Get total infected items from Malwarebytes log

[raptor25]

Hi. I am trying to use a malwarebytes logfile to add up all the infected items and get a total. It seems like they are always found on lines 16-22 in the log:

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Is there a function that will get the last number of each lines 16-22 so that they can be added up for a total?

Thanks

[rcmaehl]

FIleReadLine followed by a StringRegExp should work for you

EDIT: Thanks kaotbliss for noticing the StringRight. StringRegExp is much better in this case however I don't think anyone would really have more than 99 of each Infected Processes/Keys/etc, then again...

Edited October 27, 2011 by rcmaehl

[kaotkbliss]

StringRight is a bad choice because the number can be any number of digits long

StringRegExp would be the better choice

[JohnOne]

Here is a very basic example of what you want, there are many other ways to achieve the same result.

Look at examples of some other functions mentioned and adapt them.

#include <String.au3>                                     ; Include the String UDFs library
#include <Array.au3>                                       ; Include the Array UDFs library for visual purpose
$str = "Memory Processes Infected: 10" & @CRLF _           ; Create a string representation of your file
   & "Memory Modules Infected: 2" & @CRLF _
   & "Registry Keys Infected: 100" & @CRLF _
   & "Registry Values Infected: 6" & @CRLF _
   & "Registry Data Items Infected: 0" & @CRLF _
   & "Folders Infected: 5" & @CRLF _
   & "Files Infected: 2"
$astr = _StringBetween($str, ": ", @CRLF)                 ; Create an array of matches
_ArrayDisplay($astr)                                       ; Just to show what you are dealing with
Local $result = 0                                         ; Create a variable to hold the result
For $i = 0 To UBound($astr) -1                           ; Add array matches via a loop
$result += Int($astr[$i])
Next
MsgBox(0,0,$result)                                     ; Show result

[kaotkbliss]

I stand corrected, stringbetween would be a lot simpler than stringregexp

[raptor25]

Okay. Well I have a log called mbam.txt in the script directory and have tried using stringregexp to get anything with a digit at the end of each line and return an array to just to learn how to use it but I get nothing on this.

$hFile = FileOpen(@ScriptDir & "\mbam.txt", 0)
 
While 1
    $line = FileReadLine($hFile)
    If @error = -1 Then ExitLoop
 
    $text = StringRegExp($line, "[:digit:]$", 3)
 
    For $i = 0 To UBound($text) - 1
         MsgBox(0, 'Info', $text[$i])
    Next
 
Wend
 
FileClose($hFile)

Any suggestions on what I am doing wrong on this?

[JohnOne]

Try this

#include <String.au3>
$hFile = FileOpen(@ScriptDir & "\mbam.txt", 0)
$lines = ''
For $i = 16 to 22
    $lines &= FileReadLine($hFile,$i)
Wend

FileClose($hFile)
$astr = _StringBetween($lines, ": ", @CRLF)               ; Create an array of matches
Local $result = 0                                         ; Create a variable to hold the result
For $i = 0 To UBound($astr) -1                           ; Add array matches via a loop
$result += Int($astr[$i])
Next
MsgBox(0,0,$result)

[raptor25]

Nope. I just get a 0 when I run that one even though there are numbers to add up in the log. (I had to change that Wend to Next for the for loop). Thanks for you help so far though.

[raptor25]

I wonder if the $lines &= FileReadLine($hFile,$i) isn't putting a @CRLF to find to parse it..?

[Melba23]

raptor25,

By using StringRegExp directly you avoid that problem:

#include <Array.au3>                                       ; Include the Array UDFs library for visual purpose
$str = "Memory Processes Infected: 10" & @CRLF _           ; Create a string representation of your file
         & "Memory Modules Infected: 2" & @CRLF _
         & "Registry Keys Infected: 100" & @CRLF _
         & "Registry Values Infected: 6" & @CRLF _
         & "Registry Data Items Infected: 0" & @CRLF _
         & "Folders Infected: 5" & @CRLF _
         & "Files Infected: 2"
$astr = StringRegExp($str, "\d+", 3)                        ; Create an array of matches
_ArrayDisplay($astr)
Local $result = 0                                           ; Create a variable to hold the result
For $i = 0 To UBound($astr) - 1                             ; Add array matches via a loop
    $result += Int($astr[$i])
Next
MsgBox(0, "Result", $result)                                ; Show result

Any better?

M23

P.S.

stringbetween would be a lot simpler than stringregexp

What do you think _StringBetween uses internally?

Take a look inside String.au3!

[kaotkbliss]

Ahh. I've never used StringBetween before and I'm horrible with stringregexp, so my thinking is just entering the 2 characters that surround what you want is a lot easier than formulating an expression to grab the numbers after a :

[Melba23]

kaotkbliss,

I'm horrible with stringregex

My normal response to that is suggest ressions.info/tutorial.html'>this site - the best SRE tutorial I have come across.

Seriously, it is worth getting to grips with SREs - even to the basic level I have managed so far. They can prove extremely useful - and at times they are absolutely essential.

M23

[JohnOne]

I keep threatening to get stuck into regexp, but just wind up staring at the screen like its enigma matrix wrapped in a double helix.

One day.. One day.