Jump to content

Sky Slate Blueberry Blackcurrant Watermelon Strawberry Orange Banana Apple Emerald Chocolate
Photo

Comodo reports autohotkey.net as malware


  • Please log in to reply
12 replies to this topic
Six
  • Members
  • 2 posts
  • Last active: Dec 13 2010 06:18 AM
  • Joined: 13 Dec 2010
Posted Image

picture says it all


[Moved to general chat (not a bug). ~MacroMan!]

  • Guests
  • Last active:
  • Joined: --
Report it as a false positive...or ask them to show you the malware.
autohotkey.net - VirusTotal - 1/6 - ParetoLogic: Malware site / Rest: Clean site...wonder what's triggering the false positives?

  • Guests
  • Last active:
  • Joined: --
More info...
autohotkey.net | McAfee SiteAdvisor - GREEN - We tested this site and didn't find any significant problems.
Comments Page - autohotkey.net | McAfee SiteAdvisor - 4 good / 3 bad reviews...all of the misinformation seems to begin at...
Malicious Sites October 26 | freepcsecurity.co.uk...which was then picked up by...
MalwareDomains...God how do we clean this up?

MacroMan!
  • Members
  • 604 posts
  • Last active: Mar 20 2012 11:40 AM
  • Joined: 28 Aug 2009
I can't believe someone actually wrote this about autohotkey.net:

WARNING THIS SITE POSES SERIOUS SECURITY THREATS: Threats on this and other malware sites may include fake antivirus scams, malicious redirects, viruses, trojans, rogue installers, key loggers, droppers, browser exploits, and a range of other security threats. Avoid malware sites. Do not become their next victim.


This is a complete load, this almost seems like it's a deliberate attack at us.

David


EDIT:
Have just sent this email to freepcsecurity:

Please remove autohotkey.net from your malicious sites list on Oct 26.

autohotkey.net has never and will never host malicious software or malware/viruses.
It is a site for the programming language AutoHotkey. This report has caused the site to be reported as dangerous to thousands of legitimate users. If you need further information, please do not hesitate to contact me.

Regards


EVERYONE PLEASE ALSO SEND THIS EMAIL TO THEM and help stop false positives.
<!-- m -->http://www.freepcsec....uk/contact-me/<!-- m -->


EDIT 2:
I have also sent this email to MalwareDomains:

Please remove autohotkey.net from your malicious sites list on Nov 26.

autohotkey.net has never and will never host malicious software or malware/viruses.
It is a site for the programming language AutoHotkey. This report has caused the site to be reported as dangerous to thousands of legitimate users. If you need further information, please do not hesitate to contact me.

Regards


Again, please send them this same email to try and get autohotkey.net off of this list.
<!-- e --><a href="mailto:[email protected]">[email protected]</a><!-- e -->


EDIT 3:
I have sent this email to pareto logic who reports autohotkey.net as malicious:

It appears that one of your products reports the domain name autohotkey.net as malicious as is shown on the virustotal.com website:
<!-- m -->http://www.virustota... ... 1292225157<!-- m -->

autohotkey.net has never and will never host malicious software or malware/viruses.
It is a site for the programming language AutoHotkey. This report has caused the site to be reported as dangerous to thousands of legitimate users. Please fix this false-positive. If you need further information, please do not hesitate to contact me.

Regards


Please also send this email to Pareto Logic:
<!-- m -->http://techsupport.p... ... estion.asp<!-- m -->
(click on 'Ask a question')

David
What ever happened, happened.

MacroMan!
  • Members
  • 604 posts
  • Last active: Mar 20 2012 11:40 AM
  • Joined: 28 Aug 2009
Articles about AutoHotkey false positives.

<!-- m -->http://cranialsoup.b... ... rojan.html<!-- m -->
<!-- m -->http://www.donationc.../Help/entry/74/<!-- m -->

David
What ever happened, happened.

MacroMan!
  • Members
  • 604 posts
  • Last active: Mar 20 2012 11:40 AM
  • Joined: 28 Aug 2009
It appears that autohotkey.net has been blacklisted because autohotkey_l_install.exe has so many false positives:

<!-- m -->http://malc0de.com/d... ... hotkey.net<!-- m -->
<!-- m -->http://support.clean...ir ... rst desc<!-- m -->
What ever happened, happened.

  • Guests
  • Last active:
  • Joined: --

[Moved to general chat (not a bug). ~MacroMan!]

...lots of mods move things that they think are "not a bug" out of Bug Reports & I think this is wrong.

I think whether you call this a "bug" or not...it deserves more than "General Chat". I consider this a bug, a bug that will be fixed once these reports are cleaned up. No, it's not a bug in the AutoHotkey source code, but it is a bug with the internet (or how ever you want to describe it).

