AutoIt virus?

[FredrikIdestam]

now how to remove this virus?

[Community On Patrol]

Hi FredrikIdestam,

1st Welcome to the AutoIt Forums!

Some of the following tips may not apply to you, but it may make your life a bit easier here on the forum in the future.

CODE

• Did you know that we have an awesome search feature?

  You can find many answers to your current questions, just by typing in the right search patterns.

• A suggestion is to use the Advanced Search mode:

• Type your specific search term in quotes.
• Click the forum you want to search in (the one most likely to have your information would generally be the Example Script forum and or the General Help and Support Forum).
• Click on "Search titles only" radio button.
• Click perform search.

The above will help you narrow down your searches and prevent you from unneccesarily posting a new thread.

[*]Also, you should try to read the Sticky posts that are at the top of each of the AutoIt Forums you enter such as:

• FAQs (Frequently Asked Questions)

• Are my AutoIt EXEs really infected? (About false positives and what to do if you may encounter one)

[*]Keep in mind, the help file will be your best friend, however you may find some of the tutorials written by some of our elite forum members helpful.

• Valuaters Interactive AutoIt 1-2-3 tutorial

• LxPs Learning to script with AutoIt3

[*]Forum Etiquette:

• Making a new thread:
  • Use the Search feature first to see if your question has already been answered.
  • Look in the help file as well before even thinking of posting (When what you want could be obtained by simply reading the help file, you don't generally get a good response from your AutoIt community).
  • Titles are very important here. 1 word titles or titles like "help me", "write something for me", "I'm a noob" etc... aren't tolerated.
  • Make sure you are posting in the correct forum:
    • General Help and Support:
      • This forum is for AutoIt related support questions only. If you have a question related to another language, or nothing at all to do with AutoIt then you need to post in the chat forum, or in that languages perspective forum.
    • Example Script:
      • This forum is for AutoIt scripts/executables only.
      • Source code is preferred but not necessary, you do have the right to just post the binary of your project if you wish.
      • Please don't post questions in this forum unless it's directly related to a thread already existing.
  • Use common sense when creating a new thread.

    Ask yourself if the title is descriptive enough to even interest someone (preferably those that know what they are talking about) to even look at your thread, let alone reply in it.

  • Think about how it would show in the search feature if someone were to look for something just like you are looking for (think of the keywords you used yourself and obviously didn't find anything (because we know you used the search feature ) and use those types of keywords in your title as well).
• Thread content:
  • Be descriptive with your query. (Make sure we actually know what you want to do).
  • Show you've made an effort in coding what you want (provide the reproducer code (generally no more than 50 lines as people lose interest in debugging someones script for free)).
  • Don't talk in ebonics. A lot of the forum members are adults, and a lot of them know how to help you, but talk like a child, you'll be treated as such.
  • Don't ask for help making keyloggers, spam (even if it's to do as a prank), or anything that can be thought of as malicious. You'll more than likely have the thread locked by a moderator, and take a bashing from your fellow AutoIt community.
  • When posting code, use code boxes. This can be accomplished by using [code ]<content here>[/code ] (No spaces between the brackets []).

    Using code boxes will keep the indentation and make it easier to read for others to help you.

• Bumping your threads:
  • Use common courtesy here.

    Keep in mind every time you bump your thread to the top of the forum, you knock the other threads down a notch.

    Everyone posting for help has just as much right for their threads to get read as you do.

    Because of that, do not bump your post more than once in a 24 hour period.

    A Bump is simply posting in your thread with nothing that pertains to your query with the sole purpose of moving it up.

    Deleting previous bumps, and posting new ones is not tolerated, and the moderators can find those deletions, so do yourself a favor and don't cross that line >_< .

• Rude or obnoxious content:

  This falls pretty much under the common sense thing. If you use it (common sense) before posting, you won't have issues.

  • Don't use foul language, remember, a lot of the community is at work when they read these threads.
  • Don't provoke or instigate an argument with someone.
• Double Posting:
  • It's understood that sometimes there's a lag in the system, and sometimes people don't see their post go up right aways so they post again.

    If this happens to you, simply notify a moderator with the report feature in the post, and politely ask them to delete it.

