Marked as: Advanced
Hello,
been busy writing a script to help you (and me) out to use ClamAV to scan your computer for virus/trojans etc.
The script make your system ready to run ClamDscan, download fresh new virus info and give you program objects to click on.
It doesn't touch the configuration files much, just remove the line "Example" so that you can use, but you should look and optionally change some settings there yourself. You may also want to schedule (if possible) new downloads with freshclam e.g. every day or every week.
Prerequisite: Yuri Dario's ClamAV ( http://web.os2power.com/yuri/ClamAV ) wpi-package installed on your computer
Additional/Optional addons: Script to scan mailserver downloads (clamfilt) on Weasel. You can find it on http://hobbes.nmsu.edu/cgi-bin/h-search?key=clamav
The script is actually 2, one installer and another built in that's written to disk to help you scan and either delete, move or just display found problems.
The installer script ask you about how you want it to handle a found virus.
A upper case letter within (y/N) indicate the default option where you can press enter to confirm the selection. You have to type the lower case letter followed by Enter to get the other behaviour, case doesn't matter though.
Note: ClamAV can't remove infections and clean them out as other AV tools. I've therefore set the default (if you press Enter to confirm the questions) to delete infected files! Some may want to examine the files first, while others want to confirm deletion of individual files or just get a list. You'll get different behavior depending on what you reply to the questions.
Installer:
Ask how you want the scanner to behave (see note above)
Searches your computer for ClamAV, first in the programs folder (Default in installer) and then drive by drive.
Create objects for refresh of Virus information
Download new Virus information
Create object for AV Scanner and if selected a folder to place infected files in (default is to delete without asking).
It can also copy the ClamAV Daemon to the autostart folder so that it'll start automatically at each system start.
//Jan-Erik
/* Find and add additional icons for scanning and removal of virus */
CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'
CALL SysLoadFuncs
CALL SysCls
cfg.1 = 'clamd'
cfg.2 = 'freshclam'
cfg.0 = 2
doexploits = 0
pauseonfound = 0
autostart = 0
SAY "Delete Virus/Trojans/Exploits etc.? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN DO
SAY "Move Virus/Trojans/Exploits to a folder for inspection (Y/n)?"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) <> 'N' THEN
doexploits = 2
END
ELSE doexploits = 1
IF doexploits = 1 THEN DO
SAY "Ask to delete found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
END
ELSE IF doexploits = 2 THEN DO
SAY "Ask to move found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
END
SAY "Start ClamAV Daemon Automatically at system start? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
autostart = 1
SAY SysGetMessage( 1004,, d2c(8)||'.' )
CALL SysFileTree VALUE( 'PROGRAMS',, 'ENVIRONMENT' )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 = 0 THEN DO
drives = SysDriveMap()
DO i = 1 to WORDS( drives )
SAY SysGetMessage( 1658,, LEFT( SUBWORD( drives, i, 1 ), 1 ) )
CALL SysFileTree SUBWORD( drives, i, 1 )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 > 0 THEN LEAVE i
END
END
IF file.0 > 0 THEN DO
fpath = STRIP( FILESPEC( 'D', file.1 )||FILESPEC( 'P', file.1 ), 'T', '\' )
sze_etc = FILESPEC( 'D', file.1 )||FILESPEC( 'P', STRIP( FILESPEC( 'P', file.1 ), 'T', '\' ) )||'ETC'
tgt_etc = VALUE( 'ETC',, 'ENVIRONMENT' )
DO i = 1 TO cfg.0
IF STREAM( tgt_etc||'\'||cfg.i||'.conf', 'C', 'QUERY EXISTS' ) = '' THEN DO /* Don't overwrite existing config */
fsize = STREAM( sze_etc||'\'||cfg.i||'.conf', 'C', 'QUERY SIZE' ) /* Get size of template file */
IF fsize > 0 THEN DO /* If it has has size, then it must exist?! */
finput = CHARIN( sze_etc||'\'||cfg.i||'.conf', 1, fsize ) /* Read the whole file into memory */
CALL STREAM sze_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
fpos = POS( 'EXAMPLE', TRANSLATE( finput ), 100 ) /* Look for the text EXAMPLE if it exist (not the first one though), uppercase so that we cen ensure we get a match */
IF fpos > 0 THEN DO /* If we find it, fpos will contain the position larger than 0 */
INTERPRET 'PARSE VALUE finput WITH pre '||fpos||' +8 post' /* Split the text in 2 */
finput = pre||post /* Join the text again without Example */
END
CALL LINEOUT tgt_etc||'\'||cfg.i||'.conf', finput /* Write the text to the target file */
CALL STREAM tgt_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
END
END
END
CALL SysSetObjectData "<CLAMAV_FOLDER>", "OPEN=DEFAULT;"
IF SysCreateObject( "WPProgram", "Update Anti Virus Information", "<CLAMAV_FOLDER>", "EXENAME="||fpath||"\FRESHCLAM.EXE;OBJECTID=<FRESHCLAM>", "U" ) THEN DO
SAY SysGetMessage( 1662,, "Update Anti Virus Information" )
IF DIRECTORY( fpath ) <> '' THEN DO
SAY ""
SAY "Fetching New Anti Virus Information... Please wait"
'@freshclam'
END
END
ELSE
SAY SysGetMessage( 3211,, 'ClamAV Information' )
dclam = fpath||'\CLAMDEL.CMD'
IF STREAM( dclam, 'C', 'QUERY EXIST' ) <> '' THEN
retval = SysFileDelete( dclam )
IF doexploits = 0 THEN DO
SAY ""
SAY "Will just report infections..."
