Background: I was hit by a virus when I connected my Sony Ericsson phone to the the PC. It had ‘rose.exe’ on the root of the phone (which probably came in a TXT message) I don’t know how it got in there, since I don’t normally open TXT messages sent from Internet or strangers. Anyway.
It copied rose.exe onto my C:\ on laptop and then it created .eml and readme.eml in every file and folder. Thank God I don’t use Outlook Express or Outlook, otherwise all of my conacts would have got this virus in the email. Thats it behaviour and worst damage. It creates a …System32\runouce.exe file that runs in the memory and will ride on several OS runtime dll and utilities.
Once I read about it on Internet, I used ‘del /S *.eml’ command which deleted all .eml files. I cleaned the regisrty for ‘runouce.exe’ as well. I found a TrendMicro fix for it and ran it and cleared the virus from the memory.
Current Problem:
Right now, every single htm or html file has atleast 40-50 lines with following string. Its same string and it is inserted at the end of the htm file, that is after or the java script.
Help needed:
If anyone knows Windows scripting, please help me write a script or command that will search all .htm files on a drive and look for this string and delete them.
Like in Unix scripting we use grep, awk and sed. Anyone that can help in this regards, please post here. I know its simple and not that complicated. Thanks in Advance.