When people "report bugs" & they get moved to "General Chat" it makes me think the reporter will feel like "well I tried to help, but they moved it & said it wasn't a bug...guess they don't care" (I know I'd feel that way).

I vote for leaving "bug reports" in "Bug Reports" even if they are not a bug in AutoHotkey's source code per-se...or we need a new forum for these type of "Important Issues" that don't "qualify" as "bugs".

Also, the description of "Bug Reports" is "Found a problem? Please post it here."...I'd say virus false-positive reports is a "problem", even if not a "bug".

  • Guests
  • Last active:
  • Joined: --
PROGRESS - Delisting...
MalwareDomains - Delisting: autohotkey.net

  • Guests
  • Last active:
  • Joined: --
SETBACK - it's worse than expected - AutoHotkey.com is listed too!...
DNS Sinkhole - malc0de.com - AutoHotkey.com & AutoHotkey.net listed
ZONES (BIND Format) - Ctrl+F, type AutoHotkey, press F3 a lot
BOOT (Windows Format) - Ctrl+F, type AutoHotkey, press F3 a lotAutoHotkey.com - Database Search - Malc0de
AutoHotkey.net - Database Search - Malc0de

Malware for domain: AutoHotkey.com - Clean MX - very small "Report false positive" link in 2nd column
Malware for domain: AutoHotkey.net - Clean MX - very small "Report false positive" link in 2nd column[/list]

MacroMan!
  • Members
  • 604 posts
  • Last active: Mar 20 2012 11:40 AM
  • Joined: 28 Aug 2009

PROGRESS - Delisting...
MalwareDomains - Delisting: autohotkey.net


My email to these guys got somewhere then.

The problem stems from the software that is hosted being reported as malicious, which in turn makes the site end up on these lists.

We need to revive the old thread about sending emails to these guys. I'll get working on it tomorrow.

[Moved to general chat (not a bug). ~MacroMan!]

...lots of mods move things that they think are "not a bug" out of Bug Reports & I think this is wrong.

I think whether you call this a "bug" or not...it deserves more than "General Chat". I consider this a bug, a bug that will be fixed once these reports are cleaned up. No, it's not a bug in the AutoHotkey source code, but it is a bug with the internet (or how ever you want to describe it).

When people "report bugs" & they get moved to "General Chat" it makes me think the reporter will feel like "well I tried to help, but they moved it & said it wasn't a bug...guess they don't care" (I know I'd feel that way).

I vote for leaving "bug reports" in "Bug Reports" even if they are not a bug in AutoHotkey's source code per-se...or we need a new forum for these type of "Important Issues" that don't "qualify" as "bugs".

Also, the description of "Bug Reports" is "Found a problem? Please post it here."...I'd say virus false-positive reports is a "problem", even if not a "bug".


I understand where your coming from, but just because it's moved, it doesn't mean we don't care, quite the opposite in fact. It's just the 'Bug report' forum is for software bugs only. We want to avoid too many under used sub-forums which is what a forum about false-positive would be.

As you can see from what I have posted here, I care very much about the fact that we have these false-positives and I am the one who moved the post.

David
What ever happened, happened.

Six
  • Members
  • 2 posts
  • Last active: Dec 13 2010 06:18 AM
  • Joined: 13 Dec 2010
I started this post and I'm not bothered it's been moved. My thinking is this - if you own the forum it's your responsibility to moderate when needed. But I also wish more forum software would let thread starters moderate their own threads. The ones that do provide a much better experience for everyone. Off topic, misinformation, flames? delete, delete, thread locked.

But the reason for my post - I checked today and ComodoDNS does not report autohotkey.net as an attack site.

You would think their anti-virus department and their DNS department would be better coordinated. Incidentally I noticed this last time that their firewall install default option is to use their DNS servers.

  • Guests
  • Last active:
  • Joined: --
PROGRESS - AutoHotkey.net removed from Comodo SecureDNS

I checked today and ComodoDNS does not report autohotkey.net as an attack site.

...yes, I just checked my E-mail & had received these from Comodo (& I was coming here to report)...

Date: Monday, December 13, 2010 2:45 PM (EST)
Hi ,

Thanks for your mail.

This issue has forwarded to our developers and will get back to you shortly. If the site is genuine  and not a phishing site our developers will will unblock it within 48 hours.
Date: Monday, December 13, 2010 7:08 PM (EST)
Hi,

Thank you for writing to us.

The domain, https://ahknet.autohotkey.com, has been whitelisted per your request.
...do you know what exact time (& timezone) you "checked today"?

gamax92
  • Members
  • 411 posts
  • Last active: Aug 06 2013 05:00 AM
  • Joined: 05 Dec 2010
This is great news. The only problem else is the exes. The packers make it the antivirus go boing! Alert virus is detected! Its bull crapi like this project.