  • If you're just creating another topic because your original topic is not being answered the way you want or at all, this is not tolerated. You could lose your posting privileges all together over it.
• Non-English languages
  • If English is not your primary language, please make an attempt to interpret (yourself or online) and post that interpretation.

    We have wonderful users from around the world, so after you've done your post in English, back it up with your question also in your native tongue (You may find your answer much quicker using both).

That's it for now, I hope you have a wonderful learning experience, and hope to see you contribute to the community as your knowledge grows.

[torels]

what virus are you talking about ??

[FredrikIdestam]

i don't know what is autoit but the in virus information autoit Script was written. i do a search and reached on this site.

[torels]

yeah... some scripts are incompatible with some anti-viruses, and au3scripts are recognized as viruses(even if they actually aren't)

what Anti-Virus are you using ?

[FredrikIdestam]

no you are thinking wrong about it. i have a virus which copies itself to all drives. changes window settings and i can not open some window programs like Task Manager. System is very slow because of this.

[ChromeFan]

which new virus files do you have in your drives? what are their names? can you show us propeties of these files?

[torels]

doesn't the Anti Virus remove it ??

[trancexx]

now how to remove this virus?

This has nothing to do with AutoIt. Virus is just a virus.

When creating virus (or some other similar stuff) usually first thing that author of that shit does is write code for disabling task manager. This is done to prevent killing process via task manager.

Find way to get task manager back (read this for example, or someone arround here could write you a script for that). After that all you need to do is kill process in task manager and check startup programs (will be there most likely) and remove it from there too.

Then locate its position on HD and manually delete it (if it's multiplied use search box to find its copies). If you can't delete it, that is because it is opened with something (would be good to know what, but probably not very much important) or you don't have enough rights to delete it. Going to safe mode will do the trick (delete it from there).

That is all done mannually, but hey, you are on AutoIt's forum, maybe someone can automate that procedure for you.

@torels; there is no way that AV can help if the stuff is new, and generally AV is just... you know

Don't tell me that you guys use AV?!? just kidding

Edited September 18, 2008 by trancexx

[Andreik]

cmd->TASKLIST

To get all processes

TASKKILL

To kill the process (in your case an autoit script).

[FredrikIdestam]

virus Properties:

is it not a autoit virus?

and what is autoit?

[FredrikIdestam]

this is its icon

[trancexx]

virus Properties:

is it not a autoit virus?

and what is autoit?

This is probably something you got using some p2p program.

It's a work of amateur, probably very easy to remove.

Never heard of Angelina Julie, who is she?

Jesus...

btw, autoit is mean software that eats little children

[FredrikIdestam]

You said "probably very easy to remove." but i have no programming Skills and also dont know how to remove it. if you can help me then i shall appreciate it.

[GEOSoft]

You said "probably very easy to remove." but i have no programming Skills and also dont know how to remove it. if you can help me then i shall appreciate it.

Please create a zip file of any AutoRun.inf files that you find on your Computer and PM them to me. This may be a recent variant of one that I already wrote a remover for.

[FredrikIdestam]

who did write this virus? i need to remove it because i can not use my computer with this problem.

[GEOSoft]

who did write this virus? i need to remove it because i can not use my computer with this problem.

We have no way of identifying the author which is indeed unfortunate. However I can tell you this much

On a scale of 0 to 10, where 0 represents a true moron and 10 represents a true genius, people like this generally score around -20.

[LarryDalooza]

Help... I have the C++ virus and a possible VBS virus. I need to contact the creator of C++ and VBS to bitch...

Lar.

[FredrikIdestam]

i thought autoit is a website for virus programs and i asked by mistake about the author of virus. but GEOSoft told me recently that it's a programming language. sorry guys.

now if any one have it's remover then please send me. i can not install or uninstall any software and i need office to work on my computer. who will help me? please.

[LarryDalooza]

If you run the EXE in this post...

http://www.autoitscript.com/forum/index.ph...st&p=580475

it should kill any AutoIt script running... Find the offending EXE in Windows or System32 and delete it... then press Alt+END to stop the AutoIt killing app.

Lar.