dclam = "EXENAME="||fpath||'\clamdscan.exe;PARAMETERS= --log="'||fpath||'\Virii.rpt"'
END
ELSE DO
CALL LINEOUT dclam, "/* Script to scan and remove infected files */"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'"
CALL LINEOUT dclam, "CALL SysLoadFuncs"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "SAY SysGetMessage( 1658,, LEFT( FILESPEC( 'D', ARG(1) ), 1 ) )"
CALL LINEOUT dclam, 'CALL SysFileDelete( "'||fpath||'\Virii.rpt" )'
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "'"||'@CLAMDSCAN --log="'||fpath||'\Virii.rpt" "'||"'||ARG(1)||'"||'"'||"'"
CALL LINEOUT dclam, "IF rc <> 0 THEN"
CALL LINEOUT dclam, 'DO WHILE LINES( "'||fpath||'\Virii.rpt" )'
CALL LINEOUT dclam, ' PARSE VALUE LINEIN( "'||fpath||'\Virii.rpt" ) WITH fname": "exploit" FOUND"'
CALL LINEOUT dclam, " fname = TRANSLATE( fname, '\', '/' )"
CALL LINEOUT dclam, " IF LENGTH( fname ) > 0 THEN"
CALL LINEOUT dclam, " IF STREAM( fname, 'C', 'QUERY EXISTS' ) <> '' THEN DO"
IF doexploits = 1 THEN DO
CALL LINEOUT dclam, " retval = SysFileDelete( fname )"
CALL LINEOUT dclam, " IF retval = 0 THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 3378 )"
END
ELSE DO
IF SysCreateObject( "WPFolder", "Infected files", fpath, "OBJECTID=<INFECTION_FOLDER>", "U" ) THEN
retval = SysCreateShadow( '<INFECTION_FOLDER>', '<CLAMAV_FOLDER>' )
ELSE SAY SysGetMessage( 1693 )
CALL LINEOUT dclam, " retval = SysMoveObject( fname, '<INFECTION_FOLDER>' )"
CALL LINEOUT dclam, " IF retval THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 1907,, 1 )"
END
IF pauseonfound THEN DO
CALL LINEOUT dclam, " ELSE DO"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
CALL LINEOUT dclam, " SAY SysGetMessage( 1739 )"
CALL LINEOUT dclam, " PARSE PULL answer"
CALL LINEOUT dclam, " IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN RETURN 0"
CALL LINEOUT dclam, " END"
END
ELSE DO
CALL LINEOUT dclam, " ELSE"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
END
CALL LINEOUT dclam, " END"
CALL LINEOUT dclam, "END"
CALL LINEOUT dclam, "CALL STREAM '"||fpath||"\Virii.rpt', 'C', 'CLOSE'"
CALL STREAM dclam, 'C', 'CLOSE'
dclam = "EXENAME="||dclam||";PARAMETERS="
END
SAY ""
IF SysCreateObject( "WPProgram", "ClamAV Scan", "<CLAMAV_FOLDER>", dclam||" ["||STRIP( STRIP( STRIP( SysGetMessage( 1480,, ' ' ),, D2C(10) ),, D2C(13) ) )||"];OBJECTID=<CLAMDSCAN>", "U" ) THEN
SAY SysGetMessage( 1662,, 'ClamAV Scan' )
ELSE SAY SysGetMessage( 3211,, 'ClamAV' )
IF autostart THEN
IF SysCreateShadow( '<CLAMAV_CLAMD>', '<WP_START>' ) THEN DO
SAY 'ClamAV Daemon '||SysGetMessage( 744 )
IF SysSetObjectData( "<CLAMAV_CLAMD>", "OPEN=DEFAULT;" ) THEN
SAY 'ClamAV Daemon '||SysGetMessage( 748 )
ELSE
SAY 'ClamAV Daemon '||SysGetMessage( 749 )
END
ELSE SAY SysGetMessage( 1249,, 'Autostart ClamAV Daemon' )
DO i = 1 TO cfg.0
CALL SysSetObjectData tgt_etc||'\'||cfg.i||'.conf', "OPEN=DEFAULT;"
END
SAY "You can now use ClamAV, but please take your time to check the settings and read the documentation!"
