To: LLigeta and morbidVariable $LogFQNIEError
Variable should be \\tol-team1\Login Record\T192168005175.ie
The message box at line 634 shows that the variable is OK at that line.
The message box at line 664 shows that the 21st position of the array has been changed from a character "c" to a character "d".
If you change the script so that lines 206 and 214 have an index of "1", then the variable is not overwritten in the 21st position!!
--- line 1 of script starts in next line ---
;===== login script 12/30/2001 - V9.2a - Archie Call
; Audit Sophos installation and display warning banners
; Uses \\Tol-Team1\Login Record as Central Folder for files
; Write login record to file T????????????.txt
; Synchronize time to Tol-Team1
; Write out T????????????.ie file if IE is not 6.0 or 5.5 SP2
; Update to IE 6.0 if T????????????.u60 exists
; Update to IE 5.5 SP2 if T????????????.u55 exists
; Update a 1505 Jeff user to W2K SP2 if T????????????.w05 exists
; If IISADMIN service is installed give warning and write out
; T????????????.adm file
; If W2K Pro and not Service Pack 2 then write out T????????????.SP2
; V8 - Loop back during Sophos Install check and try again
; V9.0 Various potential virus initiators.
; V9.1 Check for various virus file fragments
; V9.2 Check that InterCheck is active
; IE patches for 6.0 and 5.5 SP2
; TrackIt Audit runs based on control file on C: drive
; V9.2a Loop 6 times for Sophos Error
;====================================================================
break on
$BeginTicks = @TICKS
$BlankDir = ""
dim $HoldLogs[25]
$MaxLogs = 15
cls
$VersionNo = "V9.2a"
$Spaces20 = " "
;==== determine OS type
$ProductSuite = @ProductSuite
;==== exit if Terminal Server
if $ProductSuite = 16
quit
endif
$ProductType = @ProductType
$PWAge = @PWAge
$Workstation = 0
;==== determine Sophos Class
Select
case $ProductType = "Windows 95"
$SophosClass = "W95"
$Workstation = 1
case $ProductType = "Windows 98"
$SophosClass = "W95"
$Workstation = 1
case $ProductType = "Windows Me"
$SophosClass = "W95"
$Workstation = 1
case $ProductType = "Windows NT Workstation"
$SophosClass = "NT"
$Workstation = 1
case $ProductType = "Windows NT Server"
$SophosClass = "NT"
case $ProductType = "Windows NT Domain Controller"
$SophosClass = "NT"
case $ProductType = "Windows 2000 Professional"
$SophosClass = "NT"
$Workstation = 1
case $ProductType = "Windows 2000 Server"
$SophosClass = "NT"
case $ProductType = "Windows 2000 Domain Controller"
$SophosClass = "NT"
case $ProductType = "Windows XP Home Edition"
$SophosClass = "XP"
$Workstation = 1
case $ProductType = "Windows XP Professional"
$SophosClass = "XP"
$Workstation = 1
case $ProductType = "Windows XP Server"
$SophosClass = "XP"
case $ProductType = "Windows XP Domain Controller"
$SophosClass = "XP"
case 1
$SophosClass = "Cannot determine -- Error!"
EndSelect
;====quit if not workstation
If $Workstation = 0
quit
endif
$StartBanner = "Sophos " + $VersionNo + " audit starting"
$Selection = MessageBox($StartBanner,"",0,1)
;==== update local pc time from Tol-Tam server.
