Member Panel

Hey guys, anyone ever heard of these?

I've got a clients machine who has IRALog.exe running 50% cpu usage all the time.

I've done some research and found that it's an automated it script by some place called AutoIT

http://www.autoitscript.com/autoit3/compiled.html

it screams spyware to me, and we're currently trying to remove these files manually (which is a pain as the guy doesn't have local admin rights).

Just wondering if anyone had heard of these?

Hya GaRHaR.

Nope , sorry but never heard of it. But i could be used both legit and illegit:



AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation in order to automate tasks in a way not possible or reliable with other languages (e.g. VBScript and SendKeys). AutoIt is also very small, self-contained and will run on 95, 98, ME, NT4, 2000, XP, 2003 out of the box with no annoying "runtimes" required! You can even make compiled executable scripts that can run without AutoIt being installed!
AutoIt was initially designed for PC "roll out" situations to reliably configure thousands of PCs, but with the arrival of v3 it has become a powerful language able to cope with most scripting needs.

AutoIt can:

• Provide a general-purpose scripting language for all Windows versions
• Simulate keystrokes (supports most keyboard layouts)
• Simulate mouse movements and clicks
• Move, resize and manipulate windows
• Interact directly with "controls" on a window (set/get text from edit controls, check boxes and radio buttons, select items in drop-down lists, etc.)
• Create complex user interfaces (GUIs)
• Work with the clipboard to cut/paste text items
• Provide a scriptable RunAs function for Windows 2000/XP/2003

But looking at the warning on there site:

If you wish to complain about a script (because it is a trojan/hack/gaming cheat) then again, contact the author. If you wish, you may also contact me to tell me of the "bad" script so that I can make a note of it and if neccessary investigate further.

It seems to be used pretty often for malicious things.



Do you need some muscle apps to try to delete it/them? Then post the file paths and names. And the "Prework" also sounds like a good idea.

yea, got rid of them...just wanted to know if anyone had heard of 'em

trying to trace what this iralog was doing with all the cpu power...so far unsuccessful

Maybe this is an idea?


If you still have the files somewhere anyway.