Jump to content

Newbie question - found 351kb 5344432D.a3x file (date: January 8, 2023) alongside AutoIt3.exe


Recommended Posts

I have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft. But since installing Malwarebytes, it's been warning me about a trojan associated with these two files -snip-

This script is obviously encrypted and/or compressed, but what confused me most was that it is forbidden to decompile Autolt scripts. In fact, one can get kicked off this forum for admitting to decompiling. Why is that a problem, especially considering my situation? It just seems like a strange rule for a script that can be misused. 

I need to know what this likely malicious script was doing and I am looking for a way to view it. 

Since the Autolt3 version on my computer is dated 2018, is this an older version and therefore one that used to include a decompiler? 
From the wiki
Decompiling FAQ - AutoIt Wiki (autoitscript.com)

Quote

Where can I find the decompiler?

If the version of AutoIt is v3.2.5.1 or lower, then the decompiler is located at C:\Program Files\AutoIt3\Extras\Exe2Aut\Exe2Aut.exe by default. The directory may be different if you performed a custom installation. For all other newer versions, the decompiler has been removed.


I'm mostly posting this in case others have experienced similar situations. I am very curious about how this could have happened because I just spun up the VM where this occurred in mid-December. Fortunately, it could not have done any real damage but I still want to know its purpose.


I'll likely have this resolved in the next 30 minutes.

 

Thanks

Edited by Jos
removed domain & ip
Link to comment
Share on other sites

  • Developers
26 minutes ago, sdcinvan said:

have never installed AutoLt and I certainly didn't add both the script 5344432D.a3x and Autolt3.exe in the path C:\Users\[name]\AppData\Roaming\Microsoft

Yes you have but you might not have known it that you did! ;)

Either way: As you already know and simply ignored: It is not going to be discussed in these forums.

*click*

ps: 3.2.6.0 (25th August, 2007) (Release)

PSS: So you why ask again when you already solved this in 2020? https://www.experts-exchange.com/questions/29203712/Autolt-Error-popup-message-line-0-error-opening-the-file-pops-up-every-few-minutes.html

Edited by Jos

SciTE4AutoIt3 Full installer Download page   - Beta files       Read before posting     How to post scriptsource   Forum etiquette  Forum Rules 
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Link to comment
Share on other sites

  • Jos locked this topic
Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...