|
General Information
This is a sample batch file that uses two scanners (McAfee and F-Prot).
The batch file was contributed by maga in the XWall forum at http://xwall.us/phpBB2/viewtopic.php?t=1592
Note: If both scanners fail, the mail is passed on unscanned . In this case, an error flag file is written to the XWall directory.
Just copy the files to your XWall directory and change the hardcoded directory names to your needs.
Listing of mscan.bat
@echo off
if '%2'=='' goto USAGE
:1
"C:\FProt\fpcmd.exe" "%1" -dumb -noboot -nomem -server -archive=5 -packed -report="%2"
if errorlevel 10 goto 2
if errorlevel 9 goto 2
if errorlevel 8 goto 2
if errorlevel 7 goto 2
if errorlevel 6 goto 2
if errorlevel 5 goto 2
if errorlevel 4 goto 2
if errorlevel 3 goto FOUND1
if errorlevel 2 goto 2
if errorlevel 1 goto 2
rem F-Prot fpcmd.exe result codes
rem 0 Normal exit. Nothing found, nothing done.
rem 1 Unrecoverable error (e.g., missing virus signature files).
rem 2 Selftest failed (program has been modified).
rem 3 At least one virus-infected object was found.
rem 4 Reserved, not currently in use.
rem 5 Abnormal termination (scanning did not finish).
rem 6 At least one virus was removed.
rem 7 Error, out of memory.
rem 8 At least one suspicious object was found.
rem 9 At least one object was not scanned (encrypted file, unsupported/unknown
rem compression method, unsupported/unknown file format, corrupted or invalid file).
rem 10 At lest one archive object was not scanned (contains more then N levels of
rem nested archives, as specified with -archive switch).
:2
"C:\Program Files\Common Files\Network Associates\Engine\Scan.exe" "%1" /ALL /NOBEEP /ANALYZE /UNZIP /NOMEM /PROGRAM /NOBOOT /MIME /REPORT "%2"
if errorlevel 15 goto ERROR
if errorlevel 13 goto FOUND2
if errorlevel 12 goto ERROR
if errorlevel 10 goto ERROR
if errorlevel 8 goto ERROR
if errorlevel 6 goto ERROR
if errorlevel 2 goto ERROR
rem McAfee scan.exe Scan result codes
rem 0 The scanner found no viruses or other potentially harmful software, no errors.
rem 2 Integrity check on DAT file failed.
rem 6 A general problem occurred.
rem 8 Scanner was unable to find a DAT file.
rem 10 A virus was found in memory.
rem 12 The scanner tried to clean a file, the attempt failed, file is still infected.
rem 13 The scanner found one or more viruses or hostile objects — such as a
rem Trojan-horse program, joke program, or test file.
rem 15 The scanner’s self-check failed; the scanner may be infected or damaged.
goto END
:FOUND1
rem F-Prot report file %2 already contains "Infection: "
exit 1
goto END
:FOUND2
rem Replace McAfee "Found: " in report file %2 with F-Prot "Infection: "
cscript.exe "d:\xwall\replace.vbs" "%2" "Found: " "Infection: "
exit 1
goto END
:ERROR
echo Virus Scan Error!
type "%2"
echo Virus Scan Error! >d:\xwall\_ERROR.TXT
type "%2">>d:\xwall\_ERROR.TXT
rem net stop xwall /y
rem pause
goto END
:USAGE
echo Usage: %0 [FILE] [TEMPFILE]
echo [FILE] File to scan
echo [TEMPFILE] Report file
rem pause
:END
Listing of replace.vbs convert McAfee report to F-Prot format:
Source: http://www.microsoft.com/technet/scriptcenter/resources/qanda/feb05/hey0208.mspx
Usage: cscript replace.vbs "C:\Scripts\Text.txt" "Jim " "James "
Const ForReading = 1
Const ForWriting = 2
strFileName = Wscript.Arguments(0)
strOldText = Wscript.Arguments(1)
strNewText = Wscript.Arguments(2)
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile(strFileName, ForReading)
strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, strOldText, strNewText)
Set objFile = objFSO.OpenTextFile(strFileName, ForWriting)
objFile.WriteLine strNewText
objFile.Close
Listing of Parsereport.vbs optimized for F-Prot (thanks, Freedom):
Source: http://xwall.us/phpBB2/viewtopic.php?t=1213
Option Explicit
Const OpenAsASCII = 0
Const OpenAsUnicode = -1
Const OverwriteIfExist = -1
Const FailIfExist = 0
Const OpenAsDefault = -2
Const CreateIfNotExist = -1
Const FailIfNotExist = 0
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
Dim szSourceFile, szTargetFile, fsFileSys, hSource, hTarget, szSourceLine, szUnique
Dim szTargetLine, iPos, iSkip, j
szSourceFile = Wscript.Arguments(0)
szTargetFile = Wscript.Arguments(1)
szUnique = "Infection:" 'Unique string that appears in the report immediately before the Name of the Virus is reported
iSkip = 18 'Number of lines you can always skip at top of scanner output file
Set fsFileSys = CreateObject("Scripting.FileSystemObject")
Set hSource = fsFileSys.OpenTextFile(szSourceFile, ForReading, FailIfNotExist, OpenAsASCII)
Set hTarget = fsFileSys.CreateTextFile(szTargetFile, OverwriteIfExist, OpenAsASCII)
For j = 1 to iSkip
hSource.SkipLine
Next
Do While Not hSource.AtEndOfStream
szTargetLine = ""
szSourceLine = hSource.ReadLine
iPos = InStr(1, szSourceLine, szUnique, vbTextCompare)
If iPos > 0 Then
szTargetLine = Mid(szSourceLine, iPos + 11)
hTarget.WriteLine szTargetLine
End If
Loop
hSource.Close
hTarget.Close
Set fsFileSys = Nothing
XWALL.INI entries to use with this batch:
VirusScanner=d:\xwall\mscan.cmd
VirusScannerPara=<FILE> <TEMPFILE>
VirusPostScanner=ParseReport.vbs
VirusPostScannerPara=<TEMPFILE> <MSGFILE>
|
