another false positive - winrar sfx

[jessy 0]

When I create a winrar sfx, it's being detected by nod32.

Looks like no matter, if i Use %appdata%, or %userprofile%, or %temp%, or whatever, it's being detected.

 

with %temp% it's being detected as: RAR/Agent.L trojan

and with %appdata%: RAR/Agent.O trojan

 

the settings are:

 

;The comment below contains SFX script commands

 

Path=%appdata%\settings

Setup=apply.vbs

Silent=1

Overwrite=2

Edited December 23, 2013 by jessy

[Arakasi 549]

Good day Jessy

 

Lets start with providing some more background about what your trying to archive and compress ?

What code is behind apply.vbs file ?

 

All the other info you provided is irrelevent besides the infection name.

Edited December 23, 2013 by Arakasi

[Marcos 4,841]

If you use a script very similar to what malware uses, it will be obviously detected by generic signatures like in this case.

[toxinon12345 32]

wow, ESET stepping into script malware

It happened to me sòme LockScreens compiled/embedded in AutoIt bypassed some protection layers

[jessy 0]

it doesn't matter what the content in the vbs script is, it's detecting it no matter, what content it is for some reason

[jessy 0]

this false positive is not solved after the last update

[Veremo 6]

This is the second time you tell about FP doing something suspicious. Maybe there is some problem with you, not with ESET..

[jessy 0]

veremo, i'm simply reporting a false positive.

there's no suspecious of what i posted, and it's clearly a false detection, but being able to use the sfx commands.

[Veremo 6]

You try to silently run .vbs from self-extract RAR.. It is suspicious.

If you want to use it yourself just add it to exceptions, if you are going to make public - just don't do it, it will be flagged by more AVs I guess.

[Arakasi 549]

Veremo does have a point on this particular scenario.

[jessy 0]

I often used this method to create my own installers for my workplace, using a vbs file to launch the software with a silent switch

[Arakasi 549]

What are you creating installers with because msiexec has a silent switch already. No need for a vbs to launch it.

[jessy 0]

I know .msi got the silent parameter which, but that doesn't help me if I want to make a installer for it, which is only 1 single file

[Marcos 4,841]

We will continue detecting sfx files like this because of the high similarity with malware.

[jessy 0]

ok, thanks for your reply