Uhm, ok.
If you don't choose to execute the script after extraction, nothing happens and you can replace the interpreter.
I'd just like to note that the script is made with/for v3.2.12.1.
There may be some
breaking changes since then that may lead to misbehaviors or crashes.
Edit:
Just to make clear for people that read this statement:
I will not replace the interpreter any time soon.
-I don't want to look after the changes every time a new version comes out and see if my code is affected. Thinking of it, it's the first time anyone has reported that it would be malware and I noted it.
-I have 3 different anti-virus-checkers on different PCs and tested a few that don't bother about it but blocked a current version a few weeks ago.
Here is an overview of
an analysis. I'd also trust that the guys from
O'Reilly would not make a book about something that contains malware.
-Thinking of a developer creates malware, do you really think he would invest money to brand it as his software?
-Do you think it would be clean in later versions because he changed his mind and he would still have the bad version available as a download?
-If you don't trust me but the developer of AutoIt3.exe, you are free to download the old version and run a checksum on the file from the BWS and that download.
-And why would you still be using
WeiDU anyway if you don't believe in false positives? There are a lot posts about "
WeiDU is reported as..."
-The BWS (and as its interpreter the AutoIt3.exe) will go and try to connect to the internet. It will do because it's programmed to behave in that way.
If you (other readers) still don't feel like trusting the executable, you are free to skip my warning regarding the changes of the interpreter and see what happens or don't use the software.
Edited by dabus, 26 June 2010 - 11:01 AM.