Exe and html files with malicious code appended, any easy way to batch-remove them?

Question

I just got hit really bad by a virus that modifies some Windows Services (e.g. BiTS) to execute malicious code, repacks all exe files on the disk with malicious code, and lastly but not least annoyingly, injects a script tag linking an external js file to every html documents on the disk.

This is the summary of the virus. http://www.threatexpert.com/report.aspx?md5=58ab783a36dc1860bdd525a87ddaafd4

I tried a couple of anti-virus suites (avast! being one of them) and I believe the virus itself was wiped out. However the infected files are a bit harder to deal with. None of the anti-virus suites I tried could actually repair the infected files, or they could only offer the option to quarantine or delete them, and this is worse than re-formating which is not an imminent option either. (I have some 2,000 exe files and 20,000 html files infected)

Is there any program that can actually disinfect the infected files? If not,

• is there some kind of program that can compare an original binary file with a modified binary file, and figure out the difference which the user can use to remove such difference in any files that have it?

Thanks

EDIT: I fixed the html documents with Notepad++ using its find/replace function. Now only executables remain to be fixed.

EDIT 2: Used another anti-virus suite which can actually repair the .exe files. Everything is fine now, hopefully. Thanks for the tips!

Answer 1

I've had the same problem, and honestly, concerning the exe-files, I don't think there is any other way then to format and re-install windows.

Concerning the html files, you can use a tool like WinMerge to find all the html files which contain the script block and remove it using a find/replace (that's what I had to do after the re-install, because it also infected all the html files on my external drives).

Answer 2

You might want to connect that infected drive to a computer that doesn't have autoplay enabled. Then run an anti-virus. You can insert the Windows CD and do a repair. That could probably work to fix the windows services. But copy your data off first.

Or if you have a backup, you should just restore from that if it isn't infected.