#50080 - 2000-05-26 08:35 PM
Complete inventory of McAfee virusscan software which is always up-to-date.
|
MCA
KiX Supporter
Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
|
Dear,Many times I see different kind of questions about McAfee virus scanning. In the past our biggest problem was: which engine, which definition file and which netschield edition are active.
- Sometimes people were overrulling the implementation of McAfee's Management Console Edition.
- Sometimes the filetype were changed. Since "VBS/LoveLetter.worm" additional types must at our site always active.
- Sometimes update of definition files were going wrong.
For above reasons we had develop a kixtart script, which creates an up-to-date list of McAfee versions on any PC within our network.
It also recognizes when McAfee software was missing at all. code:
IF setconsole("hide")
ENDIF
;
; NT/95 logging - Kixtart 3.62
;
; (c) scripting@wanadoo.nl - 2000
;
; vs 1.00 - program (McAfee)
;
; 1.00 (20000525) original version
;
$prgrm_version="1.00"
;
; --------------------------------------------------------------------------
; - Site Specific Codes
; -
; - 1. "$file" log McAfee information to specified file.
; - advise: use a hidden directory on server with read + write access.; - 2. "$debug_mode". usefull for kixtar programmers.
; - 3. "$debug_file". log McAfee debug information to specified file.
; --------------------------------------------------------------------------
;
$file="c:\McAfee.lst"
;
$debug_mode="no" ; - no/yes - for additional information about checking registry keys -
$debug_file="c:\McAfee_debug.txt"
;
; --------------------------------------------------------------------------
;
$cr=CHR(10)
$lf=CHR(13)
$eol=$cr+$lf
;
IF (@inwin = 1)
$NT_mode="yes"
ELSE
$NT_mode="no"
ENDIF
IF (len(@ipaddress0) = 0)
$offline_mode="yes"
ELSE
$offline_mode="no"
ENDIF
;
break off
flushkb
;
IF ($debug_mode = "yes")
IF (RedirectOutput("c:\McAfee_debug.txt",1) = 0)
ENDIF
ENDIF ; --------------------------------------------------------------------------
; - -
; -------------------------------------------------------------------------- :script_collect_pc_info $x="" ; - it will contains all kind of information about workstation and server -
; - f.e. 00127_000505_23:23:23 DOMAIN=(NT - vs 1.01 L DOMAIN \\SPLxxxxx) 171.077.077.100 00A02ABABEEE mca SPLzzzzz ('MCA')
$domain=""
$ldomain=""
IF ($NT_mode = "yes")
$ikey="HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
IF (ExistKey($ikey) = 0)
$domain=ReadValue($ikey, "DefaultDomainName")
ENDIF
$ikey="HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
IF (ExistKey($ikey) = 0)
$ldomain=ReadValue($ikey, "CachePrimaryDomain")
ENDIF
ELSE
$ikey="HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSNP2\NetworkProvider"
IF (ExistKey($ikey) = 0)
$domain=ReadValue($ikey, "AuthenticatingAgent")
ENDIF
$ikey="HKEY_LOCAL_MACHINE\Security\Provider"
IF (ExistKey($ikey) = 0)
$ldomain=ReadValue($ikey, "Container")
ENDIF
ENDIF
IF (len($domain) = 0)
IF (len(@ldomain) <> 0)
$domain=@ldomain
ELSE
$domain=@domain
ENDIF
IF (len($domain) = 0)
$domain="~domain" ; - unknown @domain/@ldomain value -
ENDIF
ENDIF
IF (len($ldomain) = 0)
$ldomain=$domain
ENDIF
;
IF ($NT_mode = "yes")
$time_start=@time
$log_info="Kixtart-VIC "+$prgrm_version+" script started"
$log_info=$log_info+" for '"+LCASE(@userid)+"'"
$log_info=$log_info+" ("+$time_start+" - '"+@ipaddress0+"')"