settime "\\tol-team1"
$LoginFolder = "\\Tol-team1\Login Record\"
$LoginToolsFolder = $LoginFolder + "tools\"
;==== get Windows Service Pack if W2K
$W2KWinErr = 0
$ServicePack = @CSD
$WinServicePack = "This is not a W2K PC"
if $ProductType = "Windows 2000 Professional"
$WinServicePack = $ServicePack
if $ServicePack = "Service Pack 2"
else
;--- set flag to indicate Service Pack error
$W2KWinErr = 1
endif
endif
;==== determine the Sophos InstalledBy entry in Registry
$InstalledBy = "Key not found"
if $SophosClass = "W95"
$InstalledBy = ReadValue ("HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Sweep95","InstalledBy")
endif
if $SophosClass = "NT"
$InstalledBy = ReadValue ("HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SweepNT","InstalledBy")
endif
;==== determine the Sophos SweepNet Object Name entry in Registry
$SweepNetObj = "Key not found"
if $SophosClass = "NT"
$SweepNetObj = ReadValue ("HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\SweepNet","ObjectName")
endif
;=== determine whether IISADMIN service is loaded
$FoundIISAdmin = 0
$Index = 0
:Loop1
$KeyToCheck = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\"
$KeyName = EnumKey($KeyToCheck,$Index)
if @ERROR = 0
$Index = $Index + 1
$CheckKey = ucase($KeyName)
if $CheckKey = "IISADMIN"
$FoundIISAdmin = 1
endif
goto Loop1
endif
;==== determine what version of Internet Explorer is installed
$IEVersion = ReadValue ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer","Version")
$IEVersionOK = 0
$IEVersionName = ""
select
case $IEVersion = "5.50.4807.2300"
$IEVersionOK = 1
$IEVersionName = "5.5SP2"
case $IEVersion = "6.00.2462.0000" or $IEVersion = "6.0.2462.0000"
$IEVersionOK = 1
$IEVersionName = "6.0"
case $IEVersion = "6.00.2479.0006" or $IEVersion = "6.0.2479.0006"
$IEVersionOK = 1
$IEVersionName = "6.0"
case $IEVersion = "6.00.2600.0000" or $IEVersion = "6.0.2600.0000"
$IEVersionOK = 1
$IEVersionName = "6.0"
endselect
;==== determine whether IE patches are loaded
$IEPatch = ""
if $IEVersionOK = 1
if $IEVersionName = "6.0"
$Key1 = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\"
$Key2 = "{716E024F-7F74-47F3-B93B-9FF7F3CBF94C}"
$KeyToCheck = $Key1 + $Key2
$IEPatch = ReadValue ($KeyToCheck,"ComponentID")
endif
if $IEVersionName = "5.5SP2"
$Key1 = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\"
$Key2 = "{FA5F6B99-B5FC-4C24-8CBF-669DA55CFD62}"
$KeyToCheck = $Key1 + $Key2
$IEPatch = ReadValue ($KeyToCheck,"ComponentID")
endif
endif
$UserName = @userid
$FullName = @fullname
$WkSta = @WkSta
$Domain = @Domain
$Tcpip = @ipaddress0
;===== determine if Sophos installed
$SophosInstalled = 1
$LocalDrive = "c:"
$KeepLooping = 1
$NoLoops = 0
;=== check on Sophos - uses looping in case Sophos is updating at
; the same time.
Do
$FileName = $LocalDrive + "\progra~1\sophos~1\vdl.dat"
$VDLDate = GetFileTime($FileName)
$VDLDate = substr($VDLDate,1,10)
if len($VDLDate) = 0
$SophosInstalled = 0
endif
;==== if Sophos installed calc latest IDE file date
if $SophosInstalled = 1
$LatestTime = "1900/01/01"
$i = 1
$DirFiles = $LocalDrive + "\progra~1\sophos~1\*.ide"
$FileName = Dir("$DirFiles",0)
while $FileName <> "" and @ERROR = 0
$ShowName = $FileName
$Result = GetFileTime($LocalDrive + "\progra~1\sophos~1\" + $ShowName)
$FileTime = Substr($Result,1,10)
If $FileTime > $LatestTime
$LatestTime = $FileTime
endif
$FileName = dir("",0)
loop
endif
;===== calc days for Todays date
$TodayDate = @date
$YearToday = val(Substr($TodayDate,1,4))
$MonthToday = val(Substr($TodayDate,6,2))
$DayToday = val(Substr($TodayDate,9,2))