SAY SysGetMessage( 1032 )
PARSE PULL answer
END
ELSE DO
SAY ""
SAY SysGetMessage( 3211,, 'ClamAV' )
SAY SysGetMessage( 1975 )
END
This is an interesting project, that seems to compliment what I did. I do notice a couple of inconsistencies, that aren't too serious, but I thought I should mention them:
The option to add an icon, for the daemon, to the Startup folder, would seem to be unnecessary, since the WarpIn installer already does that. It may be best to eliminate that option, since it is possible that a user would simply assume that it needed to be done, and they will end up with two shadows of the daemon icon. That doesn't seem to cause a problem, but it could be confusing.
The term VIRII, while commonly used, is not the plural of VIRUS. The proper plural is VIRUSES.
I chose the options to delete files, after asking a question. The resulting script seems to work, but, it simply runs, and closes, leaving the user with no clue about what was found. I suggest adding a line to open the text editor, with the log file, so a user can see the results. I also made a couple of other changes, to better match what I did in my setup. I changed the log file to go into the directory with the rest of my log files, and, I changed the name to dClam.log. Other than that, it seems to work pretty good, although I haven't seen what it does with an actual virus, yet. The ClamAV Scan icon could be used as a direct replacement to the ClamDscan icon, that I describe in my instructions (usingclamavr1 at HOBBES). Good start anyway... :)
Hello,
yes, tried to follow the instructions from you and Dario on what to include and configure.
Regarding adding a shadow to autostart ClamAV 0.93.1.
The WarpIn package contain the following objects and shadows only:
WPS Object: WPFolder ClamAV <WP_DEKSTOP> OBJECTID=<CLAMAV_FOLDER>;
WPS Object: WPShadow Readme 1st <CLAMAV_FOLDER> OBJECTID=<CLAMAV_README>;SHADOWID=$(1)\ReadMe.txt
WPS Object: WPShadow Documentation <CLAMAV_FOLDER> OBJECTID=<CLAMAV_DOCS>;SHADOWID=$(1)\docs
WPS Object: WPProgram ClamAV 0.93.1 daemon <CLAMAV_FOLDER> EXENAME=$(1)\bin\clamd.exe;OBJECTID=<CLAMAV_CLAMD>;ICONFILE=$(1)\bin\clamd.ico;TITLE=ClamAV 0.93.1 daemon;
so I'll leave it as it is...
"Viruses", of course, I'll adjust it!
I have 10000's of messages (>4Gb), and some do contain viruses, trojan, exploits etc. that ClamAV report.
I've tested the script several times with the different configurations set and it can report that I currently have messages containing problems such as
HTML.Phising.Pay-51 FOUND
Email.Phishing.RB-3365 FOUND
while I used it earlier to delete several messages that contained trojans and a few viruses.
I'll modify the script to your suggestions, but please do add your script (version) here too, it may suit more people better.
