!Attention! - Virus in 3ds Max Stocks models!! Read article!!!

[Misha]

http://3dground.net/article/attention-alc-and-crp-viruses-in-3ds-max-

[Rimas]

Huh. I'm clean on my machine, yet I do use a lot of downloaded models. Fingers crossed I never comes across this.

[Christa Noel]

people create a mxs virus for 3ds max?? Is that for real??
Bad code in mxs is possible to corrupt a scene but deliberately do that.. what are the benefits?
no body use mxs to steal something even with custom attribute

[romullus]

Even if it has no real purpose and was created just for fun, the damage it may do to your scenes is very real and it will spread like wildfire if not treated. My max is clean, but i use many free assets from the internet, so i'm quite concerned about that.

[apjasko]

I wonder if something like this was created to spoil pirates from torrenting models from sources like cgpeers.

So am I understanding this correctly - if I download Prune Scene and run it once, it will run at startup from then on, or does it need to be ran every time I open Max?

[Frood]

and run it once, it will run at startup from then on, or does it need to be ran every time I open Max?

Sounds so. I think it just installs a startup script which hooks into #filePostOpen event and checks those global variables. I've created a script testing those vars:

#("AutodeskLicSerStuckCleanBeta","CRP_AScript","CRP_BScript","CRP_WriteAScript","CRP_WriteBScript")

are there any more?

script goes to "scripts\startup" directory, everytime a scene is loaded those vars are tested and you get allerted if one of them is found.


Good Luck


Edit: Removed script, useless meanwhile.

[Misha]

"So am I understanding this correctly - if I download Prune Scene and run it once, it will run at startup from then on, or does it need to be ran every time I open Max?"
If you run it once the prune scene will run automatic on max start

[MastaMan]

Hey guys, Prune Scene updated!
http://3dground.net/prod/prune-scene-2180817

Change Log 2.6.6:

+ Added: New signature worm.3dsmax.crp.bscript
+ Added: Startup scripts protection from injection
+ Added: Repair infected files
* Changed: Start Active Protection without UAC (Admin rights)
* Changed: Improved all signatures for detect modifications

[lupaz]

This is the first time I hear about this.
Is anyone installing the Prune Scene script?
I was trying to find more info about it by googling but it doesn't seem to be a popular topic...So weird.
I have the feeling that I'll get something by installing that script.

[romullus]

I have it installed, didn't notice anything strange. Anyway, if you don't feel comfortable to install unknown scripts, there are official scripts from Autodesk to clean those viruses.
https://knowledge.autodesk.com/support/3ds-max/troubleshooting/caas/sfdcarticles/sfdcarticles/Potential-issues-with-third-party-MAXScript-CRP-switching-to-different-viewport-scene-lights-disappear-or-seem-deleted.html
https://knowledge.autodesk.com/support/3ds-max/troubleshooting/caas/sfdcarticles/sfdcarticles/Scene-file-crashes-corrupts-scene-data-gives-Script-Controller-error-or-no-longer-uses-the-Undo-function.html?st=alc

[lupaz]

Awesome. Thanks man.

[MastaMan]

This is the first time I hear about this.
Is anyone installing the Prune Scene script?
I was trying to find more info about it by googling but it doesn't seem to be a popular topic...So weird.
I have the feeling that I'll get something by installing that script.

These viruses have existed for a long time, but only recently they came from Chinese stocks.
Now many models infected in 3dsky stock. And many people catch this viruses.

Prune Scene installed by many people and have many positive comments.
You can use the cleaners from Autodesk, just read this article http://3dground.net/article/attention-alc-and-crp-viruses-in-3ds-max-
You can find all info about this viruses and how to clean.

[JakubCech]

Hey - the Prune Scene is not working for me - I have ALC virus (helpers) in the scene called "¡¡×ý×û" and "×þ×ü".
Anyway - Prune Scene does not remove those - however ALC_fixup_v1_2.ms does - can you update Prune Scene script?

Jakub

[Thanhluong]

Hallo all,

This is how I delete it. Hope it is useful.

[Frood]

Anyone has some "infected" scene for me? I would like to investigate. It looks to me as if it would be enough to go to customize->preferences->MAXscript and temporarily disable all startup options ("Load Startup Scripts", "Load/Save Scene Scripts", "Load/Save Persistent Globals") before loading such a scene, but I'd like to test.


Good Luck

[MastaMan]

Hey - the Prune Scene is not working for me - I have ALC virus (helpers) in the scene called "¡¡×ý×û" and "×þ×ü".
Anyway - Prune Scene does not remove those - however ALC_fixup_v1_2.ms does - can you update Prune Scene script?

Jakub

Do you use the latest version?
Please install version at least 2.7.5
Get the latest version: http://3dground.net/prod/prune-scene-2180817

[MastaMan]

Hallo all,

This is how I delete it. Hope it is useful.

Really? Do you think is very easy to delete this files and objects?
New objects will be created when you open the new scene, because virus run also from callbacks events!