$DaysToday = ($YearToday * 365) + ($MonthToday * 30) + $DayToday
;====== calc days for Latest IDE date
$YearLatest = val(Substr($LatestTime,1,4))
$MonthLatest = val(Substr($LatestTime,6,2))
$DayLatest = val(Substr($LatestTime,9,2))
$DaysLatest = ($YearLatest * 365) + ($MonthLatest * 30) + $DayLatest
;======= calc days for VLD date
$YearVDL = val(Substr($VDLDate,1,4))
$MonthVDL = val(Substr($VDLDate,6,2))
$DayVDL = val(Substr($VDLDate,9,2))
$DaysVDL = ($YearVDL * 365) + ($MonthVDL * 30) + $DayVDL
;==== calc elapsed days for IDE and VDL
$ElapsedDaysIde = $DaysToday - $DaysLatest
$ElapsedDaysVDL = $DaysToday - $DaysVDL
;==== set virus warning flag if IDE > 22 days old or VDL > 75 days old
$ShowVirusWarning = 0
if $ElapsedDaysIDE > 22 or $ElapsedDaysVDL > 75
$ShowVirusWarning = 1
endif
;=== determine InterCheck status
$InterCheckErr = 1
$ShellLine = $LoginToolsFolder + "icstatus.exe /s"
shell $ShellLine
$ShellError = @ERROR
if $ShellError = 0
$InterCheckErr = 0
endif
;=== determine whether to exit loop
if $SophosInstalled = 1 and $ShowVirusWarning = 0 and $InterCheckErr = 0
;=== Sophos is OK -- you are done
$KeepLooping = 0
else
$NoLoops = $NoLoops + 1
if $NoLoops = 6
;=== looped 6 times -- you are done
$KeepLooping = 0
else
;=== wait 5 seconds and try again
$PauseBanner = "Re-checking Sophos: Loop " + $NoLoops
$Selection = MessageBox($PauseBanner,"",0,5)
cls
endif
endif
until $KeepLooping = 0
;======== if Sophos not installed then show Crital Alert
if $SophosInstalled = 0
$MsgText = "Warning!! Sophos Anti-Virus may not installed on your computer." + chr(10)
+ "" + chr(10)
+ "Please contact Systems ASAP!" + chr(10)
+ "Systems should install Sophos on this computer today." + chr(10)
+ "" + chr(10)
+ "You can use your computer -- however, do not open email attachments!" + chr(10)
+ "" + chr(10)
+ "UserName ===> " + chr(9) + $UserName + chr(10)
+ "FullName ===> " + chr(9) + $Fullname + chr(10)
+ "WkStation ==> " + chr(9) + $WkSta + chr(10)
+ "TcpipAddr ==> " + chr(9) + $Tcpip + chr(10)
+ "Domain =====> " + chr(9) + $Domain + chr(10)
+ "" + chr(10)
+ "Do not ignore this Critical Alert!"
$Selection = MessageBox($MsgText,"Anti-Virus Critical Alert!",0,30)
endif
if $SophosInstalled = 1 and $InterCheckErr = 1
$MsgText = ""
+ "The Sophos InterCheck Scanner (Red Lightning Bolt) is not Active on your computer!" + chr(10)
+ "" + chr(10)
+ "Inform Systems to update Sophos on your computer today." + chr(10)
+ "" + chr(10)
+ "You can use your computer -- however, do not open email attachments!" + chr(10)
+ "" + chr(10)
+ "Do not ignore this Critical Alert!"
$Selection = MessageBox($MsgText,"Anti-Virus Critical Alert!",0,30)
endif
if ($ShowVirusWarning = 1) and ($SophosInstalled = 1) and ($InterCheckErr = 0)
$MsgText = "Current Date (YYYY/MM/DD) =====> " + chr(9) + $TodayDate + chr(10)
+ "Sophos IDE Date (YYYY/MM/DD) ==> " + chr(9) + $LatestTime + chr(10)
+ "Sophos VDL Date (YYYY/MM/DD) ==> " + chr(9) + $VDLDate + chr(10)
+ "" + chr(10)
+ "Sophos Anti-Virus is installed on your computer, but it is out of date!!" + chr(10)
+ "" + chr(10)
+ "Inform Systems to update Sophos on your computer today." + chr(10)
+ "" + chr(10)
+ "You can use your computer -- however, do not open email attachments!" + chr(10)
+ "" + chr(10)
+ "UserName ===> " + chr(9) + $UserName + chr(10)
+ "FullName ===> " + chr(9) + $Fullname + chr(10)
+ "WkStation ==> " + chr(9) + $WkSta + chr(10)
+ "TcpipAddr ==> " + chr(9) + $Tcpip + chr(10)
+ "Domain =====> " + chr(9) + $Domain + chr(10)
+ "" + chr(10)
+ "Do not ignore this Warning!"
