search

helsmy / autohotkey-debug-adapter

Simple debug adapter for AutoHotKey.
https://marketplace.visualstudio.com/items?itemName=helsmy.autohotkey-debug
GNU Lesser General Public License v3.0
10 stars 4 forks source link

Severe AV threat #21

Open NBKRedSpy opened 9 months ago

NBKRedSpy commented 9 months ago

Win32/Wacatac.B!ml

The extension's debugAdapter.exe is shown as a AV severe threat.

babalu-community commented 9 months ago

Also appears to cause a request for elevated network access on first launch of the VS Code after reboot.

Name: AutoHotKey Debug Id: helsmy.autohotkey-debug Description: Debug Adapter for AutoHotKey implemented by AutoHotKey. Version: 0.7.2 Publisher: Helsmy VS Marketplace Link: https://marketplace.visualstudio.com/items?itemName=helsmy.autohotkey-debug

helsmy commented 9 months ago

Since this extension is an open source software and even do not connect to network at all, so it has absolutely nothing to do with viruses. You can decompile it using tools from autohotkey forums, and compare the source code. But, in order to reduce the size the extension uses upx compression, which may lead to the extension being reported as a virus. As far as I know, there are quite a few viruses that use upx compression, so there are some antivirus programs that will treat all upx compressed programs as viruses. I'll try to use mpress for next version of extension. How to know extension is been took as virus or not by antivirus programs?

NBKRedSpy commented 9 months ago

Windows 10's Microsoft Anti Virus detected it.

Also, the version on the market place is helsmy.autohotkey-debug-0.7.2.vsix While the latest release here is autohotkey-debug-0.5.0.vsix

https://marketplace.visualstudio.com/items?itemName=helsmy.autohotkey-debug

NBKRedSpy commented 9 months ago

To test, you could also try uploading to Virus total. It shows 20 vendors showing it as a virus of some sort.

Here is the report: https://www.virustotal.com/gui/file/ba1d4fe556e19aa553e85253fe101667bc23177b0cc3effcfbe8eac0b3fb6eca?nocache=1

Hash Info:

ba1d4fe556e19aa553e85253fe101667bc23177b0cc3effcfbe8eac0b3fb6eca
debugAdapter.exe

Virus Total upload page can be found here: https://www.virustotal.com/gui/home/upload

NBKRedSpy commented 9 months ago

Since this extension is an open source software and even do not connect to network at all, so it has absolutely nothing to do with viruses.

Is it possible that the market place version was taken over by hackers? Or is it really just a false positive? Just a thought.

NBKRedSpy commented 9 months ago

BTW, I can't reproduce. I wonder if MS updated their AV signatures.

I used a VM with Windows 10.

helsmy commented 9 months ago

Since this extension is an open source software and even do not connect to network at all, so it has absolutely nothing to do with viruses.

Is it possible that the market place version was taken over by hackers? Or is it really just a false positive? Just a thought.

It should not possible in normal case, becasuse uploading is authorized through a long enough token.

helsmy commented 9 months ago

Compiled script will always been reported as virus/malware by some anit-virus software, Even autohotkey itself got 2/70.

v2 autohotkey may be less reported.

It seems better to use mpress instead of upx. I will use mpress for next version of this extension