I would appreciate your advice about the Wikipedia section about malware for AutoHotkey, please.

Because AutoHotkey contains many powerful automation tools, it is sometimes used to create malicious software. Given the nature of interpreted languages, this results in a large chunk of the AutoHotkey interpreter (which is not itself malicious[citation needed]) being distributed along with the malicious software. When antivirus vendors try to add the signature of the malware to their databases they often accidentally add the signature of the AutoHotkey interpreter instead[citation needed], resulting in a false positive.

If you take a look at the article you will notice that two citations are missing. I'd simply like to find articles from reputable sources that support or refute these statements.

  • I'm pretty sure AHK is not malware! Is there a source that hits this nail on the head (that was not written by the software's authors or directly derived from their claims)?
  • Do anti-malware vendors 'often' (or sometimes) add AHK's signature to their databases mistakenly? And is there a good article that supports this claim?
  • AutoHotKey is open source. You can see for yourself if it is malware or not.
    – MiaoHatola
    May 13 '17 at 18:41
  • @MiaoHatola: Yes, I understand. However, suppose I were to make that kind of suggestion to you and say, Firefox is open source. (AFAIK, it is.) Prove to yourself that it's not malware. :) In any case, as you are most likely aware, this isn't how wikipedia works. If someone offers Pythagorus' Theorem in an article then he's obliged either to prove it or to reference an article that does.
    – Bill Bell
    May 13 '17 at 19:11
  • lithium batteries and cold meds are not bad, but cops draw conclusions if your trunk if full of them.
    – dandavis
    May 13 '17 at 21:41
  • Maliciousness requires intent. It will be difficult to provide an article showing the author's intent except to cite the utility of the tools for things other than malware and make an inference.
    – schroeder
    May 14 '17 at 7:34

I'm pretty sure AHK is not malware!

There is no claim (by the article or elsewhere) that AutoHotKey is Malware. I'm not sure who or what makes any indication that is the case. If anyone had doubts, they could view the source code as AutoHotKey is open source.

Do anti-malware vendors 'often' (or sometimes) add AHK's signature to their databases mistakenly?

Anti-virus companies rarely do anything by "mistake". A company many design their product such that the product's heuristics determines something with AutoHotKey-like content to be malicious. Another example of this can be seen with executables passed though a "PE Packer" such as UPX. Does it always mean that the executable is bad or dangerous? No, it was either just a general/broad signature or a design choice of the product's heuristic to alert the user on the discovery of such content.

  • Please see my comment in response to MiaoHatola re the first point. The wikipedia article uses the word 'accidentally' and here was I trying to make it less objectionable. Given that we can allow that AHK is not malware then would you be willing to accept that anti-malware companies sometimes commit false positive errors in making their judgements about AHK?
    – Bill Bell
    May 13 '17 at 19:22
  • @BillBell Any given antivirus company will certainly have false positives in their long list of signatures. I have run into many myself. It can prove difficult to determine what is or isn't part of AutoHotKey when looking at machine instructions, or a static executable file. What should be a greater concern is "false negatives". Again, heuristics plays a part in this, and beyond the scope of the question. May 13 '17 at 19:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.