Are my AutoIt exes really infected?

[mLipok]

 

 

 

 

3 minutes ago, JLogan3o13 said:

@Mobius Just curious, if you were one of the big AV companies - how would you police and decide who is a hobbyist and who is not, so that you could apply different levels of response logic?

IMHO:

By allowing local admin to add a certificate to trusted zone (on central AV admin console).
And if APP Dev is using the same certificate for CodeSigning then such EXE file should be always treated as SECURE.

But did you ever seen any AV Software which has a feature to add a certificate to trusted zone?

[Mobius]

32 minutes ago, JLogan3o13 said:

@Mobius Just curious, if you were one of the big AV companies - how would you police and decide who is a hobbyist and who is not, so that you could apply different levels of response logic?

To be honest I thought the sole purpose/concern of an antivirus company would be to ascertain what is malicious vs that which is not, and not just to green light those willing to pay and red light those that are not or cannot. Hobbyist vs not should not concern them in the least.

It is worth noting looking back at the early origins of digital signatures, malicious application developers were one of the biggest buyers so the point of recommending digital signatures seems a bit flat to me.

[Earthshine]

so, you have zero ideas of how to implement it. So, you can stop complaining in other words. i wish this thread would get locked. I had an issue, I went to MS and had them whitelist my autoit apps, no more issues.

Edited September 26, 2019 by Earthshine

[Mobius]

1 minute ago, Earthshine said:

so, you have zero ideas of how to implement it. So, you can stop complaining in other words. i wish this thread would get locked. I had an issue, I went to MS and had them whitelist my autoit apps, no more issues.

"ascertain what is malicious vs that which is not"

There is my idea of implementing a model that works in plain english, not your strong point huh? <(rhetoric)

[Earthshine]

HAGHAHAHAHA, and how are they to do that? do you think they have unlimited resources? You get ignored now.

[Mobius]

2 minutes ago, Earthshine said:

HAGHAHAHAHA, and how are they to do that? do you think they have unlimited resources? You get ignored now.

It's called reverse engineering, but I suppose ignorance IS bliss for some, no offense intended in my statements but yet there is always one.

[JLogan3o13]

41 minutes ago, Earthshine said:

so, you have zero ideas of how to implement it. So, you can stop complaining in other words. i wish this thread would get locked. I had an issue, I went to MS and had them whitelist my autoit apps, no more issues.

Not sure why you: A: think this post would be locked just because you don't like the content and B: don't move along if you don't like said content rather than ranting. I think you're getting your underwear in a twist over nothing.

[iamtheky]

43 minutes ago, Mobius said:

"ascertain what is malicious vs that which is not"

so even if you look to something like cylance, where its 'pure math' there are still decision trees it has to follow (and that inexplecibably ended at a file size limit in their last reported bypass) and thresholds that breed false positives.

There is no magic bullet, and as long as you write small scripts that are 99.8% the same as every other autoit dropper ever, you will need to get your hashes whitelisted.  And that process is pretty easy these days, just need to work audit and exclusion tasks into the gantt for your project.

Edited September 26, 2019 by iamtheky
bad grammar, the worst.

[Musashi]

(Aside from the dispute that is currently taking place)

Just my personal experiences :
Q : Is a quality certificate beneficial ? A : Yes (in the vast majority of cases)

Q : Does it make sense to report 'false positives' to the antivirus companies ? A : Yes (most of the problems will be solved within a few days)

As @iamtheky already wrote : There is no magic bullet.

I always find it somehow irritating, that people easily pay $1000+ per year for their mobile phone but getting a heart attack if they have to spend $200 on a good certificate.

(a bit off topic)
What concerns me more from a privacy point of view is :
The development goes increasingly in the direction of real-time cloud protection services. You can still disable this feature (at the moment), but my trust in this approach is rather low. From a technical perspective this might be great, but we all know what will happen to our personal informations  .

[BrewManNH]

BTW, I would never implicitly trust a self-signed certificate, and neither should ANY AV company. If it doesn't come from a reputable certificate issuer, then it's not worth the metaphorical paper it's written on.

Just because someone with Admin rights has installed such a cert (self-signed) doesn't mean that the cert in question is secure, in any way shape or form, it just means someone that has admin credentials installed it.

[spudw2k]

On ‎9‎/‎27‎/‎2019 at 8:45 PM, BrewManNH said:

doesn't mean that the cert in question is secure

Minor nit pick here: The issue isn't no so much that a self-signed cert isn't secure, but whether or not the issuer of a cert is trustworthy.

[tcurran]

To reaffirm some of what's been said before: Try compiling...

• with UPX off
• with compression set to Low or Lowest/Off
• launching the 64-bit version of the exe. Sometimes this will work when the 32-bit will not

One of the above or some combination of them will very likely work for you.

[Jokerman]

10 minutes ago, tcurran said:

To reaffirm some of what's been said before: Try compiling...

• with UPX off
• with compression set to Low or Lowest/Off
• launching the 64-bit version of the exe. Sometimes this will work when the 32-bit will not

One of the above or some combination of them will very likely work for you.

To add on to this - if the first version you compile gets flagged try adding a new comment line, or edit an existing one, and compile again. Or add a new unused variable (which you can then comment/uncomment in future attempts at bypassing the AV filter). I've found that changes as small as these can cause a compiled exe to miraculously no longer be flagged. YMMV.

[iamtheky]

That is indeed a thing, I might have scripts in the wild with some commented out Lorem Ipsum and Beowulf 🙋‍♂️

It has been years though, I really havent had a problem with the newer enterprise AVs.

[bowain]

On 9/27/2019 at 6:45 AM, BrewManNH said:

BTW, I would never implicitly trust a self-signed certificate, and neither should ANY AV company. If it doesn't come from a reputable certificate issuer, then it's not worth the metaphorical paper it's written on.

Just because someone with Admin rights has installed such a cert (self-signed) doesn't mean that the cert in question is secure, in any way shape or form, it just means someone that has admin credentials installed it.

My approach was meant more for in a work around in my corporate environment and not for public. If I were to distribute anything I code I would indeed buy a cert. And as you emphasize this will not work outside as it is a self signed cert.

I have had to whitelist most of my apps on my home lab as the AV here flags them. Mainly the older ones that were not signed and complied with UPX. I'm not sure if that is why or not.

[BrewManNH]

4 hours ago, bowain said:

My approach was meant more for in a work around in my corporate environment and not for public.

But it shouldn't work with a self-signed exe, the AV companies shouldn't be accepting them as valid proof you're not sending viruses around was my point. There's no reputation behind a SSC, it's just you saying "hey I swear I'm not encrypting everyone's files because I signed my exe."

[bowain]

@BrewManNH This is just white listed on the corporate rules, not by the AV company. Corporate created the cert on an in house CA so we know we can trust it on the corporate machines. This would never, should not ever and will not ever be used outside of our environment. As I said if I wanted to go beyond out corp area I would buy a cert from a recognized CA.

[BrewManNH]

That does make sense, I guess I was looking at it in a more general view.

[Jokerman]

@stephensmith You may want to have a look at the Forum Rules post - specifically the 4th bullet point. Most things about games are specifically off-limits on these forums so think carefully before bringing them up. 😉

Edited November 21, 2019 by Jokerman
Somehow posted before I hit submit

[JLogan3o13]

On 11/3/2019 at 1:58 PM, stephensmith1211 said:

I don't know much about this. Just one thing to ask, can it affect my rom file downloaded from  https://garoms.com/pokemon-black/ to play pokemon game?

Jokerman is quite right, @stephensmith1211 this forum does not support game automation questions in any form. Please familiarize yourself with the rules before continuing to post.