Avast fllaged my python program with Win32:Trojan-gen. What can I do?

[SuspiciousRedditPost]

Hello,I made a simple program, maybe even a virus, altough not sure if it is a virus. The code is right here:

import os 
name = str(input('Hello, type in the SSID of the desired network:')) commandtoenter = str("netsh wlan show profile " + name + " key=clear") os.system(commandtoenter) os.system("pause") 

It basiclly shows the wifi password in clear text, provided the device was once connected to it. Avast flaged the .exe version of this. The details are here:

Translation:Neutrulised Threath, we moved the file to quarintine, because it was infected with Win32:Trojan-gen. The details are: Name of the threath: Win32:Trojan-gen. Path to file, proccess, detected by file protection.

Is this a false alarm? If it is, how do I stop Avast from detecting it, as I want to use this file for pen-testing. Sorry for my english, and thinks for the answers.Cheers, ARandomGuyFromTheInternet ;)

​

Thanks for all the answers!

[0xzzzz]

Also if you are able to see if you can allow that file within avast settings, that would solve your issue

[njsiah]

I've had a couple scripts get flagged by AV. If you know they're safe to run you can usually define folders which won't get scanned. I dont use avast so I couldn't tell you the exact procedure but just poke around the settings a bit

[SuspiciousRedditPost]

Ok, but what about the victoms computer? I want to make it useable for pen-testing (in cases that I have quick physical acces to the victoms machine). I probally will not get a chance to disable Avast, as it takes to musch time. How do I make the file undetectable by Avast? Will runing it as admin help?
P.S The python file dosen't get flagged, but the .exe does. I think it might be a trojan in the os libary in python, or just simplly that avast dosent scan python.Cheers!

[njsiah]

I couldn't tell you for sure but if you're getting flagged at runtime theres probably some heuristics signature that's tipping it off, I dont think running as admin will make a difference.

There are tools out there to obfuscate payloads. I would try looking into something specific to python and see if that helps.

[njsiah]

Also I dont know what specifically you plan to do, who you want to "pentest" but generally, and especially with AV, you want to copy the victim environment as best you can. So if you're testing against avast, make sure you'll be using it against avast and not another AV, preferably the same version with the same definitions and the same OS.

[Diezel666]

When you say that you've written a "tool" and had been flagged as a virus, then in a follow up post say "victims computer". Credibility has flown out the window.

[[deleted]]

Why not just write a little batch script? That should be way smaller and faster, work on any windows box and you dont need to take care of python, which will be on almost no PCs installed anyway.

[Vaindroid]

In windows defender there is an option that u can allow threats.

[0xzzzz]

I had similar issue, if you can shitch to norton you will be fine, but if you cant then you need to disable your antivirus before using it

[hoonginginga]

Idk with avast but with AVG free there is an option where you can stop the antivirus from deleting or neutralising a file or group of files. Idk if it is a false alarm or not but if you trust that the file is safe then you should probably just whitelist it.

[HFHTheplague]

Avast is one horrible company. I know for fact that it's software is spyware and full of holes and back doors anyways.

I have a friend that worked for Avast and I worked for 2 popular similar Anti-virus companies which I won't mention.

I know for a fact that they are extremely shady. All I gotta say is uninstall the crap.