sdcinvan Posted March 18, 2023 Posted March 18, 2023 (edited) I have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft. But since installing Malwarebytes, it's been warning me about a trojan associated with these two files -snip- This script is obviously encrypted and/or compressed, but what confused me most was that it is forbidden to decompile Autolt scripts. In fact, one can get kicked off this forum for admitting to decompiling. Why is that a problem, especially considering my situation? It just seems like a strange rule for a script that can be misused. I need to know what this likely malicious script was doing and I am looking for a way to view it. Since the Autolt3 version on my computer is dated 2018, is this an older version and therefore one that used to include a decompiler? From the wikiDecompiling FAQ - AutoIt Wiki (autoitscript.com) Quote Where can I find the decompiler? If the version of AutoIt is v3.2.5.1 or lower, then the decompiler is located at C:\Program Files\AutoIt3\Extras\Exe2Aut\Exe2Aut.exe by default. The directory may be different if you performed a custom installation. For all other newer versions, the decompiler has been removed. Expand I'm mostly posting this in case others have experienced similar situations. I am very curious about how this could have happened because I just spun up the VM where this occurred in mid-December. Fortunately, it could not have done any real damage but I still want to know its purpose. I'll likely have this resolved in the next 30 minutes. Thanks Edited March 18, 2023 by Jos removed domain & ip
Developers Jos Posted March 18, 2023 Developers Posted March 18, 2023 (edited) On 3/18/2023 at 8:13 PM, sdcinvan said: have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft Expand Yes you have but you might not have known it that you did! Either way: As you already know and simply ignored: It is not going to be discussed in these forums. *click* ps: 3.2.6.0 (25th August, 2007) (Release) PSS: So you why ask again when you already solved this in 2020? https://www.experts-exchange.com/questions/29203712/Autolt-Error-popup-message-line-0-error-opening-the-file-pops-up-every-few-minutes.html Edited March 18, 2023 by Jos SciTE4AutoIt3 Full installer Download page - Beta files Read before posting How to post scriptsource Forum etiquette Forum Rules Live for the present, Dream of the future, Learn from the past.
Recommended Posts