Potential Issues caused by third party MaxScript files - ALC and CRP

[Alfred.DeFlaminis]

Hello all,

Recently there have been some scattered reports of some issues which have been traced back to two third party MaxScripts.  Autodesk has investigated these issues and two articles have been created about this which I wanted to share here. If you are having any issues, please refer to these articles below:

ALC MaxScript article:

A 3rd-party MAXScript (hereafter called "ALC"), can accidentally corrupt 3ds Max software’s settings and be propagated to other MAX files (*.max) on a Windows® system if scene files containing the broken script are loaded into 3ds Max. (The original script seems to have been included with some free 3ds Max scenes that users may have downloaded from various non-Autodesk affiliated online sources.)  Although the MAXScript appears to have been written as a form of copy protection for a commercial plug-in, if affected 3ds Max scene files are distributed and re-opened, they may propagate the corruption problem to other copies of 3ds Max.  (See link for more details.)

--

CRP MaxScript article:

A 3rd-party MAXScript (hereafter called "CRP"), included with some free, online 3ds Max scene files (non-Autodesk affiliated) may corrupt 3ds Max software's settings and can be propagated to other MAX files (*.max) on a PC. This can happen if the scene files are loaded into a corrupted version of 3ds Max, then re-saved. (See link for more details.)  

--

If you are having any trouble with the steps in those articles, please create a new support case by doing the following:

1. Log into your Autodesk Account
2. Go to the upper right-hand corner and click Support > Contact Us > Technical Support, and pick Email.
3. From there, create and submit a new support case for this, with the subject line "ALC MAXScript issue." or "CRP MAXScript issue."  

Your case will be escalated to Technical Support and Autodesk will use best commercial efforts to work with you directly, to help you fix your 3ds Max installation, and restore your affected 3ds Max scene files (if possible). We strongly recommend that you do not open additional scene files on the affected Windows system until the repairs are complete (if possible). 

Thank you and best regards,

[attilaszabo]

---

---

Instead of first letting you infect the system, and then try to cure it, simply do not start the infected files. To find the infection in the file needs just a dozen lines of code (which I have already shown).

---

Detecting whether a scene file has ACL and\or CRP without loading it into 3ds Max is a great goal - we are working on a tool hat will allow users to do just that.

Many users don't have the luxury to discard the corrupted scenes, and therefore these users need a way to remove the corruptions. That can be done only by loading them into 3ds Max. 

The 3ds Max Security Tools detect and remove the corruptions.

I hope this helps,

-Attila

[lukuanenko]

Hey guys Prune Scene already success clean all viruses, protect files in startup folder from injection. 

And has one super feature - scanning viruses on HDD.

And all features are free!

Download: https://3dground.net/prod/prune-scene-2180817

Manual: https://3dground.net/manual/prune-scene#/virus-active-protection

[attilaszabo]

---

Instead of first letting you infect the system, and then try to cure it, simply do not start the infected files. To find the infection in the file needs just a dozen lines of code (which I have already shown).

---

We are working on a tool that detects ACL and CRP without having to load the Max scene file into 3ds Max.

But in order to remove the corruptions from the scene file, we need to load them into 3ds Max.

I hope this helps,

-Attila

[denisT.MaxDoctor]

---

@attilaszabo wrote:

Hi @denisT.MaxDoctor,

When 3ds Max saves the scene, it asks all plugins to save their data. 

Although they have to respect some basic rules, it's up to them what they save, how they save it, and how they load it.

Therefore we can't provide a fool-proof way to parse a Max scene file.

---

this is not true... the truth is that you can't parse "local plugin data". but scene node hierarchy,  custom attributes. materials, modifiers, controllers are accessible (including their names and classes, and in many cases their content like a custom attributes source or script controller expressions). Also there is access to the files persistent globals and callbacks, because this information stored by the system.

[denisT.MaxDoctor]

---

@attilaszabo wrote:

---

---

We are working on a tool that detects ACL and CRP without having to load the Max scene file into 3ds Max.

But in order to remove the corruptions from the scene file, we need to load them into 3ds Max.

