The normalizer is a textbox where files and folder paths can be pasted directly from a log generated by a program (such as RSIT, DDS or Combofix) into to be 'normalized' into a standard script for three common programs used in malware removal (Combofix's CFScript, OTM's OTMI script, Avenger scripts). This makes it easier for the helper to generate deletion scripts by copying and pasting paths directly from a users log.
Pressing the "Normalize" button will automatically standardize the paths into a usable script that can be copied and pasted into a fix. Note that the normalizer function will only work for file and folder paths. It does not work with drivers, services or registry entries (those have to be done manually by the helper).
Below is an example of the normalization process in action:
2009-05-31 19:55 . 2009-04-30 22:59 422 ----a-w-
c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe 2009-05-31 19:55 . 2009-04-30 22:59 16141 ----a-w- c:\users\MUM\AppData\Roaming\BestOn\lego.exe 2009-05-04 13:31 . 2009-05-04 13:31 0 ----a-w- c:\windows\system32\REN6F5D.tmp 2009-04-30 22:58 . 2009-04-30 22:58 120832 ----a-w- c:\users\MUM\AppData\Roaming\Google\vmsclock.exe 2009-06-13 19:27 . 2009-01-15 20:20 -------- d-----w- c:\users\MUM\AppData\Roaming\sdf3535swfd 2009-06-12 01:59 . 2008-02-26 03:45 -------- d-----w- c:\programdata\545jdgssdf57843 |
:files c:\users\MUM\AppData\Roaming\sdf3535swfd c:\programdata\545jdgssdf57843 c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe c:\users\MUM\AppData\Roaming\BestOn\lego.exe c:\windows\system32\REN6F5D.tmp c:\users\MUM\AppData\Roaming\Google\vmsclock.exe |
folder:: c:\users\MUM\AppData\Roaming\sdf3535swfd c:\programdata\545jdgssdf57843 file:: c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe c:\users\MUM\AppData\Roaming\BestOn\lego.exe c:\windows\system32\REN6F5D.tmp c:\users\MUM\AppData\Roaming\Google\vmsclock.exe |
folders to delete: c:\users\MUM\AppData\Roaming\sdf3535swfd c:\programdata\545jdgssdf57843 files to delete: c:\users\MUM\AppData\Roaming\Apple Computer\socks1.exe c:\users\MUM\AppData\Roaming\BestOn\lego.exe c:\windows\system32\REN6F5D.tmp c:\users\MUM\AppData\Roaming\Google\vmsclock.exe |
For some extremely large file lists from certain logs, the normalizer can fail in correctly generating a normalized fix. In this case, the Get Files box can be checked. This will cause the normalizer to stop determining whether the specific entry is a file or a folder and will proceed to just obtain the file paths in text box.