Shh/Updater-B False positives - Script to restore moved files not working on Windows 7

HI,

Can you see that the files which were moved are in the INFECTED directory with the .000 extension? Worth checking they are there.  

Using the SAV.txt log from the machine, can you see where the files were and their new entry in the INFECTED folder with the .000 extension?

Can you, when logged in as the same user you're running the script as, move the file from the INFECTED folder to the original location and restore the original extension?

This manual operation would at least replicate roughly what the script is doing and check that your account can revert the files.

Regards,

Jak

Do you have the SAV.txt from a computer you are getting this, so I can take a look at the log file, to ensure the script can process it as expected?  

Hi,

To simplify the script, incase it's choking on the detection of the right line, how about just the following

' Script to copy back files identified as infected using the SAV log files.
' It will parse all files called SAV* in the SAV log directory for copy actions
' by default logs to: "\Users\[User]\AppData\Local\Temp\CopyFilesBack.txt" or
' \documents and settings\[User]\Local Settings\Temp\CopyFilesBack.txt" depending on OS.
const WOW_KEY         = "Wow6432Node"
const FOR_READING     = 1
const MESSAGE_STRING  = "has been moved to"
const SAV_LOG_PRE_FIX = "SAV"


dim strWow6432Node, strLogPath, objFSO, objFile, strLogFileName
dim strSAVLogLocation, strSAVLogLocationDir, strRes, objLogFile, strRegPath
strLogFileName  = "CopyFilesBack.txt" 'Lines contain the text in the constant "MESSAGE_STRING"

'Setup global objects
set objFSO  = CreateObject("Scripting.FileSystemObject")
'Get script log file location to write to
strLogPath  = GetLogLocation() & "\" & strLogFileName
set objLogFile = objFSO.CreateTextFile(strLogPath, true)
WriteToLog 0, "Starting script to recover quarantined files where: log contains the line: '" & MESSAGE_STRING
strWow6432Node   = "\"
if Is64(".") then
    strWow6432Node = "\" & WOW_KEY & "\"
 WriteToLog 0, "64-bit machine."
else
    strWow6432Node = "\"
 WriteToLog 0, "32-bit machine."
end if
strRegPath = "HKEY_LOCAL_MACHINE\SOFTWARE" & strWow6432Node & "Sophos\SAVService\Application\LogDir"
strRes = GetKey(strRegPath)
if strRes = "0" then
 WriteToLog 1, "Failed to get SAV log location from registry."
    WriteToLog 1, "Exiting script."
 wscript.quit (1)
else
 WriteToLog 0, "Read the SAV log location from registry."
end if
strSAVLogLocationDir = strRes
WriteToLog 0, "Location of log directory: " & strSAVLogLocationDir
'For each file starts with 'SAV_LOG_PRE_FIX'
WriteToLog 0, "For each file in the directory that starts '" & SAV_LOG_PRE_FIX & "'."
set objFolder = objFSO.GetFolder(strSAVLogLocationDir).files
intFound = 0
for each SAVFile in objFolder
 if instr(SAVFile.name, SAV_LOG_PRE_FIX) > 0 then
  
  set objFile = objFSO.OpenTextFile (strSAVLogLocationDir & "\" & SAVFile.name, FOR_READING, false, -1)
  WriteToLog 0, "=================Processing: '" & SAVFile.name & "'========================"
  
  do While objFile.AtEndOfStream <> true  
   strLineIn = trim(objFile.ReadLine)
 

    if (instr (strLineIn, MESSAGE_STRING) > 0)  then
       'Interested in the lines as it matches our requirements.
     arrOfLine = split(strLineIn, """")
    
     strOrigFilePath = trim (arrOfLine(1))
     strNewFilePath  = trim (arrOfLine(3))
      
     WriteToLog 0, strOrigFilePath & " -> " & strNewFilePath
	 
     if CopyFileBack (strNewFilePath, strOrigFilePath) then
      WriteToLog 0, "File restored."
     else
      WriteToLog 0, "File restore failed."
     end if
    end if  
 
   
  loop
 end if
next
'***********************************************************************************************************
WriteToLog 0, "Script finished."

set objFolder  = nothing
set objLogFile = nothing
set objFSO     = nothing

'***********************************************************************************************************
'Functions
'***********************************************************************************************************
Function GetLogLocation()
 
 on error resume next
 Set objTempFolder = objFSO.GetSpecialFolder(2)
 if objTempFolder = "" then
  GetLogLocation = "C:\windows\temp\" 'Set to Windows temp if can't get the dir.
 else
  GetLogLocation = objTempFolder
 end if
 
 Set objTempFolder = nothing
 
End function
'***********************************************************************************************************
'***********************************************************************************************************
Function CopyFileBack (strCurrentLocation, srcOrigLocation)
 
 WriteToLog 0, "-->CopyFileBack()"
 
 on error resume next
 err.clear
 
 If objFSO.FileExists(strCurrentLocation) Then
  WriteToLog 0, "File exists: " & strCurrentLocation & " attempt to copy back to: " & srcOrigLocation
  objFSO.moveFile strCurrentLocation, srcOrigLocation
  
  if err.number <> 0 then
   WriteToLog 1, "Failed to copy file: " & err.number & " : " & err.description
   CopyFileBack = false
  else
   CopyFileBack = true
  end if
 
 else
  WriteToLog 1, "Copying file back failed as file " & strCurrentLocation & " doesn't exist."
  CopyFileBack = false
 End If
 
 WriteToLog 0, "<--CopyFileBack()"  
 
End Function
'***********************************************************************************************************

'***********************************************************************************************************
Function Is64(strMachineName)
    WriteToLog 0, "-->Is64(" & strMachineName & ")"
    on error resume next
 
 err.clear
   
 dim objWMIService, objColSettings, strDesc, objProcessor
 
 Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachineName & "\root\cimv2")
 Set objColSettings = objWMIService.ExecQuery ("SELECT AddressWidth FROM Win32_Processor")
 
    if err.number <> 0 then
     WriteToLog 1, "Error Number: " & err.number & " Error Description: " & err.description, 1
       wscript.quit(1)
    end if
   
 For Each objProcessor In objColSettings
  strDesc = objProcessor.AddressWidth
 Next
 
    if strDesc = "32" then
        Is64 = false
    end if
    if strDesc = "64" then
        Is64 = true
    end if
 
    Set objWMIService = nothing
 set objColSettings = nothing
 
    WriteToLog 0, "<--Is64()"
   
End Function
'***********************************************************************************************************

'*********************************************************************************************************** 
Function WriteToLog (strSev, strLogLine)
    dim strToWrite
    strToWrite = ""
   
    select case strSev
        case 0
         strToWrite = "INF: "
        case 1
         strToWrite = "ERR: "
        case else
         strToWrite = "UNKNOWN: "
    end select
   
    objLogFile.WriteLine Date() & " " & Time() & " " & strToWrite & " " & strLogLine
   
End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function GetKey(strPath)
    on error resume next
    dim strPathToLog
 dim objReg
 
 set objReg = wscript.createobject("wscript.shell")
 
    err.clear
    strPathToLog = objReg.RegRead (strPath)
    if err.number = 0 then
        GetKey = strPathToLog
    else
        GetKey = 0
    end if
     
 set objReg = nothing
 
End Function

 This will attempt to move everything back not just the Shh/ detections.

Anything malicious in the QM will be blocked by on-access as it's attempted to be restored so should be fine.  Maybe you only have Shh/ detections in the INFECTED directory so in that case it doesn't matter.

If permissions really are the problem then maybe run the script:

psexec -s cscript updated.vbs

Downloading psexec from: http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

Regards,

Jak