---

but also you try to clean the system directory from "miscellaneous" files as you think (for example "vrdematcleanbeta.ms", "vrdematcleanbeta.mse", etc.) . But these files are coming to the system with the installation of "CleanBeta" tools, but not as a result of max file infection.

you unite in one toolset clean up max files, "protection" against infection, restoring infected scripts, and clean the system... And all this is done for only two particular cases.

Of course, this is better than nothing, but does it make sense to call this Security Tools and include it in the system?

[denisT.MaxDoctor]

---

@lukuanenko wrote:

Hey guys Prune Scene already success clean all viruses, protect files in startup folder from injection. 

---

I do not think this is the right place to host self-promotion. But if you want to do good to people, then do not public encrypted, or obfuscated, or simply unreadable scripts. IMHO

[dgs3d]

@hagen.deloss We have been dealing with problems this week and just realized we have infected files. Please,  could you share me the cleaning scripts? Thank you!

[denisT.MaxDoctor]

just read my posts https://forums.autodesk.com/t5/3ds-max-programming/alc-maxscript-issue/td-p/8243132

this is all and enough to clean infected files.

[denisT.MaxDoctor]

---

@attilaszabo wrote:

Hi @denisT.MaxDoctor,

The solution we shipped is Maxscript based and the code is not encrypted.

You can review it in <maxroot>\ApplicationPlugins\3dsMaxSecurityTools\Contents\Win64\Scripts.

The 3ds Max Security Tools in Max 2019 Update 2 are not a fool-proof, or universal solution to the fact that Maxscript code can be saved in Max scene files. It is simply a detection and cleanup tool for ALC and CRP aimed at helping all those users who are affected.

We are developing other, more potent, layers of mitigation against code injection through Max scene files.

Best regards,

-Attila

---

The attached file is 'infected' by "CRP" scripts... Can you fix it?

[lanaasaad111]

Hello, I couldn't find out how to send private messages. Sorry to send it here. I have version 2018 of 3ds max and I have iixxyxu and xpxu. I followed the steps for ALC and I got true. All my files on my computer have this problem. Can you please send me cleaner file? Thanks in advance. 

[hagen.deloss]

Hi @lanaasaad111

I will send you a message right now with next steps 😄

[dgs3d]

when testing on two different machines, we get:

(globalVars.isGlobal #CRP_BScript) FALSE

But whe we check for the other virus (ADSL) 

(globalVars.isGlobal #ADSL_BScript)​ 

we get these messages:

On one machine we get the message:  ¨UNDEFINED¨ 

On another machine we get: 

(globalVars.isGlobal #ADSL_BScript)​
-- Type error: Call needs function or class, got: false
-- MAXScript callstack:
-- thread data: threadID:27024
-- ------------------------------------------------------
-- [stack level: 0]
-- In top-level

Could you help me? Thank you.

[hagen.deloss]

Hi @dgs3d

Hmm, I'm not sure whats going on there, that's a question for @attilaszabo, I will make sure to follow up and get some more insight into this one way or another 😄

[larryminton]

@dgs3d Hmmm..  The 'globalVars.isGlobal' method can only return true or false....  This method is defined in mxsagni.dlx, and has existed since 3ds Max 2008.

I'll message you and see if we can figure out what's going on...

[hagen.deloss · Accepted solution]

Hi everyone,

For anyone that is encountering the ALC/CRP issue in 3DS Max versions 2015, 2016, 2017 or 2018 you can now download Security Tools from the app store!

Here is the link to download the tools.

If you are having issues within 3DS Max 2019: make sure to download the newest update of the software, as it has these features built in (I'm referring to update 2019.2).

If you have issues with the ALC/CRP from older versions of 3DS Max (2014 and previous): please create a support case through the proper channels and a specialist with assist you. 

[denisT.MaxDoctor]

Who did accept this solution?

Are you sure? Did you test it well?

Did you debug install/uninstall?

For example:

-- During installation there is no option to pick MAX version (in case if a user has more than one version)

-- After uninstalling the Security Tools the Missing item stays in Customize menu...