$Selection = MessageBox($MsgText,"Anti-Virus Warning!",0,30)
endif
if $FoundIISAdmin = 1
$MsgText = "The Internet Information Server service was found on your computer!" + chr(10)
+ "" + chr(10)
+ "This service can be a source of viruses and is subject to outside attack." + chr(10)
+ "" + chr(10)
+ "Contact Systems to have this service removed!" + chr(10)
+ "" + chr(10)
+ "You can use your computer -- however the service must be removed today!" + chr(10)
$Selection = MessageBox($MsgText,"Internet Information Server Warning!",0,30)
endif
;==== write login record
cls
;===Pad TcpIp with zeros
$LogFileName = "T"
for $ii = 1 to 4
$FragOct = substr($TcpIP,($ii-1)*4+1,3)
$FragOct = "000" + ltrim($FragOct)
$F1 = len($FragOct) - 2
$FragOct = substr($FragOct,$F1,3)
$LogFileName = $LogFileName + $FragOct
next
$TCPSegment = left($LogFileName,10)
$AutoexecBat = "c:\autoexec.bat"
$LogFQN = $LoginFolder + $LogFileName + ".txt"
$LogFQNIEError = $LoginFolder + $LogFileName + ".ie"
$LogFQNError = $LoginFolder + $LogFileName + ".err"
$LogFQNIEUpdate55 = $LoginFolder + $LogFileName + ".u55"
$LogFQNIEUpdate60 = $LoginFolder + $LogFileName + ".u60"
$LogFQNIIS = $LoginFolder + $LogFileName + ".adm"
$LogFQNW2KWin = $LoginFolder + $LogFileName + ".sp2"
$LogFQNW2KSP205 = $LoginFolder + $LogFileName + ".w05"
$LogFQNFoundFrag = $LoginFolder + $LogFileName + ".frg"
$LogFQNIEPatchError = $LoginFolder + $LogFileName + ".pat"
$LogFQNIEPatch55 = $LoginFolder + $LogFileName + ".p55"
$LogFQNIEPatch60 = $LoginFolder + $LogFileName + ".p60"
$TrackItLocation = $LoginToolsFolder + "TrackItLoc.txt"
$TrackItLocalLoc = "c:\TrackItLast.Txt"
;--- read the TrackIt Control File
$x = open(2,$TrackItLocation,2)
$Lin = readline(2)
while @Error = 0
$TheLoc = $Lin
if left($TheLoc,10) = $TCPSegment
$lenl = len($TheLoc)
$SegmentLoc = right($TheLoc,$lenl-12)
$SegmentLoc = ucase(trim($SegmentLoc))
endif
$Lin = readline(2)
loop
$x = close(2)
;==== if previous log file exists then stack previous logins into array
if Exist($LogFQn)
$x = open(1,$LogFQN,2)
$Lin = readline(1)
$L1 = 1
$InLogs = 0
while @Error = 0
$TestHead1 = substr($Lin,1,10)
if $TestHead1 = "----------"
$InLogs = 1
endif
if $InLogs = 1
$HoldLogs[$L1] = $Lin
$L1 = $L1 + 1
endif
$Lin = readline(1)
loop
$L1 = $L1 - 2
else
$x = Open(1,$LogFQN,5)
for $iiii = 1 to 3
$TheLine = "Fixed Information" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
next
endif
$x = close(1)
del $LogFQN
if open(1,$LogFQN,5) = 0
;=== write the Fixed infor for the PC
$TheLine = "KixStart Version Number: " + $VersionNo + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "TCP/IP: " + $TcpIp + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "Computer: " + $WkSta + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "Domain: " + $Domain + " User: " + $UserName + " - " + $FullName + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "ProductType: " + $ProductType +
" Sophos Class: " + $SophosClass + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "ProductSuite: " + $ProductSuite + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "PWAge: " + $PWAge + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "Sophos VDL Date: " + $VDLDate + " Days old: " +
$ElapsedDaysVdl + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "Sophos Lastest IDE Date: " + $LatestTime + " Days old: " +
$ElapsedDaysIde + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;----- determine sophos status
Select
case $SophosInstalled = 0
$SophosStatus = "Sophos not installed"
$SophosStatusCode = 0
case $ShowVirusWarning = 1
$SophosStatus = "Sophos is too old!!"
$SophosStatusCode = 0
case 1
$SophosStatus = "Sophos is current!"
