Motersho

Our company just switched from Symantec antivirus to Kaspersky a few weeks ago and I noticed that every application that I have written and compiled with AutoIT ended up getting falsely detected with Kaspersky as a virus.  Since I wrote each application, I know for a fact that there isn’t a Trojan in my code.  So I started a live chat with Kaspersky’s support staff and here was our solution.

1) Open up the Kaspersky Administration Kit and navigate to Managed Computers > Policies and then right click on the Protection Policy that you want to update and then select Properties.  For me the policy name is Protection Policy – Windows Workstations.

2) Next Click on the Protection Tab

3) Click on the Trusted Zone button

4) Click add and fill out the rule description as follows:
Properties: Threat Type
Comment: <What ever you want to name the Rule> AutoIT False Positive
Rule Description:
select object: Trojan-PSW.Win32.Autoit.m
Component: any

5) Click Ok then OK.

This will then automatically update all of the clients and all of your AutoIT application will run and not be detected and deleted as a virus.  If for some reason you AutoIT applicaiton are flagged as a virus other than Trojan-PSW.Win32.Autoit.m then you can just replace that parameter with above.

Note: This will now allow any valid Trojan-PSW.Win32.Autoit.m virus to go undetected by Kaspersky.  I write a lot of my script around the office in AutoIT so this was a chance I was willing to take.