IF logevent(0, 1, $log_info, "", "Kixtart VIC @kix")
ENDIF
ENDIF ; --------------------------------------------------------------------------
; - special variables settings -
; -------------------------------------------------------------------------- $section=substr(@date,3,2)
IF (@ydayno < 10)
$section=$section+"00"+@ydayno
ELSE
IF (@ydayno < 100)
$section=$section+"0"+@ydayno
ELSE
$section=$section+@ydayno
ENDIF
ENDIF
$key=$section+"_"
$key=$key+substr(@date,3,2)+substr(@date,6,2)+substr(@date,9,2)
$key=$key+"_"
$key=$key+@time
$key=$key+" "+$domain ; - calculation of LSERVER variable -
IF (len(@ipaddress0) = 0)
$offline_mode="yes"
IF ($NT_mode = "yes")
$x=$x+"(NT - vs "+$prgrm_version+" - off-line )"
ELSE
$x=$x+"(95 - vs "+$prgrm_version+" - off-line )"
ENDIF
ELSE
$offline_mode="no"
IF (len(@lserver) = 0)
$lserver="~lserver "
ELSE
$lserver=@lserver ; - \\spln99999 -
ENDIF
IF (LCASE($domain) = LCASE($ldomain))
IF ($NT_mode = "yes")
$x=$x+"(NT - vs "+$prgrm_version+" L $domain $lserver)"
ELSE
$x=$x+"(95 - vs "+$prgrm_version+" L $domain $lserver)"
ENDIF
ELSE
IF ($NT_mode = "yes")
$x=$x+"(NT - vs "+$prgrm_version+" - $domain $lserver)"
ELSE
$x=$x+"(95 - vs "+$prgrm_version+" - $domain $lserver)"
ENDIF
ENDIF
ENDIF
; - calculation of ip/mac-address value -
IF (len(@ipaddress0) = 15)
$i=1
$ip_old=@ipaddress0
$ip_new=""
DO
IF (substr($ip_old,$i,1) <> " ")
$ip_new=$ip_new+substr($ip_old,$i,1)
ELSE
$ip_new=$ip_new+"0"
ENDIF
$i=$i+1
UNTIL ($i > 15)
ELSE
$ip_new="xxx.xxx.xxx.xxx"
ENDIF
$x=$x+" "+$ip_new
;
IF (len(@address) = 0)
$address="xxxxxxxxxxxx"
ELSE
$address=@address
ENDIF
$x=$x+" "+$address
; - calculation of USER variable -
$user=""
IF ($NT_mode = "yes")
$ikey="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
IF (ExistKey($ikey) = 0)
$user=ReadValue($ikey, "DefaultUserName")
ENDIF
ELSE
$ikey="HKEY_LOCAL_MACHINE\System\CurrentControlSet\control"
IF (ExistKey($ikey) = 0)
$user=ReadValue($ikey, "Current User")
ENDIF
ENDIF
IF (len($user) = 0)
$user=@userid
IF (len($user) = 0)
$user="~user"
ENDIF
ENDIF
$x=$x+" "+$user
; - calculation of WORKSTATION value -
IF (len(@wksta) = 0)
$x=$x+" ~wksta"
ELSE
$x=$x+" "+@wksta
ENDIF
IF (len(@fullname) = 0)
IF (len(@comment) = 0)
$x=$x+" ('~fullname')"
ELSE
$x=$x+" ('~fullname'+'"+@comment+"')"
ENDIF
ELSE
IF (len(@comment) = 0)
$x=$x+" ('@fullname')"
ELSE
$x=$x+" ('"+@fullname+"'+'"+@comment+"')"
ENDIF
ENDIF $tmp=$x IF ($debug_mode = "yes")
; cls
IF ($NT_mode = "yes")
IF (len(@ipaddress0) = 0)
? "Kixtar "+@kix+" - NT debug mode (vs "+$prgrm_version+")"+" "+@time+" (off-line)"
ELSE
? "Kixtar "+@kix+" - NT debug mode (vs "+$prgrm_version+")"+" "+@time+" (on-line)"
ENDIF
ELSE
IF (len(@ipaddress0) = 0)
? "Kixtar "+@kix+" - 95 debug mode (vs "+$prgrm_version+")"+" "+@time+" (off-line)"
ELSE
? "Kixtar "+@kix+" - 95 debug mode (vs "+$prgrm_version+")"+" "+@time+" (on-line)"
ENDIF
ENDIF
?
? "file "+$file
? "section "+$section
? "key "+$key
IF (len(@fullname) = 0)
? "user "+$user
ELSE
IF (len(@comment) = 0)
? "user "+$user+" ('"+@fullname+"')"
ELSE
? "user "+$user+" ('"+@fullname+"'+'"+@comment+"')"
ENDIF
ENDIF
?
? "workstation "+@wksta+" ("+LCASE(@lanroot)+") C="+GetDiskSpace("c:\")+" KBytes"
? "domain "+@domain
? "ldomain "+@ldomain
? " -> = "+$domain
? " "+$ldomain+" (L)"
? "ip_adress "+$ip_new+" "+$address
?
? "debug_mode "+$debug_mode
? "offline_mode "+$offline_mode
?
