AVG2011 and V3.2

[JonD]

After submitting the InstantSupport.exe to AVG and being assured that it would be fixed... there is no fix yet! Very disappointing as many of my clients are using the AVG product and I can't tell them to change!

The interesting thing is that my modified version of 3.2 does not get detected as malware. It would appear that rearranging and adding to the existing code made sufficient changes for it to pass under the radar (so to speak).

If there's anyone else having an issue, there is a work around by adding InstantSupport.exe to the exclusion list.

If you don't have AVG but your clients do and you need step by step instructions... let me know and I will post.

JonD

[maxabbr]

JonD,

What kind of modification do you make (only in au3 files or in the winvnc.exe)?

I have the same problem with many clients and I had post this issue tu AVG but until now nothing change in the DB.

[JonD]

My mods were only in the InstantSupport.au3 file. I customized things like the loading of my logo (could have just renamed my logo file instead),,, the position of the GUI and size when it displays and some other code to handle existing service detection.

I'm not sure that the specific changes are important just the fact that there are changes since all the original code is still present.

JonD

[supercoe]

Well then, everything should work fine when 3.3 is released.

[epinino]

I have the same issue and email it to virus@avg.com . Their support very cooperative and replied my mail within 24 hours. Well there is one time when they didn't answer for several day, and I email them again. And they answer it.

You should tried their whitelisting services. So you don't have to email them each time you compile it. Though it more convenient if we could have a workaround without using the services. As supercoe said will be in 3.3.
Hardly wait it.

[maxabbr]

After a few try-and-error, I think I found the problem (or a way to avoid it at least).

In the file InstantSupport.au3 replace

FileCopy( @ScriptFullPath, $WorkingPath & "\InstantSupport.exe", 9 )

with

FileCopy( @ScriptDir & "\" & @ScriptName, $WorkingPath & "\InstantSupport.exe", 9 )

This avoid some AVG signature detection replacing a few bytes in the executable.

[JonD]

Works for me too!

Not sure why it should be any different but it's a great solution.

Thanks,
JonD

[epinino]

uwooo. it works for me too...
thanks maxabbr for the founding.

Supercoe, I think it's the solution for the next build??

[vpdd]

Amazing! It works

[supercoe]

Very interesting, I'll use this method for the next build.
Weird because @ScriptFullPath = @ScriptDir & "\" & @ScriptName
There must be some viruses that AVG knows about using @ScriptFullPath I suppose, hopefully they won't find out this trick.

Thanks maxabbr!

[maxabbr]

Dispite the two commands make the same thing (see doc for AutoIt at http://www.autoitscript.com/autoit3/docs/macros.htm) the binaries are different and for some reason one trigger some AVG signature detection.

Glad to be helpful.

[JonD]

This goes back to my original observation where my changes created a different binary and the problems went away.

JonD

[supercoe]

Out of all the lines of code....
How the heck did you find this to be the issue??
Amazing tracking skills.

[maxabbr]

@supercoe
Thanks!
Just coding-recompile-recoding to isolate the peace of code with problem (I assume that the problem are a simple false positive). Then I try some solutions to replace the line with similar code. No more than 2 hours of work.

[vpdd]

yep, maxabbr, incredible work and traking skills

Thanks a lot!