$SophosStatusCode = 1
EndSelect
$TheLine = "Sophos Age Status: " + $SophosStatus + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
if $InterCheckErr = 1
$TheLine = "Sophos InterCheck Status: Inactive or not installed" + chr(13) + chr(10)
$SophosStatusCode = 0
else
$TheLine = "Sophos InterCheck Status: Active" + chr(13) + chr(10)
endif
$x = WriteLine(1,$TheLine)
$TheLine = "Sophos Installed By key: " + $InstalledBy + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$TheLine = "Sophos SweepNet Account: " + $SweepNetObj + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$IEStatus = "Not protected!!"
if $IEVersionOK = 1
$IEStatus = "Version is protected."
endif
$TheLine = "IE Version: " + $IEVersion + " IE Status: " + $IEStatus + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
if $IEPatch = ""
$IEPatchStatus = "IE Patch MS01-058 (Q313675) is not installed!!."
else
$IEPatchStatus = "IE Patch MS01-058 (Q313675) is installed."
endif
$TheLine = "IE Patch Status: " + $IEPatchStatus + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$IISAdmin = "IISAdmin Service is not loaded."
if $FoundIISAdmin = 1
$IISAdmin = "IISAdmin service is loaded!!"
endif
$TheLine = $IISAdmin + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$ServicePackMessage = "Windows 2000 Service Pack: " + $WinServicePack
$TheLine = $ServicePackMessage + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;=== check for various virus fragments
$FoundFragments = 0
$TheLine = "==== Check for various virus fragments ====" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;--- nimda check
if Exist ("c:\admin.dll")
$FoundFragments = 1
$TheLine = " ---> Nimda fragment c:\admin.dll exists!!! " + chr(13) + chr(10)
else
$TheLine = " Nimda fragment c:\admin.dll not found." + chr(13) + chr(10)
endif
$x = WriteLine(1,$TheLine)
;--- sircam check
$RC = keyexist ("HKEY_LOCAL_MACHINE\software\sircam")
if $RC = 1
$FoundFragments = 1
$TheLine = " ---> Sircam fragment HKLM\software\sircam exists!!! " + chr(13) + chr(10)
else
$TheLine = " Sircam fragment HKLM\software\sircam not found." + chr(13) + chr(10)
endif
$x = WriteLine(1,$TheLine)
;=== write out HKLM Run values
$TheLine = "=== \HKLM\software\microsoft\windows\currentversion\run ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = 0
$KeyToCheck = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
:LoopN1
$KeyValueName = EnumValue($KeyToCheck,$Index)
if @ERROR = 0
$ValueData = ReadValue($KeyToCheck, $KeyValueName)
$NoSpaces = 21 - len($KeyValueName)
if $NoSpaces < 1
$NoSpaces = 2
endif
$KeyValueName1 = " " + $KeyValueName + substr($Spaces20,1,$NoSpaces)
$TheLine = $KeyValueName1 + $ValueData + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = $Index + 1
goto LoopN1
endif
;=== write out HKLM RunServices values
$TheLine = "=== \HKLM\software\microsoft\windows\currentversion\runservices ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = 0
$KeyToCheck = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices"
:LoopN2
$KeyValueName = EnumValue($KeyToCheck,$Index)
if @ERROR = 0
$ValueData = ReadValue($KeyToCheck, $KeyValueName)
$NoSpaces = 21 - len($KeyValueName)
if $NoSpaces < 1
$NoSpaces = 2
endif
$KeyValueName1 = " " + $KeyValueName + substr($Spaces20,1,$NoSpaces)
$TheLine = $KeyValueName1 + $ValueData + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = $Index + 1
goto LoopN2
endif
;=== write out HKCU Run values
$TheLine = "=== \HKCU\software\microsoft\windows\currentversion\run ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = 0
$KeyToCheck = "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
:LoopN4
$KeyValueName = EnumValue($KeyToCheck,$Index)