ENDIF ; --------------------------------------------------------------------------
; - -
; -------------------------------------------------------------------------- $virus=""
$virus_def="" ; - "4.0.4048" -
$virus_engine="" ; - "4.0.02" -
$virus_product="" ; - "4.0.2" -
;
$virus_bCanBeDisabled="x"
$virus_bDisableScanning="x"
$virus_bLoadAtStartup="x"
$virus_bScanAllFiles="x"
$virus_bScanCompressed="x"
$virus_bScanFloppyOnShutdown="x"
$virus_bScanInComing="x"
$virus_bScanOutgoing="x"
$virus_bVScan="x"
;
$execute_mode="yes"
IF ($execute_mode = "yes")
IF ($debug_mode = "yes")
?
? "Inventory McAfee version"
?
ENDIF
;
$first=""
$ikey="HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "szEngineVer")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
$virus_engine=ReadValue($ikey, $icode)
CASE ($icode = "szProductVer")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
$virus_product=ReadValue($ikey, $icode)
CASE ($icode = "szSerialNum")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szVirDefVer")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
$virus_def=ReadValue($ikey, $icode)
CASE ($icode = "szVirDefDate")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $ikey="HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\McShield"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "dwFilesCleaned")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
CASE ($icode = "dwFilesDeleted")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
CASE ($icode = "dwFilesMoved")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
CASE ($icode = "dwFilesScanned")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $ikey="HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\McShield\CurrentVersion"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "bCanBeDisabled")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bCanBeDisabled=ReadValue($ikey, $icode)
CASE ($icode = "bDisableScanning")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bDisableScanning=ReadValue($ikey, $icode)
CASE ($icode = "bLoadAtStartup")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bLoadAtStartup=ReadValue($ikey, $icode)
CASE ($icode = "bScanAllFiles")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bScanAllFiles=ReadValue($ikey, $icode)
CASE ($icode = "bScanCompressed")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bScanCompressed=ReadValue($ikey, $icode)
CASE ($icode = "bScanFloppyOnShutdown")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bScanFloppyOnShutdown=ReadValue($ikey, $icode)
CASE ($icode = "bScanInComing")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bScanInComing=ReadValue($ikey, $icode)
CASE ($icode = "bScanOutgoing")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bScanOutgoing=ReadValue($ikey, $icode)
CASE ($icode = "bVScan")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
$virus_bVScan=ReadValue($ikey, $icode)
CASE ($icode = "szLastUpdateFile")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szProgExts")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szTaskName")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $ikey="HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\Tasks\Upgrade"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "bSchedEnabled")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szLastUpdateFile")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szTaskName")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szUpdateFtpLocation")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $ikey="HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\Tasks\Update"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "bSchedEnabled")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szLastUpdateFile")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szTaskName")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "szUpdateFtpLocation")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $ikey="HKEY_LOCAL_MACHINE\Software\McAfee\Scan95"
IF (ExistKey($ikey) = 0)
$index=0
IF ($debug_mode = "yes")
? $ikey
ENDIF
DO
$icode=ENUMVALUE($ikey, $index)
IF (len($icode) <> 0)
$found=" "
SELECT
CASE ($icode = "DATFile")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE ($icode = "bVShieldEnabled")
$virus=$virus+$first+$icode+"="+ReadValue($ikey, $icode)
$first=" "
$found="*"
CASE ($icode = "szLangID")
$virus=$virus+$first+$icode+"='"+ReadValue($ikey, $icode)+"'"
$first=" "
$found="*"
CASE 1
ENDSELECT
IF ($debug_mode = "yes")
? " "+$found+" "+$icode+"="+ReadValue($ikey, $icode)
ENDIF
ENDIF
$index=$index+1
UNTIL (len($icode) = 0)
ENDIF $file_x=$file
IF ($NT_mode = "yes")
$section_x=$domain+"_NT"
ELSE
$section_x=$domain+"_95"
ENDIF
$key_x=""
$key_x=$key_x+substr(LCASE(@wksta)+" ",1,15)+" "
$key_x=$key_x+$section_x
$xxx=""
IF (len($virus_def) <> 0) OR (len($virus_engine) <> 0)
$xxx=$xxx+substr($key,1,22)
$xxx=$xxx+substr(LCASE($virus_def)+" ",1,10)
$xxx=$xxx+substr(LCASE($virus_engine)+" ",1,10)
$xxx=$xxx+substr(LCASE($virus_product)+" ",1,7)
$xxx=$xxx+$virus_bCanBeDisabled
$xxx=$xxx+$virus_bDisableScanning
$xxx=$xxx+$virus_bLoadAtStartup
$xxx=$xxx+$virus_bScanAllFiles
$xxx=$xxx+$virus_bScanCompressed
$xxx=$xxx+$virus_bScanFloppyOnShutdown
$xxx=$xxx+$virus_bScanInComing
$xxx=$xxx+$virus_bScanOutgoing
$xxx=$xxx+$virus_bVScan
$xxx=$xxx+" "
$xxx=$xxx+substr($key,23,len($key)-22)+" "+$tmp
ELSE
$xxx=$xxx+$key+" "+$tmp
ENDIF
;
IF ($debug_mode = "yes")
?