[MastaMan]

Good news for everyone. In new version Prune Scene 2.7.5 added Selective Scan.
This feature helps to scan for viruses without open the scene. It works really fast. You can scan whole partitions (C:\, D:\) or network paths.

Also added new features, for more info please read manual:

http://3dground.net/manual/prune-scene

[arqrenderz]

Hi MastaMan, we found this piece of s$it virus on our office, is there any woay to batch the process of cleanning up the files ?? and to re-save them automatically?
THX! will glad donate if this is posible (cant re-name hundreds of files ....)

Good news for everyone. In new version Prune Scene 2.7.5 added Selective Scan.
This feature helps to scan for viruses without open the scene. It works really fast. You can scan whole partitions (C:\, D:\) or network paths.

Also added new features, for more info please read manual:

http://3dground.net/manual/prune-scene

[arqrenderz]

Another thing is that we are looking at Procesor usage of 1 core of the system when doing nothing AND 25% of the gpu usage When 3dsmax is doing nothing, so we are thinking this virus is Mining some kind of crypto coin with this virus, this is our thought on this, this would be the reason to write this piece of $hit..

[MastaMan]

Hey - the Prune Scene is not working for me - I have ALC virus (helpers) in the scene called "¡¡×ý×û" and "×þ×ü".
Anyway - Prune Scene does not remove those - however ALC_fixup_v1_2.ms does - can you update Prune Scene script?

Jakub

What version do you use? Please download and install latest version from http://3dground.net

[MastaMan]

Another thing is that we are looking at Procesor usage of 1 core of the system when doing nothing AND 25% of the gpu usage When 3dsmax is doing nothing, so we are thinking this virus is Mining some kind of crypto coin with this virus, this is our thought on this, this would be the reason to write this piece of $hit..

Please send me example of your scene via dropbox for test.
Those viruses that I saw only spoiled scenes.

[nicolas7755]

Does anyone else also have the problem of a super slow scene after using Prune Scene to remove the virus?
It takes up to 5mins to open a file that used to be infected. Same with the Corona Interactve - it takes much longer to start now.

[Ludvik Koutny]

Does anyone else also have the problem of a super slow scene after using Prune Scene to remove the virus?
It takes up to 5mins to open a file that used to be infected. Same with the Corona Interactve - it takes much longer to start now.

You could try this: https://www.sinisoftware.net/index.php?option=com_content&view=article&id=12&Itemid=195

Generally, what you describe happens if there's a high number of certain items 3ds Max often tends to create for no reason, such as retimers.

[romullus]

You could try this: https://www.sinisoftware.net/index.php?option=com_content&view=article&id=12&Itemid=195

Would like to try this, but the way they distribute it... :/

[nicolas7755]

Hi Ludvik

Thanks for your reply. We tried it, but couldn't find anything wrong with the file.
We managed to fix one file by converting the Railclone object to Poly.
In another file, we are still looking for a fix, because there aren't any Railclone objects.

[Frood]

Would like to try this, but the way they distribute it... :/

For the standard max trash you can try "Cleaner" - used it successfully for years. I see it is completely reworked/unitised and now also checks animation layers:

http://www.scriptspot.com/3ds-max/scripts/cleaner?page=1

However 1: It does not check for malware (but you can disable loading scene scripts/globals in the Max preferences)
However 2: I have not tested the newer versions yet (but doing from now on).
However 3: I would still put something like this in the autostart folder because in the daily rush, you do not usually think of running a cleaner script every time you open any asset file.


Good Luck

[romullus]

Thanks, i have some scene cleaner script, which i use when i feel it's necessary. However i was under impression, that this sini forensic tool, is like some magic solution, which it probably isn't :]

[romullus]

By the way, i think i had your animation layers checker in my startup folder for some time, but eventually removed it, because it keep finding and cleaning small amount of anim layers in each scene over and over again. It was very annoying :]

[Frood]

Hehe, like this it happens: small amounts get large amount finally. That's why there are scenes with hundreds of animation layers :) I prefer to keep the corners tidy from beginning.


Good Luck

[Frood]

It was very annoying :]

If you never need animation layers, use this special Romullus-Edition. It does the cleaning in the background without any confirmation (only notification in max listener) :]


Good Luck

[romullus]

Now that's a treatment, a script tailored for me! :] Thank you very much, but i'm affraid to use it. I don't know if i need animation layers or not, because i don't know what those animation layers are in the first place :/

[Frood]

Then you don't need them anyway and you are safe :]

In fact, I asked myself today why we here in the studio should see and confirm those dialogues; because we would like to delete the layers in any case. I've never encountered a max scene using them by purpose, using controller lists + weights is more common. So I removed the confirmations and remembered your pain :)


Good Luck

[romullus]

Ok, i'll take your word for it :]

[Frood]

...usually.


Good Luck ;]

[SiNi_Si]

We have an update for this Virus problem coming out at the end of the day.

