SciTE4AutoIt3.exe Marked with Malware By VirusTotal

[kgc-jr]

VirusTotal marks SciTE4AutoIt3.exe as having several (not just one false positive) malware signatures (see attached VirusTotal report).  This is certainly making me reluctant to install the editor until this can get cleared up with VirusTotal.  Thanks in advance fir looking into this.

VirusTotal - File - 46e2431a29441536e3b28f9e4263c31cc7277b38b67997466cd3a79eeb64e5f1.pdf

[ripdad]

 

https://www.autoitscript.com/forum/topic/34658-are-my-autoit-exes-really-infected/

 

[kgc-jr]

Thanks for the reply.

I did read that post, however, I didn't feel the post was directly related to my topic.  Since SciTE4AutoIt3.exe is a trusted app download from the AutoIt website, I would have thought that it might have already been vetted through the anti-virus scanners out there...  I familiar with and understand false positives, but numerous positive IDs send up a red flag for me.  I thought that the developers and AutoIt team might want to be aware.

[pseakins]

Just don't worry about it. This happens all the time. These are false positive detections. It is unlikely that you will get VirusTotal to do anything about it as it is a consortium of many AV vendors.

AV scanners use heuristics to identify certain techniques in code which at first glance may appear malicious when detected in AutoIt distribution files and in EXE's which are compiled by AutoIt.

I used to work for a large AV company and I used AutoIt to develop in-house tools used by my colleagues. These false positives would often come under discussion.

The big problem was that "script kiddies" would use AutoIt to develop malicious code. Being such a great development tool and simple to use there were many idiots out there that did this. AutoIt gained an unfair negative opinion by the AV companies. I think you'll find many AV researchers still look down on AutoIt.

Edited December 11, 2021 by pseakins

[Jos]

These warnings are not related to AutoIt3! I removed compiled AutoIt3 scripts already a long time ago from this installer.

Scanned      Detections  File  type   Name
2021-11-22   3/58        Win32 EXE    Tidy.exe
2021-08-31   2/68        Win32 EXE    uninst.exe
2021-05-24   1/68        Win32 dll    DumpLog.dll
2021-11-16   1/64        Win32 EXE    Au3Stripper.exe

Tidy.exe & Au3Stripper are compiled PellesC programs written by me. uninst.exe & Dumplog.dll are NSIS files which I use to create the installer.
I had the same thing the last time with the installer, after which I did an update of PellesC & NSIS. This fixed it at that time.

I just went to the latest versions of PellesC & NSIS, recompiled Tidy & Au3Stripper and regenerated the SciTE4AutoIt3 installer
....and guess what: Got similar/different detections for Tidy & Au3Stripper.

So, I guess we are nearing the point were I am going to have to stop the distribution of the those extra utilities as I can't guarantee their safety.   

 

Edited December 11, 2021 by Jos

[mLipok]

They are safe.

Just AV software are stupid because of such false positive.

[kgc-jr]

Thanks all for your replies and thoughts.  VirusTotal has a reputation for flagging a lot of good, benign executables as malware.  I always use both my installed AV (BitDefender) along with VirusTotal to give me a "feel" on a new executable I've downloaded from the web.  It's kind of frustrating to download a good tool that may help us be a more productive coder, then have it flagged by AV as possible malware.  We all know that the "kiddie scripters and coders" out there are using AutoIt to create malware, which are creating some of these issues.  AutoIt gets a bad "rep" with the AV companies, and the  AV companies' machine-learning detection tools aren't perfect (by any stretch of the imagination).  

I don't know what the best answer is if you want to code and also use those same computer resources to manage your finances and personal information.  I guess it's coming down to the point where you have to have separate, isolated and protected environments for each of these tasks...

Again thanks for the insight.

[pseakins]

8 hours ago, kgc-jr said:

it's coming down to the point where you have to have separate, isolated and protected environments

Totally unnecessary. The components are reliable, @Jos builds and uploads them. Unless the AutoIt downloader page has been hacked there is no reason to suspect there could be anything wrong with the files. Personally I practise "safe hex", having worked for one of the larger AV companies I don't bother with resident AV software, I do as do you, use VirusTotal to check any downloads. As an added level of security Jos could include the SHA256 or other checksum validation codes on the wepage. It's been so long I don't remember the name of the CRC checker I installed, for me It's a simple right click and all the checksums are calculated;

Name: SciTE4AutoIt3.exe
Size: 5440701 bytes (5313 KiB)
CRC32: 8E06D377
CRC64: 2EA8F95E76A25B16
SHA256: 46E2431A29441536E3B28F9E4263C31CC7277B38B67997466CD3A79EEB64E5F1
SHA1: 50914FFE0740E73B2B0B908E4410CE0D55A287CB
BLAKE2sp: 1D62199EC4E65C3541D0EBEE9536A3EE81B3A82ED109D2C8644EA37BE0B36777
 

[argumentum]

@Jos, I guess that nowadays signing the executables is the only way to get good fame for the executable as it seems to be the only important thing for the anti-virus industry. If you stop maintaining the utilities, who will ?!. I would not know how. Jeez, I only know how to use it and that is a welcomed product, so don't you quit !, you hear ! ❤️

[Jos]

I am not sure if Signing would solve my issues, also because as stated 2 of the 4 flagged files are from the standard NSIS installer utility and I would never sign exe's or dll's of others.
Just for clarity, as I've mentioned on several occasions before, when I stop maintaining au3stripper and Tidy, nobody will be able to maintain them as I am the only one having their source code. I know they run pretty solid, but they aren't in a state to be put on github.
The simple reason for this is that they are build over a period of several years through BCX and PellesC, and not in a state I would want to publish them.
 I have thought about starting again in VS CPP but never started the project (yet). 

Jos