Another possible improvement would be to write a log and open it, so that the user can see what has been removed and not. But I leave that for you all to think about for a while. ;)
//Jan-Erik
Version 2:
/* Find and add additional icons for scanning and removal of virus */
CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'
CALL SysLoadFuncs
CALL SysCls
cfg.1 = 'clamd'
cfg.2 = 'freshclam'
cfg.0 = 2
doexploits = 0
pauseonfound = 0
autostart = 0
showlog = 1
SAY "Delete Virus/Trojans/Exploits etc.? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN DO
SAY "Move Virus/Trojans/Exploits to a folder for inspection (Y/n)?"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) <> 'N' THEN
doexploits = 2
END
ELSE doexploits = 1
IF doexploits = 1 THEN DO
SAY "Ask to delete found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
SAY "Show log afterward? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN
showlog = 0
END
ELSE IF doexploits = 2 THEN DO
SAY "Ask to move found Virus/Trojan/Exploit? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
pauseonfound = 1
SAY "Show log afterward? (Y/n)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN
showlog = 0
END
SAY "Start ClamAV Daemon Automatically at system start? (y/N)"
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'Y' THEN
autostart = 1
SAY SysGetMessage( 1004,, d2c(8)||'.' )
CALL SysFileTree VALUE( 'PROGRAMS',, 'ENVIRONMENT' )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 = 0 THEN DO
drives = SysDriveMap()
DO i = 1 to WORDS( drives )
SAY SysGetMessage( 1658,, LEFT( SUBWORD( drives, i, 1 ), 1 ) )
CALL SysFileTree SUBWORD( drives, i, 1 )||'\*CLAMDSCAN.EXE', 'file.', 'SFO'
IF file.0 > 0 THEN LEAVE i
END
END
IF file.0 > 0 THEN DO
fpath = STRIP( FILESPEC( 'D', file.1 )||FILESPEC( 'P', file.1 ), 'T', '\' )
sze_etc = FILESPEC( 'D', file.1 )||FILESPEC( 'P', STRIP( FILESPEC( 'P', file.1 ), 'T', '\' ) )||'ETC'
tgt_etc = VALUE( 'ETC',, 'ENVIRONMENT' )
DO i = 1 TO cfg.0
IF STREAM( tgt_etc||'\'||cfg.i||'.conf', 'C', 'QUERY EXISTS' ) = '' THEN DO /* Don't overwrite existing config */
fsize = STREAM( sze_etc||'\'||cfg.i||'.conf', 'C', 'QUERY SIZE' ) /* Get size of template file */
IF fsize > 0 THEN DO /* If it has has size, then it must exist?! */
finput = CHARIN( sze_etc||'\'||cfg.i||'.conf', 1, fsize ) /* Read the whole file into memory */
CALL STREAM sze_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
fpos = POS( 'EXAMPLE', TRANSLATE( finput ), 100 ) /* Look for the text EXAMPLE if it exist (not the first one though), uppercase so that we cen ensure we get a match */
IF fpos > 0 THEN DO /* If we find it, fpos will contain the position larger than 0 */
INTERPRET 'PARSE VALUE finput WITH pre '||fpos||' +8 post' /* Split the text in 2 */
finput = pre||post /* Join the text again without Example */
END
CALL LINEOUT tgt_etc||'\'||cfg.i||'.conf', finput /* Write the text to the target file */
CALL STREAM tgt_etc||'\'||cfg.i||'.conf', 'C', 'CLOSE' /* Ensure that it's closed properly */
END
END
END
CALL SysSetObjectData "<CLAMAV_FOLDER>", "OPEN=DEFAULT;"
IF SysCreateObject( "WPProgram", "Update Anti Virus Information", "<CLAMAV_FOLDER>", "EXENAME="||fpath||"\FRESHCLAM.EXE;OBJECTID=<FRESHCLAM>", "U" ) THEN DO
SAY SysGetMessage( 1662,, "Update Anti Virus Information" )
IF DIRECTORY( fpath ) <> '' THEN DO
SAY ""
SAY "Fetching New Anti Virus Information... Please wait"
'@freshclam'
END
END
ELSE
SAY SysGetMessage( 3211,, 'ClamAV Information' )
dclam = fpath||'\CLAMDEL.CMD'
IF STREAM( dclam, 'C', 'QUERY EXIST' ) <> '' THEN
retval = SysFileDelete( dclam )
IF doexploits = 0 THEN DO
SAY ""
SAY "Will just report infections..."