if @ERROR = 0
$ValueData = ReadValue($KeyToCheck, $KeyValueName)
$NoSpaces = 21 - len($KeyValueName)
if $NoSpaces < 1
$NoSpaces = 2
endif
$KeyValueName1 = " " + $KeyValueName + substr($Spaces20,1,$NoSpaces)
$TheLine = $KeyValueName1 + $ValueData + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = $Index + 1
goto LoopN4
endif
;=== write out HKCU RunServices values
$TheLine = "=== \HKCU\software\microsoft\windows\currentversion\runservices ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = 0
$KeyToCheck = "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices"
:LoopN5
$KeyValueName = EnumValue($KeyToCheck,$Index)
if @ERROR = 0
$ValueData = ReadValue($KeyToCheck, $KeyValueName)
$NoSpaces = 21 - len($KeyValueName)
if $NoSpaces < 1
$NoSpaces = 2
endif
$KeyValueName1 = " " + $KeyValueName + substr($Spaces20,1,$NoSpaces)
$TheLine = $KeyValueName1 + $ValueData + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = $Index + 1
goto LoopN5
endif
;=== write out \hkcr\exefile\shell\open\command values
$TheLine = "=== \hkcr\exefile\shell\open\command ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = 0
$KeyToCheck = "HKEY_CLASSES_ROOT\exefile\shell\open\command"
:LoopN3
$KeyValueName = EnumValue($KeyToCheck,$Index)
if @ERROR = 0
$ValueData = ReadValue($KeyToCheck, $KeyValueName)
$NoSpaces = 21 - len($KeyValueName)
if $NoSpaces < 1
$NoSpaces = 2
endif
$KeyValueName1 = " " + $KeyValueName + substr($Spaces20,1,$NoSpaces)
$TheLine = $KeyValueName1 + $ValueData + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Index = $Index + 1
goto LoopN3
endif
;---- shell= in System.ini
$ShellEquals = ReadProfileString("system.ini", "boot", "shell")
$TheLine = "=== system.ini: [boot] shell= " + $ShellEquals + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;---- run= in Win.ini
$ShellEquals = ReadProfileString("win.ini", "windows", "run")
$TheLine = "=== win.ini: [windows] run= " + $ShellEquals + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Banner1 = "Value of LogFQNIEError is " + $LogFQNIEError
$Selection = MessageBox($Banner1,"",0,0)
;--- dir of start programs
if $SophosClass = "W95"
$TheLine = "=== \windows\startmenu\programs\startup ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$DirFiles = $LocalDrive + "\windows\startm~1\programs\startup\*.*"
$FileName = Dir("$DirFiles",0)
while $FileName <> "" and @ERROR = 0
if $FileName <> "." and $FileName <> ".."
$TheLine = " " + $FileName + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
endif
$FileName = dir("",0)
loop
else
$TheLine = "=== \docume~1\alluse~1\startmenu\programs\startup ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$DirFiles = $LocalDrive + "\docume~1\alluse~1\startm~1\programs\startup\*.*"
$FileName = Dir("$DirFiles",0)
while $FileName <> "" and @ERROR = 0
if $FileName <> "." and $FileName <> ".."
$TheLine = " " + $FileName + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
endif
$FileName = dir("",0)
loop
endif
$Banner1 = "Value of LogFQNIEError is " + $LogFQNIEError
$Selection = MessageBox($Banner1,"",0,0)
;--- Internet Explorer start page
$IEStartPage = ReadValue ("HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main","Start Page")
$TheLine = "IE Start Page: " + $IEStartPage + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;--- write out autoexec.bat file
$TheLine = "=== Autoexec.bat file ===" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$x = open(2,$AutoexecBat,2)
$Lin = readline(2)
while @Error = 0
$TheLine = " " +$Lin + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$Lin = readline(2)
loop
$x = close(2)
;--- calc total running time of script.
