This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is any one else seing this alert - Shh/Updater-B False positives

Virus/spyware 'Shh/Updater-B' has been detected in "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe". Cleanup unavailable. This is trickling in as alerts but at an alarming rate.

This thread was automatically locked due to age.

Parents

0 Driftmotion over 13 years ago

if anyone is interested, we have created a script (VBS) that querries AD for computer names, then read the SAV.txt log from sophos to reverse the move of files that were wrongly moved/flagged as INFECTED. Best of all it has reporting!

' If you have any question/comment, please visit https://bitbucket.org/ncta/sophos-fixer

' Copyright (c) 2012 National Cable Telecommunication Association
' Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), 
' to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, 
' and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
' The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
' THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
' FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
' WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Dim strFilter, strAttrs, strScope, strDNSSuffix, strBase
Dim objConn, objRS, objShell,objExec,objFSO,objFile, fileName
Dim objFSOLog, MasterLogFileTxt
Dim currentDateTime, LogFileDirectory, MasterLogFile
Dim ComputerFoundFileCounter, ComputerMoveFileCounter, CantMoveFountCounter, ComputerCounter
Dim LogFileCantMove, WindowsDirectory
Dim TriggerRestart, TriggerFindAndMoveFile, RunForXPCOnly
Dim LogFileName

Const ForReading = 1, ForWriting = 2, ForAppending = 8 

TriggerRestart = False
TriggerFindAndMoveFile = True

'Set RunForXPCOnly to -1 to run on all PC or 10 to run on the first 10 PC
RunForXPCOnly = -1

WindowsDirectory = "C$\Windows\System32\"

Set objFSOLog = CreateObject("Scripting.FileSystemObject")

WScript.Echo "I'm starting. Click Ok to start.  To stop, change the log folder and it will run into error and stop."

LogFileDirectory = "C:\Log\Sophos\"

CreateLogDirectoryAndFile()
  
Set objShell = CreateObject("Wscript.Shell")
 
' List out the OU's you want computers in to be rebooted. Remember, if you add an OU,
' increment the strRoot(x) in *both* places.
' dc is for your domain Controller.  
' ou is your folder directory going backward. 
' IE.  if you have a folder like this \\MyDomainControler.net\Network\Computers\Admin\Test.
' Then LDAP would be something liket his <LDAP://DC-ii/ou=Test,ou=Admin,ou=Computers,ou=Network,dc=MyDomainController,dc=net>;
Dim strRoot(0)
strRoot(0) = "<LDAP://Domain Controller name/ou=,dc=>;"
 
' Set the filter for computers only
strFilter = "(objectclass=computer);"
strAttrs  = "name;"
strScope  = "subtree"
 
' Your domain name like example above would be .MyDomainControler.net
strDNSSuffix = ""
 
'This is your main loop, each time a different OU.
For i = 0 To UBound(strRoot)
    strBase   =  strRoot(i)
    Set objConn = CreateObject("ADODB.Connection")
    objConn.Provider = "ADsDSOObject"
    objConn.Open "Active Directory Provider"
    Set objRS = objConn.Execute(strBase & strFilter & strAttrs & strScope)
    objRS.MoveFirst
	 
	Dim count
	count = 0
	ComputerCounter = 0

	WriteToLog MasterLogFile, "Starting The script"
	 
	'This is your inner loop, each time an individual PC found in the search of the base.
	Do while not objRS.eof
		ComputerCounter = ComputerCounter + 1
		If count < RunForXPCOnly OR RunForXPCOnly = -1 THEN

			WriteToLog MasterLogFile, "Starting machine #" & ComputerCounter & ". """ & objRS.Fields("name").Value & """."
				
			' Read Sophos Log File and Move Back to original location if it doesn't exist
			IF TriggerFindAndMoveFile = True THEN
				SearchSophosLogAndMoveFileBack(objRS.Fields("name").Value)
				WScript.Sleep 2000
			End IF
				
			' Restart PC
			IF TriggerRestart = True THEN
				WriteToLog MasterLogFile, "Restarting '" & objRS.Fields("name").Value & "' now"
				ShutDownComputer(objRS.Fields("name").Value & strDNSSuffix)
				WScript.Sleep 2000
			END IF
			
			WriteToLog MasterLogFile, "Complete for " & objRS.Fields("name").Value & " -- Found: " & ComputerFoundFileCounter & ", Moved: " & ComputerMoveFileCounter & ", Can't Move:" & CantMoveFountCounter & "."
			count = count + 1
			
		End If
		objRS.MoveNext					 

	Loop
	    
	objRS.Close
    Set objRS = Nothing
	 
	objConn.Close
    Set objConn = Nothing	 
Next

WriteToLog MasterLogFile, "Stopping The script"
WScript.Echo "I'm Done."

