sdcinvan Posted March 18, 2023 Share Posted March 18, 2023 (edited) I have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft. But since installing Malwarebytes, it's been warning me about a trojan associated with these two files -snip- This script is obviously encrypted and/or compressed, but what confused me most was that it is forbidden to decompile Autolt scripts. In fact, one can get kicked off this forum for admitting to decompiling. Why is that a problem, especially considering my situation? It just seems like a strange rule for a script that can be misused. I need to know what this likely malicious script was doing and I am looking for a way to view it. Since the Autolt3 version on my computer is dated 2018, is this an older version and therefore one that used to include a decompiler? From the wikiDecompiling FAQ - AutoIt Wiki (autoitscript.com) Quote Where can I find the decompiler? If the version of AutoIt is v3.2.5.1 or lower, then the decompiler is located at C:\Program Files\AutoIt3\Extras\Exe2Aut\Exe2Aut.exe by default. The directory may be different if you performed a custom installation. For all other newer versions, the decompiler has been removed. I'm mostly posting this in case others have experienced similar situations. I am very curious about how this could have happened because I just spun up the VM where this occurred in mid-December. Fortunately, it could not have done any real damage but I still want to know its purpose. I'll likely have this resolved in the next 30 minutes. Thanks Edited March 18, 2023 by Jos removed domain & ip Link to comment Share on other sites More sharing options...
Developers Jos Posted March 18, 2023 Developers Share Posted March 18, 2023 (edited) 26 minutes ago, sdcinvan said: have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft Yes you have but you might not have known it that you did! Either way: As you already know and simply ignored: It is not going to be discussed in these forums. *click* ps: 3.2.6.0 (25th August, 2007) (Release) PSS: So you why ask again when you already solved this in 2020? https://www.experts-exchange.com/questions/29203712/Autolt-Error-popup-message-line-0-error-opening-the-file-pops-up-every-few-minutes.html Edited March 18, 2023 by Jos SciTE4AutoIt3 Full installer Download page - Beta files Read before posting How to post scriptsource Forum etiquette Forum Rules Live for the present, Dream of the future, Learn from the past. Link to comment Share on other sites More sharing options...
Recommended Posts