AutoHotkey Community

[David Andersen]

Hi,

Have a look at the following page analysing a tiny Autohotkey program:
http://www.virustotal.com/analisis/9dd9429fa93b7f3feb3c9f084a5d7c2352fe6f2cb4a46f3ed33451731807d688-1248596972

As you can see it is identified as a virus by multiple anti-virus program.

Any ideas how to fix this?

[Tuncay]

Nothing new. With AutoHotkey it is so easy to make keyloggers. Thats the reason why some anti virus applications treat Ahk as a malicious software. In general, if you use Ahk, you can ignore that.

[n-l-i-d]

This is a known problem.

Usually the antivirus programs trigger on the UPX compression. You can try renaming the UPX.exe in the AutoHotkey folder, and compile again. If you reupload the new executable to VirusTotal, you'll see lesser (or no) false positives.

HTH

[David Andersen]

Thanks for the tip n-l-i-d. I will remember that if I need to distribute an Autohotkey program widely.

[Murx]

Might be of interest http://blog.nirsoft.net/2009/05/17/antivirus-companies-cause-a-big-headache-to-small-developers/

[PhiLho]

For the anecdote, I am, at work, in the process of moving from an antediluvian computer (2004, 1GB of memory, Pentium 4) to an old computer (2006, 2GB, Pentium D)...
Still a big jump in performance, particularly when I run Thunderbird, Firefox (a memory hog), Eclipse (another one), Trend Micro anti-virus, Skype, and our own Java applications for tests.

My point is: the new computer has a Trend Micro anti-virus too, except it runs on the network (well, locally, but scheduled by server, reports to server, etc.).
While I moved my files, I had a number of alerts: one on a AutoHotkeySC.bin file inside an archive: I keep, out of habit, something like 20 old versions of AHK. Only one was reported as Trojan (Generic). I removed the file. Ah, and also some compiled scripts too, perhaps with the same version.

For the record, it reported also SpyEx (a window/Windows message examination tool, but Google searches shown a Trojan of same name exists), the hook DLL of DeskProjection, and perhaps a couple of other files.
_________________
vPhiLho := RegExReplace("Philippe Lhoste", "^(\w{3})\w*\s+\b(\w{3})\w*$", "$1$2")

[IsNull]

you may remember: http://www.autohotkey.com/forum/topic31975.html
_________________
http://securityvision.ch
AHK 2D GAME ENGINE