' End of Script

'
' Starting all Sub Functions
'

Sub SearchSophosLogAndMoveFileBack(byval strComputer)
	
	ComputerMoveFileCounter = 0
	ComputerFoundFileCounter = 0
	CantMoveFountCounter = 0
	
	Dim PC
	Dim OneLine
	Dim Loc1,  Loc2, Loc3, Loc4, FindText, StartFromDate
	Dim FileSource, FileDest

	PC = "\\" & strComputer & "\"
	LogFileName = LogFileDirectory & strComputer & ".txt"
	
	StartFromDate = "20120919"
	FindText = "has been moved to"

	FileName = PC & "C$\ProgramData\Sophos\Sophos Anti-Virus\logs\SAV.txt"

	Const ForReading = 1
	Const TristateUseDefault = -2

	Set objFSO = CreateObject("Scripting.FileSystemObject")
	
	IF (ObjFso.FileExists(FileName)) THEN		
		Set objFile = objFSO.OpenTextFile(FileName, ForReading, False, TristateUseDefault)

		Dim arrFileLines()
		i = 0

		Do Until objFile.AtEndOfStream
			Redim Preserve arrFileLines(i)
			arrFileLines(i) = objFile.ReadLine
			i = i + 1
		Loop
		objFile.Close
		
		' GET EV Variable
		Dim EV_ALLUSERSPROFILE, ALLUSERSPROFILE_Loc		
		Set oShell = CreateObject( "WScript.Shell" )
		EV_ALLUSERSPROFILE = oShell.ExpandEnvironmentStrings("%ALLUSERSPROFILE%")
		ALLUSERSPROFILE_Loc = "C:\Documents and Settings\All Users"

		For Each strLine in arrFileLines
			OneLine = strLine
			IF (InStr(OneLine, FindText) > 0 and Mid(OneLine, 1, 8) >= StartFromDate) THEN
					Loc1 = InStr(OneLine, """")
					Loc2 = InStr(Loc1 + 1, OneLine, """")
					Loc3 = InStr(Loc2 + 1, OneLine, """")
					Loc4 = InStr(Loc3 + 1, OneLine, """")
					
					FileSource = Mid(OneLine, Loc3 + 1, Loc4 - Loc3 - 1)
					FileDest =  Mid(OneLine, Loc1 + 1, Loc2 - Loc1 - 1)
					
					IF (InStr(FileDest, ALLUSERSPROFILE_Loc) > 0) THEN
						FileDest = Replace(FileDest, ALLUSERSPROFILE_Loc, EV_ALLUSERSPROFILE)
					END IF				

					FileSource = PC & Replace(FileSource, ":", "$")
					FileDest = PC & Replace(FileDest, ":", "$")	
					
					MoveFile FileSource, FileDest
			End IF			
		Next
	END IF 
End Sub

Sub MoveFile (byval FileFrom, byval FileTo)
	
	Set ObjFso1 = CreateObject("Scripting.FileSystemObject")	

	WriteToLog LogFileName, "Found File -- """ & FileFrom & """ --- To --- """ & FileTo & """"
	ComputerFoundFileCounter = ComputerFoundFileCounter +1 
	
	IF (ObjFso1.FileExists(FileFrom) AND ObjFso1.FileExists(FileTo) = false)  THEN
		'WScript.Echo "-- Moving " & FileFrom & " --- To --- " & FileTo
		
		IF (InStr(FileTo, WindowsDirectory) > 0) Then
			WriteToLog LogFileCantMove, "Can not moving file -- """ & FileFrom & """ --- To --- """ & FileTo & """"	
			CantMoveFountCounter = CantMoveFountCounter + 1
		Else
			MakeSureFolderExist FileTo
			ObjFso1.MoveFile FileFrom, FileTo

			' Log file to move
			WriteToLog LogFileName, "Moving -- """ & FileFrom & """ --- To --- """ & FileTo & """"
			ComputerMoveFileCounter = ComputerMoveFileCounter + 1
		End If
	End If		

End Sub

Sub WriteToLog (byval FileName, byval Message)
	
