This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is any one else seing this alert - Shh/Updater-B False positives

Virus/spyware 'Shh/Updater-B' has been detected in "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe". Cleanup unavailable. This is trickling in as alerts but at an alarming rate.

This thread was automatically locked due to age.

Parents

0 BenjaminP over 13 years ago

' Script to copy back files identified as infected using the SAV log files.
' It will parse all files called SAV* in the SAV log directory for copy actions
' by default logs to: "\Users\[User]\AppData\Local\Temp\CopyPDFBack.txt" or
' \documents and settings\[User]\Local Settings\Temp\CopyPDFBack.txt" depending on OS.
const WOW_KEY = "Wow6432Node"
const FOR_READING = 1
const MESSAGE_STRING = "wurde verschoben nach"
const SAV_LOG_PRE_FIX = "SAV"
const VIRUS_NAME = "Virus/Spyware 'Shh/"
dim strWow6432Node, strLogPath, objFSO, objFile, strLogFileName
dim strSAVLogLocation, strSAVLogLocationDir, strRes, objLogFile, strRegPath
strLogFileName = "CopyFilesBack.txt" 'Lines contain the text in the constant "MESSAGE_STRING"
'Setup global objects
set objFSO = CreateObject("Scripting.FileSystemObject")
'Get script log file location to write to
strLogPath = GetLogLocation() & "\" & strLogFileName
set objLogFile = objFSO.CreateTextFile(strLogPath, true)
WriteToLog 0, "Starting script to recover quarantined files where: log contains the line: '" & MESSAGE_STRING
strWow6432Node = "\"
if Is64(".") then
strWow6432Node = "\" & WOW_KEY & "\"
WriteToLog 0, "64-bit machine."
else
strWow6432Node = "\"
WriteToLog 0, "32-bit machine."
end if
strRegPath = "HKEY_LOCAL_MACHINE\SOFTWARE" & strWow6432Node & "Sophos\SAVService\Application\LogDir"
strRes = GetKey(strRegPath)
if strRes = "0" then
WriteToLog 1, "Failed to get SAV log location from registry."
WriteToLog 1, "Exiting script."
wscript.quit (1)
else
WriteToLog 0, "Read the SAV log location from registry."
end if
strSAVLogLocationDir = strRes
WriteToLog 0, "Location of log directory: " & strSAVLogLocationDir
'For each file starts with 'SAV_LOG_PRE_FIX'
WriteToLog 0, "For each file in the directory that starts '" & SAV_LOG_PRE_FIX & "'."
set objFolder = objFSO.GetFolder(strSAVLogLocationDir).files
intFound = 0
for each SAVFile in objFolder
if instr(SAVFile.name, SAV_LOG_PRE_FIX) > 0 then

set objFile = objFSO.OpenTextFile (strSAVLogLocationDir & "\" & SAVFile.name, FOR_READING, false, -1)
WriteToLog 0, "=================Processing: '" & SAVFile.name & "'========================"

do While objFile.AtEndOfStream <> true
strLineIn = trim(objFile.ReadLine)

if instr(strLineIn, VIRUS_NAME) > 0 then
intFound=1
WriteToLog 0, "The next line will have info on " & VIRUS_NAME
End if

if intFound = 1 then
strLineIn = trim(objFile.ReadLine)
WriteToLog 0, strLineIn
intFound=0
if (instr (strLineIn, MESSAGE_STRING) > 0) then
'Interested in the lines as it matches our requirements.
arrOfLine = split(strLineIn, """")

strOrigFilePath = trim (arrOfLine(1))
strNewFilePath = trim (arrOfLine(3))

WriteToLog 0, strOrigFilePath & " -> " & strNewFilePath
if CopyFileBack (strNewFilePath, strOrigFilePath) then
WriteToLog 0, "File restored."
else
WriteToLog 0, "File restore failed."
end if
end if
end if

loop
end if
next
'***********************************************************************************************************
WriteToLog 0, "Script finished."
set objFolder = nothing
set objLogFile = nothing
set objFSO = nothing
'***********************************************************************************************************
'Functions
'***********************************************************************************************************
Function GetLogLocation()

on error resume next
Set objTempFolder = objFSO.GetSpecialFolder(2)
if objTempFolder = "" then
GetLogLocation = "C:\windows\temp\" 'Set to Windows temp if can't get the dir.
else
GetLogLocation = objTempFolder
end if