? " file_x = "+$file
IF (len($virus_def) = 0) AND (len($virus_engine) = 0)
? " section_x = "+$section_x+"_error"
? " key_x = "+$key_x+"_error"
ELSE
? " section_x = "+$section_x
? " key_x = "+$key_x
ENDIF
? " xxx = "+$xxx
?
ENDIF
IF (len($virus_def) = 0) AND (len($virus_engine) = 0)
IF writeprofilestring($file_x, $section_x, $key_x, "")
ENDIF
IF writeprofilestring($file_x, $section_x+"_error", $key_x+"_error", $xxx)
ENDIF
ELSE
IF writeprofilestring($file_x, $section_x+"_error", $key_x+"_error", "")
ENDIF
IF writeprofilestring($file_x, $section_x, $key_x, $xxx)
ENDIF
ENDIF
ELSE
IF ($debug_mode = "yes")
?
? "Inventory McAfee version: SKIPPED"
?
ENDIF
ENDIF ; --------------------------------------------------------------------------
; - -
; -------------------------------------------------------------------------- IF (RedirectOutput("con",1) = 0)
ENDIF
;
IF ($debug_mode = "yes")
IF ($NT_mode = "yes")
? "Kixtar "+@kix+" - NT debug mode (vs "+$prgrm_version+")"+" "+@time
ELSE
? "Kixtar "+@kix+" - 95 debug mode (vs "+$prgrm_version+")"+" "+@time
ENDIF
ENDIF :end_script IF ($NT_mode = "yes")
$time_stop=@time
$log_info="Kixtart-VIC "+$prgrm_version+" script completed successfully"
$log_info=$log_info+" for '"+LCASE($user)+"' "+UCASE($domain)
$log_info=$log_info+" ("+$time_start+" - "+$time_stop+" - '"+$ip_new+"')"
IF (len(@fullname) > 0)
$log_info=$log_info+" '"+LCASE(@fullname)+"'"
ENDIF
IF ($found_virus_key = "yes")
IF logevent(0, 1, $log_info, "", "Kixtart VIC @kix"+"c")
ENDIF
ELSE
IF logevent(0, 1, $log_info, "", "Kixtart VIC @kix"+"s")
ENDIF
ENDIF
ENDIF
;
break on
flushkb
beep
Greetings.
|
|
Top
|
|
|
|
|
#50081 - 2000-05-26 08:42 PM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
MCA
KiX Supporter
Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
|
Examples of output of script:contents of file "c:\McAfee.lst" code:
[KLMVD1_NT]
spldxxxxx NL_NT=00148_000527_02:57:07 4.0.4079 4.0.70 4.0.3a 001011101 NL1 (NT - vs 1.00 L NL1 \\SPLNxxxxx) 171.171.171.171 00A024A835EF mca SPLDxxxxx ('MCA'+'USER001')
Information is also to eventlog for Windows NT environments. So you can see how long it needs to run and you can see the completion message.