	Dim filesys, filetxt
	Set filesys = CreateObject("Scripting.FileSystemObject")
	Set filetxt = filesys.OpenTextFile(FileName, ForAppending, True) 
	GetCurrentDateTimeString()
	filetxt.WriteLine(currentDateTime & " -- " & Message)
	filetxt.Close
	set filesys = Nothing
	
End Sub

Sub ShutDownComputer(byval strComputer)
    Dim strShutDown,objShell
 
     ' Your psshutdown command with the following options: -r for reboot, -f for force, -c allow the user to cancel the shutdown, -t 300 to give the user
    strShutDown ="C:\PSTools\psshutdown.exe -r -f -c -t 15 -e p:0:0 -m " & chr(34) & "Restart of computer for update" & chr(34) & " \\" & strComputer
	 
     Set objShell = CreateObject("WScript.Shell")
     objShell.Run strShutdown, 0, False
 
     Set objShell = Nothing
End Sub

Sub CreateLogDirectoryAndFile()
	GetCurrentDateTimeString ()

	LogFileDirectory = LogFileDirectory & currentDateTime & "\"
	If Not objFSOLog.FolderExists(LogFileDirectory) Then
	  objFSOLog.CreateFolder LogFileDirectory
	End If

	MasterLogFile = LogFileDirectory & "MasterLog.txt"
	LogFileCantMove  = 	LogFileDirectory & "CantMoveFiles.txt"	
End Sub

Sub GetCurrentDateTimeString()
	currentDateTime = Year(Now) & "-" & Month(Now) & "-" & Day(Now) & "-" & Hour(Now) & "-" & Minute(Now) & "-" & Second(Now)
End Sub

Sub MakeSureFolderExist (byval FileName)
	Dim FolderDir, IndexEnd, StartIndex, filesys
	set filesys=CreateObject("Scripting.FileSystemObject")
	
	' set IndexEnd at 5 to skip the "\" in "\\" + Computer_Name
	IndexEnd = 5
	' Start making sure folder exist after reaching the Drive not before
	StartIndex = InStr(FileName, "$") + 2

	Do While (InStr(IndexEnd + 1, FileName, "\")  > 0)
		IndexEnd = InStr(IndexEnd + 1, FileName, "\") 
		FolderDir = Mid(FileName, 1, IndexEnd)
		
		If IndexEnd > StartIndex Then
			If  Not filesys.FolderExists(FolderDir) Then
			   filesys.CreateFolder (FolderDir)
			End If
		End If
	Loop
End Sub

If you would like more info, check out our Bitbucket account BitBucket

Reply

0 Driftmotion over 13 years ago

' If you have any question/comment, please visit https://bitbucket.org/ncta/sophos-fixer

' Copyright (c) 2012 National Cable Telecommunication Association
' Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), 
' to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, 
' and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
' The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
' THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
' FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
' WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Dim strFilter, strAttrs, strScope, strDNSSuffix, strBase
Dim objConn, objRS, objShell,objExec,objFSO,objFile, fileName
Dim objFSOLog, MasterLogFileTxt
Dim currentDateTime, LogFileDirectory, MasterLogFile
Dim ComputerFoundFileCounter, ComputerMoveFileCounter, CantMoveFountCounter, ComputerCounter
Dim LogFileCantMove, WindowsDirectory
Dim TriggerRestart, TriggerFindAndMoveFile, RunForXPCOnly
Dim LogFileName

Const ForReading = 1, ForWriting = 2, ForAppending = 8 

TriggerRestart = False
TriggerFindAndMoveFile = True

'Set RunForXPCOnly to -1 to run on all PC or 10 to run on the first 10 PC
RunForXPCOnly = -1

WindowsDirectory = "C$\Windows\System32\"

Set objFSOLog = CreateObject("Scripting.FileSystemObject")

WScript.Echo "I'm starting. Click Ok to start.  To stop, change the log folder and it will run into error and stop."

LogFileDirectory = "C:\Log\Sophos\"

CreateLogDirectoryAndFile()
  
Set objShell = CreateObject("Wscript.Shell")
 
' List out the OU's you want computers in to be rebooted. Remember, if you add an OU,
' increment the strRoot(x) in *both* places.
' dc is for your domain Controller.  
' ou is your folder directory going backward. 
' IE.  if you have a folder like this \\MyDomainControler.net\Network\Computers\Admin\Test.
' Then LDAP would be something liket his <LDAP://DC-ii/ou=Test,ou=Admin,ou=Computers,ou=Network,dc=MyDomainController,dc=net>;
Dim strRoot(0)
strRoot(0) = "<LDAP://Domain Controller name/ou=,dc=>;"
 