Set objTempFolder = nothing

End function
'***********************************************************************************************************
'***********************************************************************************************************
Function CopyFileBack (strCurrentLocation, srcOrigLocation)

WriteToLog 0, "-->CopyFileBack()"

on error resume next
err.clear

If objFSO.FileExists(strCurrentLocation) Then
WriteToLog 0, "File exists: " & strCurrentLocation & " attempt to copy back to: " & srcOrigLocation
objFSO.moveFile strCurrentLocation, srcOrigLocation

if err.number <> 0 then
WriteToLog 1, "Failed to copy file: " & err.number & " : " & err.description
CopyFileBack = false
else
CopyFileBack = true
end if

else
WriteToLog 1, "Copying file back failed as file " & strCurrentLocation & " doesn't exist."
CopyFileBack = false
End If

WriteToLog 0, "<--CopyFileBack()"

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function Is64(strMachineName)
WriteToLog 0, "-->Is64(" & strMachineName & ")"
on error resume next

err.clear

dim objWMIService, objColSettings, strDesc, objProcessor

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachineName & "\root\cimv2")
Set objColSettings = objWMIService.ExecQuery ("SELECT AddressWidth FROM Win32_Processor")

if err.number <> 0 then
WriteToLog 1, "Error Number: " & err.number & " Error Description: " & err.description, 1
wscript.quit(1)
end if

For Each objProcessor In objColSettings
strDesc = objProcessor.AddressWidth
Next

if strDesc = "32" then
Is64 = false
end if
if strDesc = "64" then
Is64 = true
end if

Set objWMIService = nothing
set objColSettings = nothing

WriteToLog 0, "<--Is64()"

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function WriteToLog (strSev, strLogLine)
dim strToWrite
strToWrite = ""

select case strSev
case 0
strToWrite = "INF: "
case 1
strToWrite = "ERR: "
case else
strToWrite = "UNKNOWN: "
end select

objLogFile.WriteLine Date() & " " & Time() & " " & strToWrite & " " & strLogLine

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function GetKey(strPath)
on error resume next
dim strPathToLog
dim objReg

set objReg = wscript.createobject("wscript.shell")

err.clear
strPathToLog = objReg.RegRead (strPath)
if err.number = 0 then
GetKey = strPathToLog
else
GetKey = 0
end if

set objReg = nothing

End Function
:31619
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BenjaminP over 13 years ago

' Script to copy back files identified as infected using the SAV log files.
' It will parse all files called SAV* in the SAV log directory for copy actions
' by default logs to: "\Users\[User]\AppData\Local\Temp\CopyPDFBack.txt" or
' \documents and settings\[User]\Local Settings\Temp\CopyPDFBack.txt" depending on OS.
const WOW_KEY = "Wow6432Node"
const FOR_READING = 1
const MESSAGE_STRING = "wurde verschoben nach"
const SAV_LOG_PRE_FIX = "SAV"
const VIRUS_NAME = "Virus/Spyware 'Shh/"
dim strWow6432Node, strLogPath, objFSO, objFile, strLogFileName
dim strSAVLogLocation, strSAVLogLocationDir, strRes, objLogFile, strRegPath
strLogFileName = "CopyFilesBack.txt" 'Lines contain the text in the constant "MESSAGE_STRING"
'Setup global objects
set objFSO = CreateObject("Scripting.FileSystemObject")
'Get script log file location to write to
strLogPath = GetLogLocation() & "\" & strLogFileName
set objLogFile = objFSO.CreateTextFile(strLogPath, true)
WriteToLog 0, "Starting script to recover quarantined files where: log contains the line: '" & MESSAGE_STRING
strWow6432Node = "\"
if Is64(".") then
strWow6432Node = "\" & WOW_KEY & "\"
WriteToLog 0, "64-bit machine."
else
strWow6432Node = "\"
WriteToLog 0, "32-bit machine."
end if
strRegPath = "HKEY_LOCAL_MACHINE\SOFTWARE" & strWow6432Node & "Sophos\SAVService\Application\LogDir"
strRes = GetKey(strRegPath)
if strRes = "0" then
WriteToLog 1, "Failed to get SAV log location from registry."
WriteToLog 1, "Exiting script."
wscript.quit (1)
else
WriteToLog 0, "Read the SAV log location from registry."
end if
strSAVLogLocationDir = strRes
WriteToLog 0, "Location of log directory: " & strSAVLogLocationDir
'For each file starts with 'SAV_LOG_PRE_FIX'
WriteToLog 0, "For each file in the directory that starts '" & SAV_LOG_PRE_FIX & "'."
set objFolder = objFSO.GetFolder(strSAVLogLocationDir).files
intFound = 0
for each SAVFile in objFolder
if instr(SAVFile.name, SAV_LOG_PRE_FIX) > 0 then