Messages are:
code:
Kixtart VIC 3.62 start
Kixtart VIC 3.62c completion
contents of file "c:\McAfee_dump.txt". this file can be created by changing "$debug_mode" to "yes" code:
Kixtar 3.62 - NT debug mode (vs 1.00) 02:57:08 (on-line)file c:\McAfee.lst
section 00148
key 00148_000527_02:57:07 NL1
user MCA ('MCA'+'USER001') workstation SPLDxxxxx (c:\winnt\system32) C=132096 KBytes
domain NL1
ldomain NL1
-> = NL1
NL1 (L)
ip_adress 171.171.171.171 00A024A835EF debug_mode yes
offline_mode no
Inventory McAfee version
HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan
AlertConfigEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\AMGRCNFG.EXE
szVSTempDir=C:\PROGRA~1\NETWOR~1\VIRUSS~1\temp
bNotifyOneMonth=1
bCommEnableDiscovery=0
dwDefaultServerPlatform=1
szCommAddrCache=C:\PROGRA~1\NETWOR~1\VIRUSS~1\NETADDR.CAC
dwCommTimeOut=300
dwRefreshTime=3
Product=VirusScan
szInstallDir=C:\PROGRA~1\NETWOR~1\VIRUSS~1
* szProductVer=4.0.3a
* szSerialNum=E000-AIU3-DUYD
szUpdateEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\MCUPDATE.EXE
ConsoleEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\MCCONSOL.EXE
szUpdateMsgFile=
szVirusInfoURLValue=http://www.nai.com/vinfo
ScnStatEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SCNSTAT.EXE
ViewLogEXE=Notepad.EXE
WizardEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SCNCFG32.EXE
ScnCfg32EXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SCNCFG32.EXE
ShCfg32EXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SHCFG32.EXE
ShStatEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SHSTAT.EXE
dwConsoleRefreshRate=0
* szVirDefVer=4.0.4079
* szVirDefDate=10-May-2000
* szEngineVer=4.0.70
bDenyFloppyMountIfInfected=0
bNetshieldEnabled=1
bEnableDriverLog=0
bTaskManagerRunning=2
Scan32EXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\SCAN32.EXE
TaskMgrEXE=C:\PROGRA~1\NETWOR~1\VIRUSS~1\VsTskMgr.EXE
DAT=C:\PROGRA~1\NETWOR~1\VIRUSS~1\
NotifiedTime=cf070100804301000f0039003a001e00
bLoadAtStartup=1
HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\McShield
* dwFilesScanned=700
dwLastModified=267870
szLastScanned=Y:\virus.479\check.exe
bNewStatValues=0
* dwFilesCleaned=0
dwFileCacheHits=0
dwFilesInfected=0
* dwFilesDeleted=0
* dwFilesMoved=0
szLastInfected=
szLastVirusName=
HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\McShield\CurrentVersion
* bVScan=1
wTaskType=2
* bDisableScanning=0
* bScanFloppyOnShutdown=1
bApplyNow=0
* bCanBeDisabled=0
bFileCacheEnabled=1
bNetworkScanEnabled=0
Exclude0=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem\DB Log Path
bLimitSize=0
* bLoadAtStartup=1
bLogClean=1
bLogDateTime=1
bLogDelete=0
bLogDetection=1
bLogMove=0
bLogSettings=0
bLogSummary=0
bLogUserName=1
bLogToFile=1
bReloadDATs=0
* bScanAllFiles=0
* bScanCompressed=1
* bScanIncoming=1
* bScanOutgoing=0
dwExitStatus=0
dwLastModified=888
ExcludedItem_0=|pagefile.sys|49|0
NumExcludeItems=2
ExcludedItem_1=C:\Program Files\Network Associates\VirusScan NT| |49|1
szDefProgExts=EXE COM DOC DOT XL? MD? VXD 386 SYS BIN RTF OBD DLL SCR OBT PP? POT SHS MPP MPT OLE XTP XLB CMD OVL DEV VB? JS HTA HTM BAT INI WSH
szLogFileName=C:\Program Files\Network Associates\VirusScan NT\VirusScan Activity Log.txt
szMoveToFolder=C:\Program Files\Network Associates\VirusScan NT\INFECTED
* szProgExts=EXE COM DOC DOT XL? MD? VXD 386 SYS BIN RTF OBD DLL SCR OBT PP? POT SHS MPP MPT OLE XTP XLB CMD OVL DEV VB? JS HTA HTM BAT INI WSH
szRedirectorDeviceNames=LanmanRedirector NwRdr NetWareRedirector
* szTaskName=VirusScan On-Access Monitor
uAction=2
uCloseDelta=500
uKilobytes=100
wDate=0
wTime=0
wFlags=4096
UnloadDriver=0
ExcludedItem_2=|pagefile.sys|49|0
