/Split() • _PathSplitEx() • _PrintFromArray() • _ProgressSetMarquee() • _ReDim() • _RockPaperScissors()/_RockPaperScissorsLizardSpock() • _ScrollingCredits • _SelfDelete() • _SelfRename() • _SelfUpdate() • _SendTo() • _ShellAll() • _ShellFile() • _ShellFolder() • _SingletonHWID() • _SingletonPID() • _Startup() • _StringCompact() • _StringIsValid() • _StringRegExpMetaCharacters() • _StringReplaceWholeWord() • _StringStripChars() • _Temperature() • _TrialPeriod() • _UKToUSDate()/_USToUKDate() • _WinAPI_Create_CTL_CODE() • _WinAPI_CreateGUID() • _WMIDateStringToDate()/_DateToWMIDateString() • Au3 script parsing • AutoIt Search • AutoIt3 Portable • AutoIt3WrapperToPragma • AutoItWinGetTitle()/AutoItWinSetTitle() • Coding • DirToHTML5 • FileInstallr • FileReadLastChars() • GeoIP database • GUI - Only Close Button • GUI Examples • GUICtrlDeleteImage() • GUICtrlGetBkColor() • GUICtrlGetStyle() • GUIEvents • GUIGetBkColor() • Int_Parse() & Int_TryParse() • IsISBN() • LockFile() • Mapping CtrlIDs • OOP in AutoIt • ParseHeadersToSciTE() • PasswordValid • PasteBin • Posts Per Day • PreExpand • Protect Globals • Queue() • Resource Update • ResourcesEx • SciTE Jump • Settings INI • SHELLHOOK • Shunting-Yard • Signature Creator • Stack() • Stopwatch() • StringAddLF()/StringStripLF() • StringEOLToCRLF() • VSCROLL • WM_COPYDATA • More Examples...

Updated: 22/04/2018

Link to comment
Share on other sites
EmilyLove Universalist

EmilyLove

Posted
  • Author
Posted (edited)

It might be prudent to allow user to select their antivirus vendor, usually it is only one or two vendors flagging, not all.

Sending to all could be considered spamming, and might just be wasting their time.

I understand now, sorry. Yea I made this script to save my time manually submitting them. As long as you aren't sending an excessive amount of emails in one day, you should be fine. In my experience, bots watch the email boxes, not humans. In this case, then the only time I would waste time is my own by not using this script.

 

It should also be noted you can reconfigure the Emailer with Config FPR.exe and change the emails it mails to if it's always certain vendors causing problems. I just left the default to use all of them but the user can select which vendor they want to email. 

Edited by BetaLeaf
Added clarification

 

 

Link to comment
Share on other sites
EmilyLove Universalist

EmilyLove

Posted
  • Author
Posted

git and other version control systems are intended to be used for versioning non-binary files i.e. source code, because they are easily created via the source code. Not to mention each time you commit a new binary file, say 1MB, that goes towards your GitHub repository quota, which is a finite amount for FREE users.Your best best is to look at creating incremental releases in which you can upload a compiled version of your script once in a while. Search online for more about using git and GitHub properly.

Ok I understand. Thank you for your advice.

 

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...