Messages - rsatrioadi [ switch to compact view ]

Pages: [1] 2 3 4 5 6 ... 12next
1
Hello!

tl;dr: I used 4wd's script and it did it! My HTML files are clean now! Thank you so much 4wd, you saved my life files! (But also probably life!) And also thank you for getting me to learn AutoIt scripting a bit because of your laziness. :P

More:

I hope it is okay that I made a few modifications to the script like so: at first I used the script on a two small directories (say C:\a\a1 and C:\a\a2) and it worked, so I used it again on their parent directory (C:\a) that contains more directories other than a1 and a2. When I ran it there, it made backups of already cleaned files in a1 and a2, and made backups of the previous backups! Since I was going to use the script again on a larger scale (C:\), I didn't want it to make more and more duplicate backups, so I studied the script, downloaded AutoIt, tinkered around, and finally made it so that uninfected files wouldn't be backed up.

In the end I ran the script on C:\ and it repaired all but those in C:\Program Files. But there are not so many HTML files there, only some help files that can be fixed by reinstalling the software so it's all great. :Thmbsup:

The modified script:

Code: AutoIt [Select]
  1. #Region ;**** Directives created by AutoIt3Wrapper_GUI ****
  2. #AutoIt3Wrapper_Change2CUI=y
  3. #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
  4.  
  5. $sTempFile = @TempDir & "\RemVBSfHTM.txt"
  6. $sTest = "<SCRIPT Language=VBScript>"
  7.  
  8. If $CmdLine[0] = 0 Then
  9.         Exit (1)
  10.         $sFile = $CmdLine[1]
  11.  
  12. $hFile = FileOpen($sFile, 0)
  13. If $hFile = -1 Then
  14.         ConsoleWrite("Unable to open '" & $sFile & "' for reading." & @CRLF)
  15.         _Exit()
  16. $hTempFile = FileOpen($sTempFile, 2)
  17. If $hTempFile = -1 Then
  18.         ConsoleWrite("Unable to open '" & $sTempFile & "' for writing." & @CRLF)
  19.         _Exit()
  20.  
  21. $found = False
  22.         $sLine = FileReadLine($hFile)
  23.         If @error = -1 Then ExitLoop
  24.         If StringInStr($sLine, $sTest) > 0 Then
  25.                 $found = True
  26.                 $sLine = StringLeft($sLine, StringInStr($sLine, $sTest) - 1)
  27.                 FileWriteLine($hTempFile, $sLine)
  28.                 ExitLoop
  29.         Else
  30.                 FileWriteLine($hTempFile, $sLine)
  31.         EndIf
  32.  
  33. FileClose($hTempFile)
  34. FileClose($hFile)
  35.  
  36. If $found Then
  37.         If FileMove($sFile, $sFile & "-old+vbs") = 0 Then
  38.                 ConsoleWrite("Unable to rename '" & $sFile & "' prior to replacement." & @CRLF)
  39.                 _Exit()
  40.         Else
  41.                 FileMove($sTempFile, $sFile)
  42.         EndIf
  43.  
  44. Func _Exit()
  45.         Exit
  46. EndFunc   ;==>_Exit

So again, thank you very much 4wd and donationcoder, and I apologize for modifying the script without asking for your permission first.

2
Thanks so much 4wd, I will try running the program in a small directory first to see the result. I'll let you know if it works well with my set of files.

Thanks MilesAhead, I'll look into it and try around, but I think and hope 4wd's script is enough for this task.

I really appreciate your helps and suggestions.

3
Hi all, thanks for the replies.

@Curt
Thank you for the recommendations, but the links you provided helps with shortcuts and .vbs files, which were already handled by Avast. My biggest problem now are embedded vbscripts inside HTML files.

@mouser and @MilesAhead
Unfortunately part of my work deals with a collection of HTML files, most of which were synced over Dropbox (for team projects) and Copy (for my personal projects). I realized the existence of the virus when Dropbox on my other computer reported changes in HTML files when no one's working on them, so I installed antivirus, and the rest is history. So while I probably will do fresh install anyway, there are still infected files that I have to deal with. I know that both Dropbox and Copy keep backups of older versions, but since there are so many files across different directories I think it's more feasible to have a script that cleans the files rather than restoring backups one by one. But if you have any other suggestions I'm all ears.

@4wd
I need to clarify something: after looking at some of the infected files it seems that the <SCRIPT..>'s were appended at the end of each files, so for example if there's a HTML file with only

<p>blahblah</p>

in it it would be modified to

<p>blahblah</p><SCRIPT Language=..>

. So I think the correct approach should be looking for a SCRIPT element with Language=VBScript. If you can write the batch file I'd be very thankful.

4
Hello folks, long time no see.

tl;dr: some virus infected many (I hope not all...yet) HTML files inside my hard drive. It embedded nasty vbscript at the end of each file (after </html> tag). My antivirus detected but cannot repair them. What next?

Longer story:

After years of not using Windows, I got my hand on a Windows machine. Silly me didn't install antivirus at the first chance, so circa day 2 I got it infected with viruses from an infected flash drive. I installed Avast and ran a scan. Most .exe and .dll files were repaired but many HTML files are left unfixed (see tl;dr above). Here's a screenshot of the vbscript inside a file:

html.png

The <SCRIPT..> parts are the same in each infected HTML files, but the "gibberish" HTML comment after the closing </SCRIPT> differs from file to file. I don't know if this comment part does any harm, though.

So, any suggestions on how to clean them? If there's no ready-made solution maybe somebody can write me a script that reads all HTML files inside a directory and remove any vbscripts inside it? Pretty please? ;)

Thanks beforehand for any help.

5
I'm one of the Google Reader refugee who have found shelter in The Old Reader. Made by fellow 'victims' of Google Reader shutdown, it looks and behaves almost exactly like Google Reader.

I also tried Digg Reader but I find The Old Reader suits me better.

Pages: [1] 2 3 4 5 6 ... 12next
Go to full version