ExcludedItem_3=C:\PROGRA~1\NETWOR~1\VIRUSS~1| |49|1
bDisconnectUser=0
bSendDisconnectMessage=0
szDisconnectMessage=
HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\Tasks\Upgrade
dwExitStatus=0
wFlags=0
dwLastModified=4
* szTaskName=Automatic Product Upgrade
wTaskType=6
dwInternetAccessType=3
bLogToFile=0
szUpgradeCmd=setup -s
wTime=0
wDate=0
wTaskAttrib=0
wLastExec=0
* bSchedEnabled=0
bApplyNow=1
bAnonymousLogin=0
bDoUpdate=0
bProxy=0
bRetrieveOnly=0
dwProxyPort=80
szFTPPassword=
szFTPUserName=
* szUpdateFTPLocation=
szUpdateStoreFolder=
szUpdateUNCLocation=
uUpdateFrom=1
bUpdateStoreAfter=0
szProxy=
szUpdateShellScript=
HKEY_LOCAL_MACHINE\Software\McAfee\VirusScan\Tasks\Update
wflags=798
dwExitStatus=0
dwLastModified=14
* szLastUpdateFile=dat-4079.zip
* szTaskName=Automatic DAT Update
wTaskType=5
dwInternetAccessType=3
bProxy=0
bAnonymousLogin=0
dwProxyPort=80
szProxy=
* szUpdateFtpLocation=ftp.nai.com/pub/antivirus/datfiles/4.x
szFtpUserName=
szFtpPassword=
szUpdateStoreFolder=
szUpdateUncLocation=\\spln54662\apps\virus\update
szUpdateShellScript=
bRenameExisting=0
bUpdateStoreAfter=0
bDoUpdate=1
bRetrieveOnly=0
bExecAfterUpdate=0
uUpdateFrom=1
wTime=4623
wDate=0
wTaskAttrib=0
bApplyNow=1
wLastExec=0
* bSchedEnabled=0
bLogToFile=0
szUpdateDefaultFtpLocation=ftp.nai.com/pub/antivirus/datfiles/4.x file_x = c:\Mcafee.lst
section_x = NL1_NT
key_x = spldxxxxx NL1_NT
xxx = 00148_000527_02:57:07 4.0.4079 4.0.70 4.0.3a 001011101 NL1 (NT - vs 1.00 L NL1 \\SPLN59906) 171.171.171.171 00A024A835EF MCA SPLDxxxxx ('MCA'+'USER001')
contents of a file running at our site. code:
[SPLNX000_NT]
spldxxxxx NL_NT=00119_000428_14:21:51 4.0.4077 4.0.50 4.0.3a 001011101 NL (NT - vs 3.61 L NL \\server2) 171.171.171.171 00A024A835EF ...
server1 NL_NT=00133_000512_16:52:33 4.0.4074 4.0.50 4.0.3a 101011110 NL (NT - vs 3.69 L NL \\server1) 171.171.171.064 0000832DD1E6 ...
server2 NL_NT=00133_000512_16:52:08 4.0.4074 4.0.50 4.0.3a 101011110 NL (NT - vs 3.69 L NL \\server2) 171.171.171.062 4000D710E062 ...
[NL_95]
wd11111 NL_95=00147_000526_07:53:19 4073 4.0.70 4.0.2 1x1001110 NL (95 - vs 3.75 L NL \\server2) 171.171.171.052 4000D700E552 ...
wd22222 NL_95=00146_000525_09:35:12 4067 4.0.50 4.0.3 xxxxxxxxx NL (95 - vs 3.75 L NL \\server1) 171.171.171.057 4000D700E557 ...
wd33333 NL_95=00147_000526_10:40:15 4.0.4061 4.0.50 4.0.3 xxxxxxxxx NL (95 - vs 3.75 L NL \\server2) 171.171.171.050 4000D700E550 ...
wd44444 NL_95=00146_000525_18:13:51 4.0.4073 4.0.70 4.0.3 xxxxxxxxx NL (95 - vs 3.75 L NL \\server2) 171.171.171.044 4000D700E544 ...
[NL_NT_error]
spldyyyyy NL_NT_error=00144_000523_00:23:27 NL (NT - vs 3.74 L NL \\server2) 171.171.171.245 00104BB919A2 ...
wd55555 NL_NT_error=00147_000526_09:38:01 NL (NT - vs 3.75 L NL \\server2) 171.171.171.016 0000832717B4 ...
wd66666 NL_NT_error=00138_000517_15:04:11 NL (NT - vs 3.70 L NL \\server2) 171.171.171.044 4000D700E544 ...
Another interest topic about virus is: http://kixtart.to/script/board/ubbhtml/Forum2/HTML/000473.html Greetings.
Any reaction is welcome.
|
|
Top
|
|
|
|
|
#50082 - 2002-10-10 11:37 AM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
BrianK
Getting the hang of it
Registered: 2002-10-02
Posts: 90
Loc: Amsterdam, The Netherlands
|
Dear MCA,
The script looks great, but then again, every script looks great in my amateur eyes... Perhaps if I specify my needs, you can tell me if this script does the trick.
On the clients:
1. needs to check if there is a version of McAfee VirusScan installed at all, if not, install the program + definitions on local drive, from specified location.
1a. If the correct version is installed, comparing with the version on the server.
