Jump to content
Sign in to follow this  
TXTechie

AutoIt and Malware: Compile or just run scripts with AutoIt3.exe?

Recommended Posts

Hello Everyone!

Now that I've decided to begin using AutoIt as my standard template "wrapper" for deploying software and automating changes on computers within my work environment, I want to ask the community whether you think I should deploy my software packages as compiled executables, or should I just include the main AutoIt executables (AutoIt3.exe & AutoIt3_x64.exe) and then call the software package in my software deployment solution via the command-line (for example: AutoIt3.exe Flash-11.6.au3)?

The primary reason for this question is based on the AutoIt and Malware link on the AutoIt Wiki. While, AutoIt executables are not currently being flagged as false positives by our current Anti-Virus and Anti-Malware solution, I'm concerned about the potential scenario where a false positive occurring again at any time in the future (for any number of reasons) disabling all software deployments within our company because I've chose to use compiled AutoIt scripts for my standard deployment mechanism.

What are your thoughts?

Share this post


Link to post
Share on other sites

Hi, TXTechie. Besides AutoIt, what method of deployment are you using (Altiris, SCCM, A.D., etc.)? I always always always suggest you take the time to repackage applications into MSI format, as it gives you much more flexibility with the install. Beyond that, however, it really depends on the method of deployment.

Share this post


Link to post
Share on other sites

Hi JLogan3o13,

Well, I've been in Systems Management (software packaging and deployments) for 14+ years now and there are two primary methods for software packaging and deployments: 1) drive the installation using the native installer and 2) repackaging everything to Microsoft's Windows Installer (MSI) technology. I am in the 1) camp, so I create a script "wrapper" to drive the native installer (whether legacy or MSI) and then automate any other desired post-installation configurations as desired.

So, since I don't use Flexera Software's InstallShield tools - I've been deploying software using a script as a wrapper (currently VBScript, but I've decided to switch to AutoIt). This is why I'm asking the question.

My company uses CA Software Delivery as our software deployment solution (I have previously used Microsoft's SMS [now SCCM], Novell ZenWorks, what used to be called Marimba, but is now BMC BladeLogic Client Automation and Dell's KACE KBOX).

Share this post


Link to post
Share on other sites

If you have access to your company's antivirus software on the server level, you can whitelist the installation location of your software.

Also, I have found that compiling with options and unchecking UPX compression reduces false positives.


RAID Calculator | Software Installer

The truth has been suppressed since the dawn of time.

Share this post


Link to post
Share on other sites

My experience "in the wild" with home pcs and having to deal with multiple Antivirus products with multiple configurations is you can't trust them not to kill AutoIt programs.

As you (unlike I) have control of your environment,

Why not install "AutoIt3.exe" somewhere permanently on your computers.

Then associate "a3x" with "AutoIt3.exe".

That way you don't have to bundle AutoIt3 with everything, you avoid the possibility of false positives completely and the AutoIt program (a3x) isn't plain text visible.

Just my 2c worth.

John Morrison

Share this post


Link to post
Share on other sites

abberration - The problem is the location of the deployed software will be different and growing, I don't want that management nightmare. I thought that I had read another post here in the forums stating that using any other setting except for the default UPX compression setting of Normal would change the file attributes of the default AutoIt compiled executable - is this true?

storme - Since I am also the person in control of the standard workstation clone image, I have thought about including the AutoIt3_x64.exe on our standard Win7 (64-bit) image build - if I go the route of just executing scripts (rather than compiling). However, the less than 1 MB size of each of the AutoIt executables is not a big deal. I don't really care about the visibility of my scripts (especially since I've been using VBScript files for years), but I like the idea of having less additional files by compiling to the a3x format (I had to look that up in the help file, as I was unfamiliar with that) in that it can incorporate all include and FIleInstall files. Plus, I have the added ability to make my scripts a little more secure from easily prying eyes - especially if I may include some more confidential info in some of my scripts in the future (I know that this is not really secure, but is just secure from those who aren't interested in really trying to hack the scripts). Thank you, very much, for the additional information, storme!

 

Does anyone think I should worry about this and just go ahead and use fully compiled scripts to executables for all of my deployments?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Similar Content