' Set the filter for computers only
strFilter = "(objectclass=computer);"
strAttrs  = "name;"
strScope  = "subtree"
 
' Your domain name like example above would be .MyDomainControler.net
strDNSSuffix = ""
 
'This is your main loop, each time a different OU.
For i = 0 To UBound(strRoot)
    strBase   =  strRoot(i)
    Set objConn = CreateObject("ADODB.Connection")
    objConn.Provider = "ADsDSOObject"
    objConn.Open "Active Directory Provider"
    Set objRS = objConn.Execute(strBase & strFilter & strAttrs & strScope)
    objRS.MoveFirst
	 
	Dim count
	count = 0
	ComputerCounter = 0

	WriteToLog MasterLogFile, "Starting The script"
	 
	'This is your inner loop, each time an individual PC found in the search of the base.
	Do while not objRS.eof
		ComputerCounter = ComputerCounter + 1
		If count < RunForXPCOnly OR RunForXPCOnly = -1 THEN

			WriteToLog MasterLogFile, "Starting machine #" & ComputerCounter & ". """ & objRS.Fields("name").Value & """."
				
			' Read Sophos Log File and Move Back to original location if it doesn't exist
			IF TriggerFindAndMoveFile = True THEN
				SearchSophosLogAndMoveFileBack(objRS.Fields("name").Value)
				WScript.Sleep 2000
			End IF
				
			' Restart PC
			IF TriggerRestart = True THEN
				WriteToLog MasterLogFile, "Restarting '" & objRS.Fields("name").Value & "' now"
				ShutDownComputer(objRS.Fields("name").Value & strDNSSuffix)
				WScript.Sleep 2000
			END IF
			
			WriteToLog MasterLogFile, "Complete for " & objRS.Fields("name").Value & " -- Found: " & ComputerFoundFileCounter & ", Moved: " & ComputerMoveFileCounter & ", Can't Move:" & CantMoveFountCounter & "."
			count = count + 1
			
		End If
		objRS.MoveNext					 

	Loop
	    
	objRS.Close
    Set objRS = Nothing
	 
	objConn.Close
    Set objConn = Nothing	 
Next

WriteToLog MasterLogFile, "Stopping The script"
WScript.Echo "I'm Done."

' End of Script

'
' Starting all Sub Functions
'

Sub SearchSophosLogAndMoveFileBack(byval strComputer)
	
	ComputerMoveFileCounter = 0
	ComputerFoundFileCounter = 0
	CantMoveFountCounter = 0
	
	Dim PC
	Dim OneLine
	Dim Loc1,  Loc2, Loc3, Loc4, FindText, StartFromDate
	Dim FileSource, FileDest

	PC = "\\" & strComputer & "\"
	LogFileName = LogFileDirectory & strComputer & ".txt"
	
	StartFromDate = "20120919"
	FindText = "has been moved to"

	FileName = PC & "C$\ProgramData\Sophos\Sophos Anti-Virus\logs\SAV.txt"

	Const ForReading = 1
	Const TristateUseDefault = -2

	Set objFSO = CreateObject("Scripting.FileSystemObject")
	
	IF (ObjFso.FileExists(FileName)) THEN		
		Set objFile = objFSO.OpenTextFile(FileName, ForReading, False, TristateUseDefault)

		Dim arrFileLines()
		i = 0

		Do Until objFile.AtEndOfStream
			Redim Preserve arrFileLines(i)
			arrFileLines(i) = objFile.ReadLine
			i = i + 1
		Loop
		objFile.Close
		
		' GET EV Variable
		Dim EV_ALLUSERSPROFILE, ALLUSERSPROFILE_Loc		
		Set oShell = CreateObject( "WScript.Shell" )
		EV_ALLUSERSPROFILE = oShell.ExpandEnvironmentStrings("%ALLUSERSPROFILE%")
		ALLUSERSPROFILE_Loc = "C:\Documents and Settings\All Users"

		For Each strLine in arrFileLines
			OneLine = strLine
			IF (InStr(OneLine, FindText) > 0 and Mid(OneLine, 1, 8) >= StartFromDate) THEN
					Loc1 = InStr(OneLine, """")
					Loc2 = InStr(Loc1 + 1, OneLine, """")
					Loc3 = InStr(Loc2 + 1, OneLine, """")
					Loc4 = InStr(Loc3 + 1, OneLine, """")
					
