AutoIt.exe files

Avast is seeing these as Win32:Sohanad-AS [Wrm]

avast and autoit files seem to have some history, the problem many script kidies use autoit for malware purposes and it can be difficult to separate out the good from the bad.

Have you got the latest version of autoit ?

I would suggest that you send a few samples in a zipped password protected attachment to virus@avast.com with the password in email body, a link to this topic might help and possible false positive in the subject.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here.

If it is indeed a false positive, add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

It may be worthwhile to have a folder for your autoit scripts and exclude the files in that folder.

e.g. c:\autoit-scripts\a-itxnxnxn.* if you have a common style for the autoit script like the a-itxnxnxnxn. then you could use c:\autoit-scripts\a-it*.* so only scripts get excluded to reduce any potential security hole.

I don’t know the file type used for autoit scripts so you could get rid of the second wildcard c:\autoit-scripts\a-it*.exe (where exe is my example of the file type). This would tighten the security a little more.

I know that these are false positives as I wrote the scripts & compiled them myself :slight_smile:

I’ve emailed them to avast for inspection

It’s a known-issue. From time to time, our scripts are detected as false positives.
Maybe you can add the folder that contain them to the avast exclusion lists.

I have no doubt they are FPs the suggestion of using VT was confirmation and evidence to support the case.

Hopefully they will get on it quickly, Interestingly I’ve had an FP this afternoon on boot for a program I have used for some time and previously undetected.

Ok, I’ve isolated them into one folder & excluded it from Avast.
All seems to be ok now :slight_smile:

Good :wink:
Remember that there are 2 exclusion lists:

For the Standard Shield provider (on-access scanning):
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button…

For the other providers (on-demand scanning such as the screen-saver or the Simple User Interface):
Right click the ‘a’ blue icon, click Program Settings.
Go to Exclusions tab and click on Add button…

You can use wildcards like * and ?.
But be careful, you should ‘exclude’ that many files that let your system in danger.