Remote Approach JavaScript Spy Module in PDF files – early fighter's Toolkit

Posted By: all
Hello, everyone!

Some time ago I have been pointed out that one of my posted PDF files tried to initiate a connect to some IP address. After some investigation, results were published in certain post's comments here and here.
Also numerous publications around internet news/blogs/reviews keep popping around this issue.
Naturally I felt certain responsibility to look for a solution here. Since still no ready tools are available to clean this script off the PDF files I decided to go further and try to remove it myself and publish the results here. I hope that this info will be useful to all posters of this blog who come in touch with this issue.

The problem comes in two varieties - for the one who tries to read the file with this script, and for the one who wants to post a file containing it. In the first case it is enough to use a freeware PDF reader, or acroreader version lower, than 6. Also firewall rule may be created if one chooses this approach. Here I should also point out, that Linux version of acroreader 7 also "calls home", while xpdf is still immune to this script.
Another story is about posting, or rather cleaning the PDF file from the unwanted script. Before describing the procedure I would like to mention, that this method while giving the desired result (the resulting file does not try to connect anywhere), does not represent an optimized or convenient solution for dealing with Remote Approach java script. I also hope, that with time we will see PDF cleaning tools on the scene that will do the work faster and in more elegant way.
As much as I would be tempted to tell you the story of how I arrived at the final procedure, it has no real value, so it will not be revealed. I am sure everyone of you might have done the same.

Ok now, here's the procedure that worked for me:

1. Open the "infected" file with Advanced PDF Tools, go to "optimize" tab and chec the "remove javascript" checkbox. Then hit "change" button and save the new file. Funny thing is that the resulting file cannot be opened by acroreader (Win and Linux version) giving an error message about file being damaged and not being able to repair it. This same file opens in xpdf and foxit reader without a problem.

2. Since we want this new file to be readable also by acroreader (don't we?), open it with VeryPDF editor and (without actually changing anything) simply save it to another file (maybe to the same filename - I did not try that).

3. Now this new file can be opened by acroreader and does not try to connect anywhere, Voila! We have a "clean" file.

This procedure has been tested by me and it works. I also tried several other ways, like opening the scripted file and printing it to third party pdf printer driver, converting it to HTML and TXT and then back to PDF, but earlier described method gave me the "closest to original" results.

And lastly, to make the whole thing easier for all willing to try this temporary remedy, for your convenience here is the archive of tools I used(they may also be easily found on their corresponding homepages).

Have fun, and happy posting ;-)

Your's truly, all.