Potential Issues caused by third party MaxScript files - ALC and CRP

[Alfred.DeFlaminis]

Hello all,

Recently there have been some scattered reports of some issues which have been traced back to two third party MaxScripts.  Autodesk has investigated these issues and two articles have been created about this which I wanted to share here. If you are having any issues, please refer to these articles below:

ALC MaxScript article:

A 3rd-party MAXScript (hereafter called "ALC"), can accidentally corrupt 3ds Max software’s settings and be propagated to other MAX files (*.max) on a Windows® system if scene files containing the broken script are loaded into 3ds Max. (The original script seems to have been included with some free 3ds Max scenes that users may have downloaded from various non-Autodesk affiliated online sources.)  Although the MAXScript appears to have been written as a form of copy protection for a commercial plug-in, if affected 3ds Max scene files are distributed and re-opened, they may propagate the corruption problem to other copies of 3ds Max.  (See link for more details.)

--

CRP MaxScript article:

A 3rd-party MAXScript (hereafter called "CRP"), included with some free, online 3ds Max scene files (non-Autodesk affiliated) may corrupt 3ds Max software's settings and can be propagated to other MAX files (*.max) on a PC. This can happen if the scene files are loaded into a corrupted version of 3ds Max, then re-saved. (See link for more details.)  

--

If you are having any trouble with the steps in those articles, please create a new support case by doing the following:

1. Log into your Autodesk Account
2. Go to the upper right-hand corner and click Support > Contact Us > Technical Support, and pick Email.
3. From there, create and submit a new support case for this, with the subject line "ALC MAXScript issue." or "CRP MAXScript issue."  

Your case will be escalated to Technical Support and Autodesk will use best commercial efforts to work with you directly, to help you fix your 3ds Max installation, and restore your affected 3ds Max scene files (if possible). We strongly recommend that you do not open additional scene files on the affected Windows system until the repairs are complete (if possible). 

Thank you and best regards,

[drew.northcott]

It's also worth saving a clean maxstart.max scene in the scenes directory.   We wrote our own script to clean scenes, but it's a case-by-case thing ATM rather than an "auto check on load" solution. 

[denisT.MaxDoctor]

If you have a solution, then show it. You will not get any money, probably, but many people will say thank you. Or it's not enough?

[attilaszabo]

Hi everyone,

I would like to re-assure you that the 3ds Max product team is aware of your needs regarding protection from these 3rd party scripts, and we are taking the steps in that direction. 

Best regards,

[denisT.MaxDoctor]

I'm sure that you are ... but this issue has been known for two years.

---

---

[drew.northcott]

the ALC_fixup_v1_2.ms script is better than ours. Our version just deals with one flavour of the problem. 

There's a link on the bottom of this page. The script is readable before you run it as well,.
3dground.net/article/attention-alc-and-crp-viruses-in-3ds-max-

[denisT.MaxDoctor]

attached file (saved in MAX 2016 version) is infected with CRP scripts. Try to clean it up!

 Ahh... forgot to say - THE VIRUS IS RENDERED HARMLESS OF COURSE

[denisT.MaxDoctor]

all known to me scripts cannot find it. 

[denisT.MaxDoctor]

https://forums.autodesk.com/t5/3ds-max-programming/alc-maxscript-issue/td-p/8243132#

follow the thread

[ubergaga]

Hi, i have an infected file

[ubergaga]

---

@denisT.MaxDoctor wrote:

if someone places an "infected" max file here, I will post a script to fix this file, as well as a script to prevent any feature infection (not encrypted of course)

---

Hi, i have an infected file

[denisT.MaxDoctor]

both 

---

@ubergaga wrote:

---

@denisT.MaxDoctor wrote:

if someone places an "infected" max file here, I will post a script to fix this file, as well as a script to prevent any feature infection (not encrypted of course)

---

Hi, i have an infected file

---

both of them are "CleanBeta", and can be easily fixed as shown: https://forums.autodesk.com/t5/3ds-max-programming/alc-maxscript-issue/td-p/8243132# 

[hagen.deloss]

Hi everyone

I'm happy to say that 3DS Max 2019 update 2 has a built in tool to help clean and protect against the ALC/CRP issue. For further information on update 2, you can take a look at the release notes here, and a more in depth explanation of the tools here.

