The Normalizer

 

The normalizer is a textbox where files and folder paths can be pasted directly from a log generated by a program (such as RSIT, DDS or Combofix) into to be 'normalized' into a standard script for three common programs used in malware removal (Combofix's CFScript, OTM's OTMI script, Avenger scripts). This makes it easier for the helper to generate deletion scripts by copying and pasting paths directly from a users log.

Pressing the "Normalize" button will automatically standardize the paths into a usable script that can be copied and pasted into a fix. Note that the normalizer function will only work for file and folder paths. It does not work with drivers, services or registry entries (those have to be done manually by the helper).

Below is an example of the normalization process in action:

Before

2009-05-31 19:55 . 2009-04-30 22:59 422 ----a-w- c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe
2009-05-31 19:55 . 2009-04-30 22:59 16141 ----a-w- c:\users\MUM\AppData\Roaming\BestOn\lego.exe
2009-05-04 13:31 . 2009-05-04 13:31 0 ----a-w- c:\windows\system32\REN6F5D.tmp
2009-04-30 22:58 . 2009-04-30 22:58 120832 ----a-w- c:\users\MUM\AppData\Roaming\Google\vmsclock.exe
2009-06-13 19:27 . 2009-01-15 20:20 -------- d-----w- c:\users\MUM\AppData\Roaming\sdf3535swfd
2009-06-12 01:59 . 2008-02-26 03:45 -------- d-----w- c:\programdata\545jdgssdf57843

After OTMI Script Normalization

:files
c:\users\MUM\AppData\Roaming\sdf3535swfd
c:\programdata\545jdgssdf57843
c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe
c:\users\MUM\AppData\Roaming\BestOn\lego.exe
c:\windows\system32\REN6F5D.tmp
c:\users\MUM\AppData\Roaming\Google\vmsclock.exe

 

After CFScript Normalization

folder::
c:\users\MUM\AppData\Roaming\sdf3535swfd
c:\programdata\545jdgssdf57843
file::
c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe
c:\users\MUM\AppData\Roaming\BestOn\lego.exe
c:\windows\system32\REN6F5D.tmp
c:\users\MUM\AppData\Roaming\Google\vmsclock.exe

 

After Avenger Script Normalization

folders to delete:
c:\users\MUM\AppData\Roaming\sdf3535swfd
c:\programdata\545jdgssdf57843
files to delete:
c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe
c:\users\MUM\AppData\Roaming\BestOn\lego.exe
c:\windows\system32\REN6F5D.tmp
c:\users\MUM\AppData\Roaming\Google\vmsclock.exe

For some extremely large file lists from certain logs, the normalizer can fail in correctly generating a normalized fix. In this case, the Get Files box can be checked. This will cause the normalizer to stop determining whether the specific entry is a file or a folder and will proceed to just obtain the file paths in text box.