Download the free Forensic tool at sinisoftware.com

Si

[romullus]

Finally Autodesk themselves realesed viruses removal tool.
https://apps.autodesk.com/3DSMAX/en/Detail/Index?id=7342616782204846316&appLang=en&os=Win64&autostart=true

[romullus]

Quick update. Autodesk virus removal tool is useless. Today i got max file from big company, which has this tool installed on all its computers, yet the file still had virus in it. I also have this autodesk tool installed, but it did nothing against the virus. Luckily i also have Prune Scene script and it wiped the virus swiftly. Can't trust autodesk :[

[lupaz]

Thanks for the warning!

[James Vella]

I am curious to see if the prune script can remove viruses that the alc/crp scripts cannot - Ive been using these two and found they clean plenty of 3dsmax files Ive received from co-workers (automatically, unlike what its mentioned in the quote - but it does contain the links for the scripts). I have them in my ENU/scripts/startup directory.

https://3dground.net/article/attention-alc-and-crp-viruses-in-3ds-max-

Half way down the page:

You also can use another scripts for fix this problems:
ALC_fixup_v1_2.ms and CRP_fixup_v1_2.ms
But I not recommend to use it because you will need to run them from time to time manually and you can miss the moment when the virus gets into another scene that's very critical for large companies where several people can work with one file. Also there are other modifications of the viruses that these scripts can not fix it!

[arqrenderz]

For me prune scene wont really deal with the virus, it just erasing it from the scene but not from the system, so it will come back again (we did try the manual option and the virus gets created again on some super hidden carpet ) Did you tell autodesk of this? (i know autodesk is the slowest company to adress this type of issues (the "virus" took like a year to be acknowledge, ALSO i havent heard a thing about the virus real intentions, I dont think its just made to mess up 3dsmax scenes, why any one bother to do that, i think its more like cryptos or something like that, just think on all the big farms or workstations that have 3dsmax...

[romullus]

Did you run batch cleaner on your system? Deleting virus from single infected max file is not enough, you need to check and clean all system, otherwise virus will come back the moment you'll open next infected scene. Prune scene can do batch cleaning.

[Leonardo Restrepo]

For me prune scene wont really deal with the virus, it just erasing it from the scene but not from the system, so it will come back again (we did try the manual option and the virus gets created again on some super hidden carpet ) Did you tell autodesk of this? (i know autodesk is the slowest company to adress this type of issues (the "virus" took like a year to be acknowledge, ALSO i havent heard a thing about the virus real intentions, I dont think its just made to mess up 3dsmax scenes, why any one bother to do that, i think its more like cryptos or something like that, just think on all the big farms or workstations that have 3dsmax...

Hey arqrenderz, I am dealing with the same exact thing as you described , I dont want to reinstall 3ds max if there is some solid way to solve it , Did you find find way to erase that viruses?

[arqrenderz]

Hi Leonardo, have you tried autodesk security tools? it comes as an extension or with 3dsmax 2019 and so on. That tool can clean the virus, but i would use it and then reinstall a fresh copy of max

[romullus]

[..] but i would use it and then reinstall a fresh copy of max

I don't think that would change anything - virus is infecting max scenes, not 3ds max program itself.

As for autodesk's cleaning tools, don't want to say anything bad about them, but for me they left some viruses undetected, while prune script cleaned them all.

[MastaMan]

Prune Scene 2.9.1 Released!

- Added virus signature DesireFX CA
- Fixed colors for light theme 3Ds Max
- Added PayPal for support
https://3dground.net/prod/prune-scene-2180817

Enjoy!

[MastaMan]

Prune Scene 3.0.0 Big Update!

In new version added:

- New virus signatures: PhysX Plugin Mfx, Desire FX CA, AlienBrains (mscprop.dll), ALC2
- Multi language interface (English, Russian, Ukrainian, Polish, Vietnamese)
- Batch Disinfect files feature for Selective Scan
- By default clear options in rollout Main are disabled! Choose what you need!
- Updated UI for some rollouts and installer

Full list changes:
+ Added: Multi Language for all interface text: English, Russian, Ukrainian, Polish, Vietnamese (tnx Lukasz Karbowski)
+ Added: Batch Disinfect files feature for Selective Scan
+ Added: New signature for Alienbrains (mscprop.dll) virus (tnx Lukasz Karbowski)
+ Added: New signature for PhysXPluginMfx virus
+ Added: New signature for ALC2 virus (tnx ocgbuluw)
+ Added: Install option for register PruneScene menu in Main DropDown Menu
* Changed: Now all options in rollout Main are disabled by default. You must enable the options you need
* Changed: Updated license window UI
* Changed: Updated About rollout UI
* Changed: Updated License rollout UI
* Changed: Updated Installer UI
* Changed: Improved detection for all signatures
* Changed: Improved stability main script
* Changed: Installer license agreement info
- BugFix: Selective Scan for files with Cyrillic symbols (tnx Daniel Diaz del Castillo Guerrero)
- BugFix: Main Toolbar icon for HiDPI Displays
- BugFix: Fixed small bugs
- BugFix: Installer text background color
- BugFix: Uninstaller not deleted some files
- BugFix: Uninstaller not removed protection from startup files


Download: https://3dground.net/prod/prune-scene-2180817