2. If SP1 is installed, if not, install it.
3. If the engine is older than 12 weeks, copy the SuperDAT and run it. If younger than 12 weeks, only copy the Delta and install. (I think some things are done by the MCUPDATE utillity, wich is fine by me, but please explain how to use it in a kix script)
Perhaps there are more criteria I should consider that have passed me by.
Thanks in advance.
Brian
_________________________
Rodney Dangerfield:
“My mother didn't breast-feed me. She said she liked me as a friend.”
|
|
Top
|
|
|
|
|
#50084 - 2002-10-11 07:14 PM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
This should get you rolling....
code:
;Install VirusScan SP-1
:vscansp1
$vscansp1 = "\\Server\McAfee\antivirus\vscan4.5Sp1"
;After Vscan SP-1 is installed, we want to set screen splash to be off
$skipsplash = Readvalue("HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\Vshield\System Scan\General","bSkipSplash")
;$SkipSplash = Readvalue("HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\Vshield\System Scan\General","bShowTaskbarIcon")
IF @error = 0
;Value is found - Check for modification
IF $skipsplash <> "1"
$rc = WriteValue("HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\Vshield\System Scan\General","bSkipSplash", "1", "REG_DWORD")
ENDIF
ENDIF
;Are they running SP-1?
$scanverl = Readvalue("HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan","szVshwin32EXE")
;Get the version of the .EXE File
$scanver = GETFILEVERSION($scanverl,"FILEVERSION")
;4.5.496.0 - Version of Vshield before updating
;4.5.534.0 - Version of Vshield after updating
IF $scanver < "4.5.534.0"
RUN $vscansp1+"\VSC45SP1.exe /silent"
ELSE
;Running the SP or not running
RETURN
ENDIF
HTH,
Kent
|
|
Top
|
|
|
|
|
#50085 - 2002-10-11 07:16 PM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
code:
; ******************************* McAfee VirusShield Section *********************************
$NAITVD ="$HKLMS\Network Associates\TVD"
$vsengine ="$NAITVD\Shared Components\VirusScan Engine\4.0.xx"
$mcupdate ="$NAITVD\Shared Components\McUpdate\CurrentVersion"
$vscandir =readvalue("$NAITVD\VirusScan","szInstallDir")
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber")
$vscaneng =readvalue("$vsengine","szEngineVer")
$vscandat =readvalue("$vsengine","szDatVersion")
$vsdatdir =readvalue("$vsengine","szInstallDir")
$vsdatdate =readvalue("$vsengine","szDatDate")
$mcupdexe =readvalue("$mcupdate","szInstallDir")
; ******* install it
$availver=readprofilestring("$setup\apps\mcafee\install\PkgDesc.ini","VSNT","Version")
if "$availver">"$vscanver"
if updateapp("VirusScan4.5.1",0,1)="yes"
shell ('$setup\apps\mcafee\install\setup.exe reboot=r scanatstartup=false forceinstall=true /qb /i')
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber")
endif
endif
; ******* Service pack it
if "4.5.1.1306">"$vscanver"
if updateapp("VirusScan4.5.1-SP1",0,1)="yes"
shell ('$setup\apps\mcafee\Sp1\VSC451S1.EXE /silent')
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber")
endif
endif
; ******* Superdat it
$availeng=readprofilestring("$setup\apps\mcafee\upgrade\superdat.ini","superdat","Version")
if $availeng > $vscaneng
$=writevalue("$McUpdate\Upgrade\Upgrade Site1","szUNCLocation","$setup\Apps\McAfee\Upgrade",REG_SZ)
shell ('"$mcupdexe/MCUPDATE" /TASK UPGRADE /BATCH /norestart')
$vscaneng =readvalue("$vsengine","szEngineVer")
endif
; ******* dat it
$availdat=dir("$setup\apps\mcafee\update\*.zip")
$availdat=substr("$availdat",5,4)
if instr("$vscandat","$availdat")=0
$=writevalue("$McUpdate\Update\Update Site1","szUNCLocation","$setup\Apps\McAfee\Update",REG_SZ)
shell ('"$mcupdexe/MCUPDATE" /TASK UPDATE /BATCH')
$vsdatdate =readvalue("$vsengine","szDatDate")
$vscandat =readvalue("$vsengine","szDatVersion")
endif
; ******* extra.dat it
FreshFile("$setup\apps\mcafee\update","$vsdatdir","extra.dat")
? " Installed "color c+/n"VirusShield $vscanver "color w/n"is version " color w+/n $vscandat color w/n " dated " color w+/n $vsdatdate color w/n
[ 11. October 2002, 19:17: Message edited by: Radimus ]
|
|
Top
|
|
|
|
|
#50086 - 2002-10-14 10:45 AM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
BrianK
Getting the hang of it
Registered: 2002-10-02
Posts: 90
Loc: Amsterdam, The Netherlands
|
Dear Radimus.
