random autoit error appears out of nowhere, i dont even have autoit installed

[mxm200]

i believe it might be some malware trying to run the script but my antivirus deleted it, but now every 5 minutes exactly an autoit error appears

Line 0 (.........\nfsc\ggwjt.rne)

Error: Error opening the file.

please help me stop it from popping up, i do not have autoit installed on my pc, at least a visible/reachable one.

[Earthshine]

It’s malware. Scan with malware bites

Edited December 29, 2018 by Earthshine

[Jos]

Well, I guess you need to figure out how the program (compiled AutoIt3 script) is shelled.
HiJackThis might be a good option to run and investigate the output for this program.

Jos

[mxm200]

malware bites doesn't seem to find anything

same goes for hijackthis..

is there a way to atleast stop it from running?

i have a bitdefender but i do not have any option to block a program that is not detected as malware

[Jos]

24 minutes ago, mxm200 said:

same goes for hijackthis..

Are you sure? it should show all shelled processes by the registry etc..  so can't imagine the info isn't there.

Jos

[TurionAltec]

This error looks like the interpreter (Normally Autoit3.exe) it trying to call a non-existent script file.

 

To trackdown where it is coming from, with the error open: use Microsoft's Process Explorer.

You may need to start process explorer as administrator / use "Show details for all processes" in the file menu.

When the popup shows up, drag the target icon from process explorer to the window.

 

In the process explorer list this will highlight the executable that's generating this error. Right click the executable and "Properties".

 

It will show "Parent" of who called it, and "Autostart location" may show if it was task scheduler that called it. It will also show the path if you want to delete the autoit executable.

 

If it was task scheduler you can then go in and delete the task.

[AutoHelper15]

Hey, I had the same issue. What I did was open task manager and use that to find the file location of the error and then delete it. Hope this helps! 

[rudi]

As @TurionAltec already mentioned ProcessExplorer started "Run as Administrator" will help you -- there is a "crosshair" (?) symbol in the symbol bar of ProcessExplorer: Drag-drop that one on the PopUp you wanna get rid of and Process Explorer will directly jump to the process, this popup window belongs to. Dig into the details of this process, if it's a child, dig into the details of the process(es) above, it was childed from.