rainlist.exe is a trojan according to windows defender

[rick-t-fiedrain]

I was moving a bunch of stuff from my documents folder (under Users/Username/Documents) which included some folders with backup and old rainmeter skins.

As the files transfer to another drive, every time rainlist.exe gets moved windows defender calls it a trojan.

rainlistexe.png

As I type this I'm up to 7 such "trojans" and counting. Each of them has been linked to the rainlist.exe file.

Is this a true threat or a known false positive?

RICK

[eclectic-tech]

That is a compiled version of the Auto-It script I have in my Lua Calendar folder (@Resources\Addons\Options\RainList.au3)

Here is what I have in the actual script (RainList.au3):

Code: Select all

#NoTrayIcon
#include <Array.au3>
#include <File.au3>
#include <SendMessage.au3>

If $CmdLine[0]<2 Or Not ProcessExists("Rainmeter.exe") Then
	Exit
EndIf

If $CmdLine[0]=3 Then
	$ArrayType = $CmdLine[3]
Else
	$ArrayType = 0
EndIf

$Folders = _FileListToArray($CmdLine[1], "*", $ArrayType)
$Text = StringReplace($CmdLine[2], "$FileList$", _ArrayToString($Folders, "|", 1))
$Text = StringReplace($Text, """, Chr(34))
_SendBang($Text)

Func _SendBang($szBang)

   Local Const $hWnd = WinGetHandle("[CLASS:RainmeterMeterWindow]")

   If $hWnd <> 0 Then
      Local Const $iSize = StringLen($szBang) + 1

      Local Const $pMem = DllStructCreate("wchar[" & $iSize & "]")
      DllStructSetData($pMem, 1, $szBang)

      Local Const $pCds = DllStructCreate("dword;dword;ptr")
      DllStructSetData($pCds, 1, 1)
      DllStructSetData($pCds, 2, ($iSize * 2))
      DllStructSetData($pCds, 3, DllStructGetPtr($pMem))

      Local Const $WM_COPYDATA = 0x004A
      _SendMessage($hWnd, $WM_COPYDATA, 0, DllStructGetPtr($pCds))
  EndIf

EndFunc

Nothing looks unusual to me, so I would think you are seeing a false positive...