I've taken your script and modified the paths to make it work in my environment. Also i've added some lines to accomodate the Win9x clients.
code:
; ******************************* McAfee VirusShield Section *********************************
; ****** V:drive is actually the Q: drive in real script *************************************
$NAITVD ="$HKLMS\Network Associates\TVD"
$vsengine ="$NAITVD\Shared Components\VirusScan Engine\4.0.xx"
$mcupdate ="$NAITVD\Shared Components\McUpdate\CurrentVersion"
$vscandir =readvalue("$NAITVD\VirusScan","szInstallDir")
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber")
$vscaneng =readvalue("$vsengine","szEngineVer")
$vscandat =readvalue("$vsengine","szDatVersion")
$vsdatdir =readvalue("$vsengine","szInstallDir")
$vsdatdate =readvalue("$vsengine","szDatDate")
$mcupdexe =readvalue("$mcupdate","szInstallDir")
; ******* Install it
Select
CASE @INWIN = ("1") ;Windows NT
$availver=readprofilestring("V:\vscan\vscan_NT\PkgDesc.ini","VSNT","Version")
if "$availver">"$vscanver"
if updateapp("VirusScan4.5.1",0,1)="yes"
shell ('V:\vscan\vscan_NT\setup.exe reboot=r scanatstartup=false forceinstall=true /qb /i')
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber") endif
endif
CASE @INWIN = ("2") ;Windows 9x
$availver=readprofilestring("V:\vscan\vscan_9x\PkgDesc.ini","VSNT","Version")
if "$availver">"$vscanver"
if updateapp("VirusScan4.5.1",0,1)="yes"
shell ('V:\vscan\vscan_9x\setup.exe reboot=r scanatstartup=false forceinstall=true /qb /i')
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber") endif
endif
EndSelect
; ******* Service pack it
if "4.5.1.1306">"$vscanver"
if updateapp("VirusScan4.5.1-SP1",0,1)="yes"
shell ('V:\vscan\upgrade\VSC451S1.EXE /silent')
$vscanver =readvalue("$NAITVD\VirusScan","szCurrentVersionNumber")
endif
endif
; ******* Superdat it
$availeng =readprofilestring("V:\vscan\mirror.ftp\superdat.ini","superdat","Version")
if $availeng > $vscaneng
$=writevalue("$McUpdate\Upgrade\Upgrade Site1","szUNCLocation","V:\vscan\mirror.ftp",REG_SZ)
shell ('"$mcupdexe/MCUPDATE" /TASK UPGRADE /BATCH /norestart')
$vscaneng =readvalue("$vsengine","szEngineVer") endif
; ******* dat it
$availdat=dir("V:\vscan\mirror.ftp\*.zip")
$availdat=substr("$availdat",5,4)
if instr("$vscandat","$availdat")=0
$=writevalue("$McUpdate\Update\Update Site1","szUNCLocation","V:\vscan\mirror.ftp",REG_SZ)
shell ('"$mcupdexe/MCUPDATE" /TASK UPDATE /BATCH')
$vsdatdate =readvalue("$vsengine","szDatDate")
$vscandat =readvalue("$vsengine","szDatVersion")
endif
; ******* extra.dat it
FreshFile("V:\vscan\mirror.ftp","$vsdatdir","extra.dat")
? " Installed "color c+/n"VirusShield $vscanver "color w/n"is version " color w+/n $vscandat color w/n " dated " color w+/n $vsdatdate color w/n
However, when I start it, the following line appears:
Script error: Expected expression!
_________________________
Rodney Dangerfield:
“My mother didn't breast-feed me. She said she liked me as a friend.”
|
|
Top
|
|
|
|
|
#50088 - 2002-10-14 02:27 PM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
updateapp() is a UDF in the UDF forum
|
|
Top
|
|
|
|
#50089 - 2002-12-01 07:46 AM
Re: Complete inventory of McAfee virusscan software which is always up-to-date.
|
MCA
KiX Supporter
Registered: 2000-04-28
Posts: 5152
Loc: Netherlands, EU
|
Dear BrianK,
Our script makes only an inventory. It doesn't have the capabilities of installing or
upgrading McAfee on your clients.
Indeed on the board there are very interesting script for keeping your virusscanner
up-to-date.
greetings.
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1024 anonymous users online.
|
|
|