					FileSource = Mid(OneLine, Loc3 + 1, Loc4 - Loc3 - 1)
					FileDest =  Mid(OneLine, Loc1 + 1, Loc2 - Loc1 - 1)
					
					IF (InStr(FileDest, ALLUSERSPROFILE_Loc) > 0) THEN
						FileDest = Replace(FileDest, ALLUSERSPROFILE_Loc, EV_ALLUSERSPROFILE)
					END IF				

					FileSource = PC & Replace(FileSource, ":", "$")
					FileDest = PC & Replace(FileDest, ":", "$")	
					
					MoveFile FileSource, FileDest
			End IF			
		Next
	END IF 
End Sub

Sub MoveFile (byval FileFrom, byval FileTo)
	
	Set ObjFso1 = CreateObject("Scripting.FileSystemObject")	

	WriteToLog LogFileName, "Found File -- """ & FileFrom & """ --- To --- """ & FileTo & """"
	ComputerFoundFileCounter = ComputerFoundFileCounter +1 
	
	IF (ObjFso1.FileExists(FileFrom) AND ObjFso1.FileExists(FileTo) = false)  THEN
		'WScript.Echo "-- Moving " & FileFrom & " --- To --- " & FileTo
		
		IF (InStr(FileTo, WindowsDirectory) > 0) Then
			WriteToLog LogFileCantMove, "Can not moving file -- """ & FileFrom & """ --- To --- """ & FileTo & """"	
			CantMoveFountCounter = CantMoveFountCounter + 1
		Else
			MakeSureFolderExist FileTo
			ObjFso1.MoveFile FileFrom, FileTo

			' Log file to move
			WriteToLog LogFileName, "Moving -- """ & FileFrom & """ --- To --- """ & FileTo & """"
			ComputerMoveFileCounter = ComputerMoveFileCounter + 1
		End If
	End If		

End Sub

Sub WriteToLog (byval FileName, byval Message)
	
	Dim filesys, filetxt
	Set filesys = CreateObject("Scripting.FileSystemObject")
	Set filetxt = filesys.OpenTextFile(FileName, ForAppending, True) 
	GetCurrentDateTimeString()
	filetxt.WriteLine(currentDateTime & " -- " & Message)
	filetxt.Close
	set filesys = Nothing
	
End Sub

Sub ShutDownComputer(byval strComputer)
    Dim strShutDown,objShell
 
     ' Your psshutdown command with the following options: -r for reboot, -f for force, -c allow the user to cancel the shutdown, -t 300 to give the user
    strShutDown ="C:\PSTools\psshutdown.exe -r -f -c -t 15 -e p:0:0 -m " & chr(34) & "Restart of computer for update" & chr(34) & " \\" & strComputer
	 
     Set objShell = CreateObject("WScript.Shell")
     objShell.Run strShutdown, 0, False
 
     Set objShell = Nothing
End Sub

Sub CreateLogDirectoryAndFile()
	GetCurrentDateTimeString ()

	LogFileDirectory = LogFileDirectory & currentDateTime & "\"
	If Not objFSOLog.FolderExists(LogFileDirectory) Then
	  objFSOLog.CreateFolder LogFileDirectory
	End If

	MasterLogFile = LogFileDirectory & "MasterLog.txt"
	LogFileCantMove  = 	LogFileDirectory & "CantMoveFiles.txt"	
End Sub

Sub GetCurrentDateTimeString()
	currentDateTime = Year(Now) & "-" & Month(Now) & "-" & Day(Now) & "-" & Hour(Now) & "-" & Minute(Now) & "-" & Second(Now)
End Sub

Sub MakeSureFolderExist (byval FileName)
	Dim FolderDir, IndexEnd, StartIndex, filesys
	set filesys=CreateObject("Scripting.FileSystemObject")
	
	' set IndexEnd at 5 to skip the "\" in "\\" + Computer_Name
	IndexEnd = 5
	' Start making sure folder exist after reaching the Drive not before
	StartIndex = InStr(FileName, "$") + 2

	Do While (InStr(IndexEnd + 1, FileName, "\")  > 0)
		IndexEnd = InStr(IndexEnd + 1, FileName, "\") 
		FolderDir = Mid(FileName, 1, IndexEnd)
		
		If IndexEnd > StartIndex Then
			If  Not filesys.FolderExists(FolderDir) Then
			   filesys.CreateFolder (FolderDir)
			End If
		End If
	Loop
End Sub

If you would like more info, check out our Bitbucket account BitBucket

Children

No Data