$ScriptSecs = @TICKS - $BeginTicks + 1500
$RunSecs = "$ScriptSecs"
$lens = len($RunSecs)
$TTSecs = substr($RunSecs,1 , $lens - 3) + "." + substr($RunSecs, $lens - 3, 3)
$TheLine = "Running time: " +$TTSecs + " seconds" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;---- write the variable logon times
$TheLine = "--------------------------" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
;=== write variable login records
$TheLine = $TodayDate + " " + @Time + " " + $UserName + " " + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
for $iiii = 2 to $L1
if $iiii <= $MaxLogs
$TheLine = $HoldLogs[$iiii] + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
endif
next
$TheLine = "==========================" + chr(13) + chr(10)
$x = WriteLine(1,$TheLine)
$x = close(1)
endif
;cls
;? $LogFQN
;? $LogFQNIEError
;? $LogFQNError
;? $LogFQNIEUpdate55
;? $LogFQNIEUpdate60
;? $LogFQNIIS
;? $LogFQNW2KWin
;? $LogFQNW2KSP205
;? $LogFQNFoundFrag
;gets $eee
;==== write Sophos error file
if $SophosStatusCode = 0
copy $LogFQN $LogFQNError
else
if exist($LogFQNError)
del $LogFQNError
endif
endif
;==== write IE Explorer error file
if $IEVersionOK = 0
copy $LogFQN $LogFQNIEError
else
if exist($LogFQNIEError)
del $LogFQNIEError
endif
endif
;==== write IE Explorer patch file
if $IEPatch = "" and $IEVersionOK = 1
copy $LogFQN $LogFQNIEPatchError
else
if exist($LogFQNIEPatchError)
del $LogFQNIEPatchError
endif
endif
;==== write IIS Service error file
if $FoundIISAdmin = 1
copy $LogFQN $LogFQNIIS
else
if exist($LogFQNIIS)
del $LogFQNIIS
endif
endif
;==== write W2K Windows Service Pack error file
if $W2KWinErr = 1
copy $LogFQN $LogFQNW2KWin
else
if exist($LogFQNW2KWin)
del $LogFQNW2KWin
endif
endif
;==== write found virus fragments file
if $FoundFragments = 1
copy $LogFQN $LogFQNFoundFrag
else
if exist($LogFQNFoundFrag)
del $LogFQNFoundFrag
endif
endif
;=== show OK Box
if $SophosStatusCode = 1
$OKMessage = "Sophos " + $VersionNo + " audit results" + chr(10)
+ chr(10) + " PC is OK"
$Selection = MessageBox($OKMessage,"",0,1)
endif
;====== update IE to Ver 5.5 Sp2
if exist($LogFQNIEUpdate55)
del $LogFQNIEUpdate55
if exist($LogFQNIEPatchError)
del $LogFQNIEPatchError
endif
$Update55sp2 = "\\hmibdc2\bdc2_d\build\cleanup\ie5setupsp2.exe"
run $Update55sp2
quit
endif
;====== update IE to Ver 6.0
if exist($LogFQNIEUpdate60)
del $LogFQNIEUpdate60
if exist($LogFQNIEPatchError)
del $LogFQNIEPatchError
endif
$Update60 = "\\hmibdc2\bdc2_d\build\cleanup\ie6setup.exe"
run $Update60
quit
endif
;====== update IE Ver 5.5 Sp2 with patches
if exist($LogFQNIEPatch55)
del $LogFQNIEPatch55
$Patch55 = "\\tol-team1\build\iepatch\5.5\q313675.exe"
run $Patch55
quit
endif
;====== update IE Ver 6.0 with patches
if exist($LogFQNIEPatch60)
del $LogFQNIEPatch60
$Patch55 = "\\tol-team1\build\iepatch\6.0\q313675.exe"
run $Patch55
quit
endif
;====== update W2K Pro to SP2
if $ProductType = "Windows 2000 Professional"
if exist($LogFQNW2KSP205)
del $LogFQNW2KSP205
$UpdateSP2 = "\\hmibdc2\bdc2_d\build\sp2.bat"
run $UpdateSP2
quit
endif
endif
;====== run TrackIt if more than 45 days since last run
if $SegmentLoc <> "NOAUDIT"
$DaysTrack = $DaysToday - 200
if exist($TrackItLocalLoc)
;======= calc elapsed days for trackit date
$TrackItDate = getfiletime($TrackItLocalLoc)
$YearTrack = val(Substr($TrackItDate,1,4))
$MonthTrack = val(Substr($TrackItDate,6,2))
$DayTrack = val(Substr($TrackItDate,9,2))
$DaysTrack = ($YearTrack * 365) + ($MonthTrack * 30) + $DayTrack
endif
$ElapsedDaysTrack = $DaysToday - $DaysTrack
if $ElapsedDaysTrack > 45
$StartBanner = "TrackIt Audit will run for a couple of minutes." + chr(10)
+ "" + chr(10)
+ "Select OK and then let TrackIt Audit run." + chr(10)
+ "Do not close the TrackIt Audit prematurely!"
$Selection = MessageBox($StartBanner,"TrackIt Info Message",0,8)
$TrackItAudit = $SegmentLoc + "audit32.exe"
shell $TrackItAudit
$StartBanner = "TrackIt Audit Completed Sucessfully"
$Selection = MessageBox($StartBanner,"",0,3)
del $TrackItLocalLoc
if open(2,$TrackItLocalLoc,5) = 0
$TheLine = "dummy info"
$x = WriteLine(2,$TheLine)
endif
$x = close(2)
endif
endif
cls
quit