    • By nooneclose
      I was running my script and everything was working fine and then it just stopped working. 
      I got this error message:
      !>12:51:55 AutoIt3.exe ended.rc:-1073741819 +>12:51:55 AutoIt3Wrapper Finished. >Exit code: 3221225477 Time: 354.6 I looked that error up and this article (https://www.autoitscript.com/trac/autoit/ticket/2541) said it was fixed a long time ago. 
      I am using version: SciTE Version 4.1.0, how am I getting this error? (first time I got it after running my code 50+ times)
      it crashed while trying to loop through emails. 
      Full output log:
      >"C:\Program Files (x86)\AutoIt3\SciTE\..\AutoIt3.exe" /run /prod /ErrorStdOut /in "C:\" /UserParams +>12:46:01 Starting AutoIt3Wrapper v.18.708.1148.0 SciTE v.4.1.0.0 Keyboard:00000409 OS:WIN_10/ CPU:X64 OS:X64 Environment(Language:0409) CodePage:0 utf8.auto.check:4 +> SciTEDir => C:\Program Files (x86)\AutoIt3\SciTE >Running AU3Check (3.3.14.5) from:C:\Program Files (x86)\AutoIt3 +>12:46:01 AU3Check ended.rc:0 >Running:(3.3.14.5): --> Press Ctrl+Alt+Break to Restart or Ctrl+Break to Stop Action 1: Create a connection to the outlook account at line: 192 Action 1: Finished at line: 205 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Current email has been changed from Unread to Read. at line: 238 Current email has been changed from Unread to Read. at line: 238 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 3: Store vaild E-mails at line: 258 Number of unread E-mails: 17 at line: 290 Action 3: Finished at line: 292 Current number of processed Emails is: 0 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Opening a new Chrome window. at line: 2747 Action 8: Open Web Browser at line: 2240 _WDStartup: "MicrosoftWebDriver.exe" --verbose Action 8: Finished at line: 2270 Action 9: Navigate to Work Order Tracking at line: 2281 Action 9: Finished at line: 2295 Action 10: Click on Create New Work Order at line: 2306 Action 10: Finished Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660308 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 1 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660309 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 2 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660310 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 3 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660311 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 4 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660312 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 5 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660313 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 6 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: YT6508 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Long Description. Suite not needed. at line: 1475 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660314 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 7 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: CN2116 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Long Description. Suite not needed. at line: 1475 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660315 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 8 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: DT4905 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Work Order Number: 660316 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 9 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: YT6513 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 Young Tower has no suites! Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660317 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 10 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: BT3310 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Long Description. Suite not needed. at line: 1475 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660318 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 11 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: BT3411 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660319 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 12 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 Action 4: Finished at line: 361 Action 5: Store E-mail's contents at line: 371 Action 5: Finished at line: 495 Action 6: Test to Skip based on location at line: 508 Proper Building format used. Send Location: DT4519 Action 6: Finished at line: 710 Action 7: Check if location needs to be a suite at line: 720 The 'Bathroom' is not mentioned in the Description. Suite not needed. at line: 2180 Action 7: Finished at line: 2186 Action 11: Send E-mail Data to it's proper field at line: 2324 Sub-Action 3: Split Long Description at line: 2522 Sub-Action 3: Finished at line: 2576 Work Order Number: 660320 Action 11: Finished at line: 2511 Change status was called at line: 2758 Sub-Action 2: Change E-mail to Read at line: 2223 Current email has been changed from Unread to Read. at line: 2226 Sub-Action 2: Finished at line: 2230 Action 16: Create New Work Order at line: 2705 Action 16: Finished at line: 2719 Current number of processed Emails is: 13 at line: 2735 Action 2: Scan for invaild E-mails at line: 215 Number of SKIPPED unread E-mails: at line: 226 Number of SKIPPED E-mails: 0 at line: 246 Action 2: Finished at line: 248 Action 4: Loop through E-mails at line: 302 !>12:51:55 AutoIt3.exe ended.rc:-1073741819 +>12:51:55 AutoIt3Wrapper Finished. >Exit code: 3221225477 Time: 354.6  
    • By mlazovjp
      I am going through the AutoIt Wiki and soaking up a lot of great information.  On the “Best Coding Practices” page at https://www.autoitscript.com/wiki/Best_coding_practices#Scopes_of_Variables there seems to be a minor detail missing.  In the “Variable Initialization” section at https://www.autoitscript.com/wiki/Best_coding_practices#Variable_Initialization , there are references to a data type $o, but in the table listing prefixes and their data types, there does not appear to be a prefix “o”.  I assume that this is for Object?
    • By nooneclose
      I have searched for almost an hour and I still cannot find examples and or the code that I am looking for concerning my question. 
      I am wanting to capture/read/send (however you want to say it) the console output to a file.
      Here is a picture of what I want to send to a file after the script runs. (what is in the console output/window after the script runs)

       
    • By bluebug
      Hi, guys!
      I'm new with using Autoit.
      Is possible do an automation to an application desktop java using Autoit?
       
       
    • By nooneclose
      Here is my code: Currently it finds all the unread, subject restricted emails in the inbox and its subfolders. (finds 15 when it should only find 4)
      $aItems = _OL_ItemFind($oOutlook, $mFolder[1], $olMail, "[UnRead]=True", "Subject", "Maintenance Request", "EntryID,Subject", "", 1) I want to find the emails in the inbox but I don't want to include the emails from the inbox's sub-folders. 
×
×
  • Create New...