How to find a file on the basis of a string

[imani]

Can anybody tell me the code to find a file on the basis of this string

shell\open\Command=RavMon.exe

[PsaltyDS]

Can anybody tell me the code to find a file on the basis of this string

shell\open\Command=RavMon.exe

What's the context for that entry? There used to be a "Reliable AntiVirus (RAV)" from a Romanian company with that executable name, but it was embraced by Microsoft in 2003 and probably extinguished.

Then, there's the W32/Rjump.worm:

Method of Infection -

W32/Rjump.worm lists all mapped and removable storage drives on an infected system and drops the following files onto the root folder of the available drive:

* autorun.inf --> used to autorun the worm when the drive is accessed

* msvcr71.dll --> Clean Microsoft Visual Studio dll file

* ravmon.exe --> copy of the worm

The contents of the autorun.inf are as follows:

[AutoRun]

open=RavMonE.exe e

shellexecute=RavMonE.exe e

shell\Auto\command=RavMonE.exe e

shell=Auto

Infection occurs when a removable storage device or a mapped drive hosting a copy of W32/Rjump.worm is accessed and the user agrees to the auto run prompt for execution of the worm.

[Paulie]

Perhaps he has the worm and is trying to get rid of it?

In that case, it would have been more convincing if he had said "I have a worm and i want to delete it"

[imani]

Perhaps he has the worm and is trying to get rid of it?

In that case, it would have been more convincing if he had said "I have a worm and i want to delete it"

Yes I want to detect the autorun.inf file on the basis of this string to get rid of those virus files

[imani]

Yes I want to detect the autorun.inf file on the basis of this string to get rid of those virus files

Anybody can reply me

[smashly]

Hi,

Maybe look in the registry, I'm only guessing at this though ...

$Def = RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RavMon.exe\", "")
MsgBox(0,'', $Def)

Cheers

[Tripredacus]

Well, Windows has the ability to search for strings already. My question would be is it possible to create a faster search for strings in AutoIT?

[imani]

Well, Windows has the ability to search for strings already. My question would be is it possible to create a faster search for strings in AutoIT?

I have found the code

$file = FileOpen("autorun.inf",0)
While 1
    $line = FileReadLine($file)
    If @error = -1 Then ExitLoop
    ;MsgBox(0, "Line read:", $line)
    If $line = "shell\open\Command=RavMon.exe" Then 
        MsgBox(16,'','Virus Found in the file')
        ExitLoop
        EndIf
Wend

FileClose($file)