For those of you that are still encountering this issue outside of 2019, there is a app store download solution coming soon, development hasn't announced a date for that release yet. In the meantime, message me for the cleaning scripts until that download is available.

Thanks everyone!

[denisT.MaxDoctor]

I hope it's an open source solution. Otherwise, it will start a harmful competition - "Hype the Autodesk", where people will be specially writing some Malicious Code to deceive your "universal" Security Tools.

[attilaszabo]

Hi @denisT.MaxDoctor,

The solution we shipped is Maxscript based and the code is not encrypted.

You can review it in <maxroot>\ApplicationPlugins\3dsMaxSecurityTools\Contents\Win64\Scripts.

The 3ds Max Security Tools in Max 2019 Update 2 are not a fool-proof, or universal solution to the fact that Maxscript code can be saved in Max scene files. It is simply a detection and cleanup tool for ALC and CRP aimed at helping all those users who are affected.

We are developing other, more potent, layers of mitigation against code injection through Max scene files.

Best regards,

-Attila

[denisT.MaxDoctor]

---

@attilaszabo wrote:

The 3ds Max Security Tools in Max 2019 Update 2 are not a fool-proof, or universal solution to the fact that Maxscript code can be saved in Max scene files. It is simply a detection and cleanup tool for ALC and CRP aimed at helping all those users who are affected.

We are developing other, more potent, layers of mitigation against code injection through Max scene files.

---

Of course it's a hard-coded solution specifically made for ALC/CRP issue. And my thought it shouldn't be a part of a "Security Tools" (which sounds like "universal"). It would be much straightforward to provide a MAX scene parser (which is asked for many years by advanced max tools developers) . With this parser it will be way easier to find any malicious or suspicious data in max file before opening (loading) it. Am I wrong?

[denisT.MaxDoctor]

---

@attilaszabo wrote:

The solution we shipped is Maxscript based and the code is not encrypted.

You can review it in <maxroot>\ApplicationPlugins\3dsMaxSecurityTools\Contents\Win64\Scripts.

---

I've just looked at the contents of "Security Tools" ... Are you serious?

"If in any problem you find yourself doing an immense amount of work, the answer can be obtained by simple inspection." (Murphy's Laws)

~ 2.5K lines of code just to "cure" absolutely incidental cases?
I got the impression that you did not even understand the mechanism of spreading the virus.

"You have attributed conditions to villainy that simply result from stupidity." (Robert A. Heinlein, "Logic of Empire" )

I already said that these are not viruses per se. The authors of these "scripts" did not set themselves the task of concealing the mechanism of protection (as they thought) of their tools. They just did it, but made it sloppy and messy!

Instead of first letting you infect the system, and then try to cure it, simply do not start the infected files. To find the infection in the file needs just a dozen lines of code (which I have already shown).

[akshay.3ds]

Hello Hagen,

We are also facing this ALC and CRP issue, and its eating all of our files rapidly . 
Can you please help us by sharing that cleaner file .

please share link on design.thinkn3d@gmail.com

It would be very helpful ,

Thanks and Regards ,

Akshay

[hagen.deloss]

Hi @akshay.3ds

I just sent you a private message with the requested cleaning scripts. Let me know if you have trouble accessing the files, or if you have trouble using the tools 😄

[j2cervin]

We managed to prevent a further spreading by blocking write access to the 'startup' folder that usually houses the scripts.  This buys us time until we can figure out just what the damage was to the files and clean them all.  However, this may have some other consequences depending on some plug ins that you use (although I have noticed no issues so far).  You may need to manually unblock it if you need to install certain scripts.    

[attilaszabo]

Hi @denisT.MaxDoctor,

When 3ds Max saves the scene, it asks all plugins to save their data. 

Although they have to respect some basic rules, it's up to them what they save, how they save it, and how they load it.

Therefore we can't provide a fool-proof way to parse a Max scene file.

I hope this helps,

-Attila