AutoIT Error at Startup

[Lizardking141]

So a little background first, I am part of an IT team for a company and this error popped up on a computer of one of my users. We do not use AutoIT for anything in our company and I am just now getting into it after hitting this error. The error I am seeing is:

Line 0 (File "C:\Users\username\YBcL1gilQRdZq0G1\FBbtK"):
Error: Error opening the file.

So I tracked down what was causing the error and there was a shortcut in the users' windows startup folder that was pointing to this file that no longer exists. I do not see any record of it being deleted in my AV manager. I got rid of the shortcut and it got rid of the error as expected.

So my question is without the original file or records of it being gone is there any way for me to make sure it is completely gone from the system? I don't know quite how robust AutoIT is and what it could have done before it was deleted or if it would have deleted itself for some reason.

I know this is kind of vague but this is all I have to go off of as well and am just trying to get more information and make sure this problem is fixed and doesn't pop up anymore.

Thanks for any info. 

[BrewManNH]

You could search for it on the hard drive to see if it still exists anywhere. The Line 0 part says that something is running, not a shortcut, but the actual program. You may have stopped it from being executed, but if all you deleted was the shortcut then the program might still be lurking somewhere.

Without having a snapshot of the contents of the computer prior to the file being placed onto it and executed, you'd have a hard time finding out what it might have done while it was there and running.

[Lizardking141]

That is what I was worried about, it still lurking around somewhere. I can not find the program or even the containing folder that the shortcut was pointing to on the drive. It should have clicked in my head that if it is an AutoIT line 0 error instead of say a windows "The file this link is pointing to is no longer available" esque error that it would still be there somewhere and trying to run but something is stopping it. 

Thanks for the info, I will go do some more searches and see if I can find an traces of it again. 

[Lizardking141]

Found the .au3 file, was hiding in User\AppData\Roaming. Any way if I have the file I can tell what it was trying to do when it was running?

Thanks.

[Jos]

It should be a readable script when it's an au3, so should be easy to figure out what it does.

Jos

[Lizardking141]

It is definitely readable, wouldn't really consider it easily readable due to the fact that the shortest variable is $HCUKCVEgeE and they only get more convoluted with functions like MUMUOKCWUYGDiDFPZNGOeHcX, but it is a good starting point and I will definitely be digging into it to try to figure it out. Guess this gives me an excuse to learn a new language which isn't a bad thing.

Thanks for the all the help and information. 

[Melba23]

Lizardking141,

That does not sound like good news. If you want to PM me the file, I would be happy to take a look and see if I can work out what it does.

M23

[Lizardking141]

If you don't mind doing it I have no objections to more eyes on it. 

I will PM it to you.

Thanks,