Saving file creates a warning in Chinese characters

[franklin.barrientos]

How do I revert the Chinese warnings into English?

I've made sure my OS is set to English, I've done a complete uninstall/reinstall and also confirmed that my Region is set to English (US). The warnings continue to appear in Chinese when I save any file. Any help would be appreciated. It doesn't appear to be a language setting issue. 

[nelsoncruz · Accepted solution]

We are aware of a script that is attempting to clean out a previous malicious code that was floating around a few months back.  In turn this script is now being saved into files which is why you see that warning. We are in the process of updating the Maya Security Tool to capture this code as well.

For now, one can manually clean things up by deleting a couple of files in your ~/maya/scripts directory.  The two files that generally get created and pass its payload are "vaccine.py" & "userSetup.py"  One can clean up a Maya scene manually by locating and stopping the scriptJob and scriptNode that gets created.

jobs = cmds.scriptJob(lj=True)
for job in jobs:
    if "leukocyte.antivirus()" in job:
        id = job.split(":")[0]
        if id.isdigit():
            cmds.scriptJob(k=int(id), f=True)

script_nodes = cmds.ls("vaccine_gene", type="script")
if script_nodes:
    cmds.delete(script_nodes)

Cheers!

Nelson

[lynn_zhang]

Hi @franklin.barrientos ,

Just checking to see if your problem has been solved. Have you followed the advice from @nelsoncruz above and did it work? If you find it helpful, please click on the "ACCEPT SOLUTION" button in his reply so this helps other users in the community find the solution too. Thanks!

[franklin.barrientos]

Hi @nelsoncruz 

I've removed the two .py files and it appears to have worked. Thank you!

[nelsoncruz]

We have released an updated version of the Security Tools for Maya.
https://apps.autodesk.com/MAYA/en/Detail/Index?id=8637238041954239715

Cheers!

Nelson

[stevkalinowski]

We have our own userSetup.py file in the folder.  Does anyone know if it overwrites or edits the users own userSetup.py file?

We need our own usetSetup.py file so if there's a chance it's been modified then we need to fix it instead of deleting it.

[Anonymous]

for me the scanner solution didnt work so i tried to fix this kind of issue from appearing again in the future:

 https://gist.github.com/Alan-Green337/099acb92649205d63091acd4fd1d41b6

should fix viruses that have nodes named things other than 'leukocyte' or 'vaccine"

[Anonymous]

fixed the broken link from my post above.

https://gist.github.com/Alan-Green337/bd62ab2f98cdfa9772720df3540f111a

please see if functionality akin to this scripts' can be implemented more widely

[pierscoe1]

Can you share any info on what this might have done to my system...

I too have just started getting the chinese character thing...

updated the security tools, and they renamed the two scripts on the users folder.

What else might this have done?!?

[nelsoncruz]

This particular issue does not harm anything on the system side of things.  It look's like someone was building a tool to clean up the files from some previous malicious code.  Unfortunately, because of the way this tool was built it it self began to spread in files. 

[pierscoe1]

Thanks for the response.

Next issue - the Security Tools have fixed most of my infected files... but for one particular file, when I click "attempt to fix" it then just pops up a dialogue saying "quit without saving"...  and that's the only option I get, meaning I can't open that file...

How do I get around this?

[nelsoncruz]

Hey, If its an ASCII file than you can open the file in a text editing application like notepad.  Attempt to locate the following lines

createNode script -n "vaccine_gene"

createNode script -n "breed_gene"

If you do locate these, delete them and the following 5 lines.  they are to long to paste here but should look like:

createNode script -n "vaccine_gene";
rename -uid "359C899E-48A0-5564-D7F1-60BFC33E0FBD";
addAttr -ci true -sn "nts" -ln "notes" -dt "string";
setAttr ".b" -type "string" "a lot of code here"
setAttr ".st" 1;
setAttr ".stp" 1;
setAttr ".nts" -type "string" "a lot of code here"

createNode script -n "breed_gene";
rename -uid "2713E645-49E9-21E1-A556-4B92D69E7F4A";
setAttr ".b" -type "string" "a lot of code here";
setAttr ".st" 1;
setAttr ".stp" 1;

As to why the file is not cleaning?  Hard to say without looking at it but if there is references in the scene, than we automatically shutdown Maya as we cannot clean up all the referenced scenes.  If the above fails I can have a look at the file and give it a go.  

[pierscoe1]

thanks for the tip... 

sadly it's not an ma.  It's an mb.

It does have references in it, but so do a bunch of other files I've tried, which have been fine...  and they're all pointing to the same references (afaik - difficult to be sure when I can't open the file at all)

[stevkalinowski]

Just a tip for anyone trying to solve this themselves because the Security Tools don't really help.  The callback "MSceneMessage.kAfterOpen" fires before the script node executes, so if you add a cleanup function on that callback you can delete the 2 script nodes before they execute.

[Anonymous]

the script I posted above does just that and fixes this problem entirely.

embedded references wont get fixed by the Maya Scanner Tool, because that tool just gives up and tells the user to quit Maya.

[tig5]

Here's what finally worked for me.

I had let the problem go for a while, so that pesky script had been added to many scene files. This is how I eradicated them all.

1. Open Maya and select File > Open Scene... Option Box. Make sure "Execute script nodes" is unchecked.

2.  Open your scripts directory  and delete

• userSetup.py
• vaccine.py
• vaccine.pyc
• there may also be files that maya security plugin renamed, but similar. I deleted them also.

3. This is where you remove the scripts from each Maya scene file. I had quite a few to open. For each scene that is infected with the script, open in Maya (because "Execute script nodes" is unchecked, it won't keep spreading) and open the Expression Editor.

Once open, select "By Script Node Name".

If those little scripts are hiding in your scene, they will show up here as breed_gene and vaccine_gene. Simply delete them, save your scene, and repeat for your other Maya scenes that you think may be infected. 

Hope that works for you too. 🙂

[Anonymous]

Thank you for the quick tut on fixing this. I'm running into an issue though. When I try to save the file after deleting the scripts, they return as soon as I save and the Warning in Chinese pops up again. 

[tig5]

No trouble at all. This little script has spread everywhere and it's become really challenging to keep it out of sharing files or working with a team. Just remember it's completely safe and doesn't do anything bad. I know it's annoying though, so one more thing you can try is search your computer for any of those files to see if they're in another script folder.
userSetup.py
vaccine.py
vaccine.pyc
there may also be files that maya security plugin renamed, but similar. I deleted them also.

How that helps and I know the security team is working on an update to get rid of it automatic. So soon hopefully 🙂

[e.rodriguesJX4E6]

Thank you so much for this

[wachsga]

what if it doesn't delete them? clicking it but nothing is happening. thank you for taking the time to write all this out by the way.