[Anonymous]

Is this in light of the AdskSignTool.exe feature? I have tried to use it, using the provided example, but I just get syntax errors. I copied the following into the listener and tried under MaxScript and Python but seems no matter what I try, it does not do what I believe it is supposed to. The docs do not cover this very well (no surprise there!), so can anyone point me to where I am not using this correctly. As mentioned, the "example" does not really expand on anything (again, no surprise there from the docs), which would be helpful, you know, in being able to understand and use the features.

.\AdskSignTool.exe -verify -marker "--" .\MacroScripts\Macro_BrushPresets.mcr
-- Syntax error: at ., expected <factor>
-- In line: .\A
>>> .\AdskSignTool.exe -verify -marker "--" .\MacroScripts\Macro_BrushPresets.mcr
 File "<console>", line 1
 .\AdskSignTool.exe -verify -marker "--" .\MacroScripts\Macro_BrushPresets.mcr
 ^
SyntaxError: invalid syntax
>>> C:\3dsmax2019x64\3ds Max 2019\AdskSignTool.exe -verify -marker "--" C:\3dsmax2019x64\3ds Max 2019\MacroScripts\Macro_BrushPresets.mcr
 File "<console>", line 1
 C:\3dsmax2019x64\3ds Max 2019\AdskSignTool.exe -verify -marker "--" C:\3dsmax2019x64\3ds Max 2019\MacroScripts\Macro_BrushPresets.mcr
 ^
SyntaxError: invalid syntax
>>> C:\\3dsmax2019x64\\3ds Max 2019\\AdskSignTool.exe -verify -marker "--" C:\\3dsmax2019x64\\3ds Max 2019\\MacroScripts\\Macro_BrushPresets.mcr
 File "<console>", line 1
 C:\\3dsmax2019x64\\3ds Max 2019\\AdskSignTool.exe -verify -marker "--" C:\\3dsmax2019x64\\3ds Max 2019\\MacroScripts\\Macro_BrushPresets.mcr
 ^
SyntaxError: invalid syntax
>>> "C:\\3dsmax2019x64\\3ds Max 2019\\AdskSignTool.exe" -verify -marker "--" "C:\\3dsmax2019x64\\3ds Max 2019\\MacroScripts\\Macro_BrushPresets.mcr"
 File "<console>", line 1
 "C:\\3dsmax2019x64\\3ds Max 2019\\AdskSignTool.exe" -verify -marker "--" "C:\\3dsmax2019x64\\3ds Max 2019\\MacroScripts\\Macro_BrushPresets.mcr"
 ^
SyntaxError: invalid syntax
C:\\3dsmax2019x64\\3ds Max 2019\\AdskSignTool.exe -verify -marker "--" C:\\3dsmax2019x64\\3ds Max 2019\\MacroScripts\\Macro_BrushPresets.mcr
-- Syntax error: at keyword parameter, expected <factor>
-- In line: C:\\

from the not very helpful page:

poor explanation in docs

Where does the .bat file go? Is it run from Maxs folder? The desktop? Mars?

Too much ambiguity in new and old features

[Anonymous]

Just tried the info from the page....

As it does not say which format its to be saved in, what shell or window to type it in, I tried them all. No joy. It really is frustrating to have such poor ambiguous documentation where it seems that you "Just know what to do" mantra is an expectation of a users ability.

C:\3dsmax2019x64\3ds Max 2019>-verify -marker "--" .\MacroScripts\Macro_BrushPresets.mcr 1>.\AdskSignTool.exe
'-verify' is not recognized as an internal or external command,
operable program or batch file.

[attilaszabo]

Open a command prompt, navigate to your installation of Max and run the tool with the -verify and -marker options like below:

D:\Autodesk\3ds Max 2019>AdskSignTool.exe -verify -marker "--" ".\stdplugs\stdscripts\addmodfunc.ms"

The file '.\stdplugs\stdscripts\addmodfunc.ms' has a valid digital signature
Certificate information
Subject : Autodesk, Inc.
Issuer : Symantec Class 3 SHA256 Code Signing CA - G2
Serial Number : 7c6e57205ee95e9978e005e431080610
Expiration : lundi 5 ao¹t 2019 18:59:59

I hope this helps,

Attila Szabo

[attilaszabo]

You need to enclose the path (the last argument) into quotation marks because you have a space in your path.