AutoHotkey Community

It is currently May 26th, 2012, 4:10 am

All times are UTC [ DST ]




Post new topic Reply to topic  [ 5 posts ] 
Author Message
PostPosted: May 8th, 2008, 8:12 am 
Offline

Joined: November 27th, 2006, 1:44 pm
Posts: 61
Location: Heerlen Country: Netherlands
currently 10 virusscanner detect a autohotkey program as suspicous. i find this number to high. Please view the scanning results here: http://www.virustotal.com/nl/analisis/9 ... 1661631b53

_________________
Before asking a question try to read the manual
Always use the code sections when you paste some code


Report this post
Top
 Profile  
Reply with quote  
PostPosted: May 8th, 2008, 8:24 am 
This is not really and AHK bug / issue. It's all to do with UPX.EXE compressing the compiled script (http://www.autohotkey.com/forum/post-195201.html). To prove this, do the rename-upx fix in the post just mentioned, recompile and rescan the resulting EXE. You will probably not see any hits in the scanner.

Question:
Could AHK2EXE.EXE have a "no compression" option and have it set to that by default?


Report this post
Top
  
Reply with quote  
 Post subject:
PostPosted: May 8th, 2008, 8:41 am 
Offline

Joined: November 27th, 2006, 1:44 pm
Posts: 61
Location: Heerlen Country: Netherlands
You are partially correct about that, but i still urgently ask the creators of ahk to PLEASE MAKE UPX AN OPTION WICH YOU CAN SET AT THE BEGINNING OF THE AHK-FILE WITH A DEFAULT OF OFF (so that it will NOT run through UPX)

Results of scanning with removed UPX (same ahk-sourcefile)
http://www.virustotal.com/nl/analisis/b ... 9b39dc1c1d

_________________
Before asking a question try to read the manual
Always use the code sections when you paste some code


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: May 8th, 2008, 9:40 am 
Offline
User avatar

Joined: October 7th, 2006, 8:45 am
Posts: 3328
Location: Simi Valley, CA
eagle00789 wrote:
You are partially correct about that, but i still urgently ask the creators of ahk to PLEASE MAKE UPX AN OPTION WICH YOU CAN SET AT THE BEGINNING OF THE AHK-FILE WITH A DEFAULT OF OFF (so that it will NOT run through UPX)

You could just email "prevx1" and "TheHacker" and tell them that their stuff hits AHK scripts as false positives. Maybe you could use ALL CAPS in your emails too... :roll:

btw: moving/renaming/deleting upx.exe from the AHK folder would effectively do what you describe (default script compilation to not use upx)

If you really wanted to go all-out, you could copy the AHKtoEXE.exe file to a seperate folder then use a shortcut or batch file or add an extra "compile (no upx)" option to the shell menu for ahk scripts.

In short, there are many ways for you to get what you are asking for without waiting for someone to do it for you.

_________________
Ternary (a ? b : c) guide     TSV Table Manipulation Library
Post code inside [code][/code] tags!


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: May 8th, 2008, 3:04 pm 
Offline

Joined: July 23rd, 2004, 7:38 am
Posts: 15
[VxE] wrote:
Quote:
If you really wanted to go all-out, you could copy the AHKtoEXE.exe file to a seperate folder then use a shortcut or batch file or add an extra "compile (no upx)" option to the shell menu for ahk scripts.


Good idea! Here is the AHK code that will do this on a default install:

Code:
FileCopyDir, C:\Program Files\AutoHotkey\Compiler, C:\Program Files\AutoHotkey\Compiler_noUPX
FileDelete, C:\Program Files\AutoHotkey\Compiler_noUPX\upx.exe
RegWrite, REG_SZ, HKEY_CLASSES_ROOT, AutoHotkeyScript\Shell\Compile_noUPX\Command, , "C:\Program Files\AutoHotkey\Compiler_noUPX\Ahk2Exe.exe" /in "`%l"

_________________
float o=0.075,h=1.5,T,r,O,l,I;int _,L=80,s=3200;main(){for(;s%L||
(h-=o,T= -2),s;4 -(r=O*O)<(l=I*I)|++ _==L&&write(1,(--s%L?_<L?--_
%6:6:7)+"World! \n",1)&&(O=I=l=_=r=0,T+=o /2))O=I*2*O+h,I=l+T-r;}


Report this post
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 

All times are UTC [ DST ]


Who is online

Users browsing this forum: coinman, oldbrother and 21 guests


You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Group