set objFile = objFSO.OpenTextFile (strSAVLogLocationDir & "\" & SAVFile.name, FOR_READING, false, -1)
WriteToLog 0, "=================Processing: '" & SAVFile.name & "'========================"

do While objFile.AtEndOfStream <> true
strLineIn = trim(objFile.ReadLine)

if instr(strLineIn, VIRUS_NAME) > 0 then
intFound=1
WriteToLog 0, "The next line will have info on " & VIRUS_NAME
End if

if intFound = 1 then
strLineIn = trim(objFile.ReadLine)
WriteToLog 0, strLineIn
intFound=0
if (instr (strLineIn, MESSAGE_STRING) > 0) then
'Interested in the lines as it matches our requirements.
arrOfLine = split(strLineIn, """")

strOrigFilePath = trim (arrOfLine(1))
strNewFilePath = trim (arrOfLine(3))

WriteToLog 0, strOrigFilePath & " -> " & strNewFilePath
if CopyFileBack (strNewFilePath, strOrigFilePath) then
WriteToLog 0, "File restored."
else
WriteToLog 0, "File restore failed."
end if
end if
end if

loop
end if
next
'***********************************************************************************************************
WriteToLog 0, "Script finished."
set objFolder = nothing
set objLogFile = nothing
set objFSO = nothing
'***********************************************************************************************************
'Functions
'***********************************************************************************************************
Function GetLogLocation()

on error resume next
Set objTempFolder = objFSO.GetSpecialFolder(2)
if objTempFolder = "" then
GetLogLocation = "C:\windows\temp\" 'Set to Windows temp if can't get the dir.
else
GetLogLocation = objTempFolder
end if

Set objTempFolder = nothing

End function
'***********************************************************************************************************
'***********************************************************************************************************
Function CopyFileBack (strCurrentLocation, srcOrigLocation)

WriteToLog 0, "-->CopyFileBack()"

on error resume next
err.clear

If objFSO.FileExists(strCurrentLocation) Then
WriteToLog 0, "File exists: " & strCurrentLocation & " attempt to copy back to: " & srcOrigLocation
objFSO.moveFile strCurrentLocation, srcOrigLocation

if err.number <> 0 then
WriteToLog 1, "Failed to copy file: " & err.number & " : " & err.description
CopyFileBack = false
else
CopyFileBack = true
end if

else
WriteToLog 1, "Copying file back failed as file " & strCurrentLocation & " doesn't exist."
CopyFileBack = false
End If

WriteToLog 0, "<--CopyFileBack()"

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function Is64(strMachineName)
WriteToLog 0, "-->Is64(" & strMachineName & ")"
on error resume next

err.clear

dim objWMIService, objColSettings, strDesc, objProcessor

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachineName & "\root\cimv2")
Set objColSettings = objWMIService.ExecQuery ("SELECT AddressWidth FROM Win32_Processor")

if err.number <> 0 then
WriteToLog 1, "Error Number: " & err.number & " Error Description: " & err.description, 1
wscript.quit(1)
end if

For Each objProcessor In objColSettings
strDesc = objProcessor.AddressWidth
Next

if strDesc = "32" then
Is64 = false
end if
if strDesc = "64" then
Is64 = true
end if

Set objWMIService = nothing
set objColSettings = nothing

WriteToLog 0, "<--Is64()"

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function WriteToLog (strSev, strLogLine)
dim strToWrite
strToWrite = ""

select case strSev
case 0
strToWrite = "INF: "
case 1
strToWrite = "ERR: "
case else
strToWrite = "UNKNOWN: "
end select

objLogFile.WriteLine Date() & " " & Time() & " " & strToWrite & " " & strLogLine

End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function GetKey(strPath)
on error resume next
dim strPathToLog
dim objReg

set objReg = wscript.createobject("wscript.shell")

err.clear
strPathToLog = objReg.RegRead (strPath)
if err.number = 0 then
GetKey = strPathToLog
else
GetKey = 0
end if

set objReg = nothing

End Function
:31619
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data