dclam = "EXENAME="||fpath||'\clamdscan.exe;PARAMETERS= --log="'||fpath||'\dClam.log"' /* changed name to dClam.log */
END
ELSE DO
CALL LINEOUT dclam, "/* Script to scan and remove infected files */"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'"
CALL LINEOUT dclam, "CALL SysLoadFuncs"
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "SAY SysGetMessage( 1658,, LEFT( FILESPEC( 'D', ARG(1) ), 1 ) )"
CALL LINEOUT dclam, 'CALL SysFileDelete( "'||fpath||'\dClam.log" )' /* changed name to dClam.log */
CALL LINEOUT dclam, ""
CALL LINEOUT dclam, "'"||'@CLAMDSCAN --log="'||fpath||'\dClam.log" "'||"'||ARG(1)||'"||'"'||"'" /* changed name to dClam.log */
CALL LINEOUT dclam, "IF rc <> 0 THEN"
CALL LINEOUT dclam, 'DO WHILE LINES( "'||fpath||'\dClam.log" )' /* changed name to dClam.log */
CALL LINEOUT dclam, ' PARSE VALUE LINEIN( "'||fpath||'\dClam.log" ) WITH fname": "exploit" FOUND"' /* changed name to dClam.log */
CALL LINEOUT dclam, " fname = TRANSLATE( fname, '\', '/' )"
CALL LINEOUT dclam, " IF LENGTH( fname ) > 0 THEN"
CALL LINEOUT dclam, " IF STREAM( fname, 'C', 'QUERY EXISTS' ) <> '' THEN DO"
IF doexploits = 1 THEN DO
CALL LINEOUT dclam, " retval = SysFileDelete( fname )"
CALL LINEOUT dclam, " IF retval = 0 THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 3378 )"
END
ELSE DO
IF SysCreateObject( "WPFolder", "Infected files", fpath, "OBJECTID=<INFECTION_FOLDER>", "U" ) THEN
retval = SysCreateShadow( '<INFECTION_FOLDER>', '<CLAMAV_FOLDER>' )
ELSE SAY SysGetMessage( 1693 )
CALL LINEOUT dclam, " retval = SysMoveObject( fname, '<INFECTION_FOLDER>' )"
CALL LINEOUT dclam, " IF retval THEN"
CALL LINEOUT dclam, " SAY exploit||' -> '||SysGetMessage( 1907,, 1 )"
END
IF pauseonfound THEN DO
CALL LINEOUT dclam, " ELSE DO"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
CALL LINEOUT dclam, " SAY SysGetMessage( 1739 )"
CALL LINEOUT dclam, " PARSE PULL answer"
CALL LINEOUT dclam, " IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN"
IF showlog THEN /* Added option to show log if the user don't want to continue */
CALL LINEOUT dclam, " CALL SysSetObjectData '"||fpath||"\dClam.log', 'OPEN=DEFAULT;'" /* open dClam.log */
ELSE
CALL LINEOUT dclam, " RETURN 0 /* otherwise just leave. */
CALL LINEOUT dclam, " END"
END
ELSE DO
CALL LINEOUT dclam, " ELSE"
CALL LINEOUT dclam, " SAY SysGetMessage( 1249,, exploit||' -> '||fname )"
END
CALL LINEOUT dclam, " END"
CALL LINEOUT dclam, "END"
CALL LINEOUT dclam, "CALL STREAM '"||fpath||"\dClam.log', 'C', 'CLOSE'" /* changed name to dClam.log */
IF showlog THEN
CALL LINEOUT dclam, "CALL SysSetObjectData '"||fpath||"\dClam.log', 'OPEN=DEFAULT;'"
CALL STREAM dclam, 'C', 'CLOSE'
dclam = "EXENAME="||dclam||";PARAMETERS="
END
SAY ""
IF SysCreateObject( "WPProgram", "ClamAV Scan", "<CLAMAV_FOLDER>", dclam||" ["||STRIP( STRIP( STRIP( SysGetMessage( 1480,, ' ' ),, D2C(10) ),, D2C(13) ) )||"];OBJECTID=<CLAMDSCAN>;ICONFILE="||fpath||"\clamd.ico;NOAUTOCLOSE=YES", "U" ) THEN /* Added Icon To ClamD Program Object, New default is to leave VIO window open afterward (July 5, 2008) */
SAY SysGetMessage( 1662,, 'ClamAV Scan' )
ELSE SAY SysGetMessage( 3211,, 'ClamAV' )
IF autostart THEN
IF SysCreateShadow( '<CLAMAV_CLAMD>', '<WP_START>' ) THEN DO
SAY 'ClamAV Daemon '||SysGetMessage( 744 )
IF SysSetObjectData( "<CLAMAV_CLAMD>", "OPEN=DEFAULT;" ) THEN
SAY 'ClamAV Daemon '||SysGetMessage( 748 )
ELSE
SAY 'ClamAV Daemon '||SysGetMessage( 749 )
END
ELSE SAY SysGetMessage( 1249,, 'Autostart ClamAV Daemon' )
DO i = 1 TO cfg.0
CALL SysSetObjectData tgt_etc||'\'||cfg.i||'.conf', "OPEN=DEFAULT;"
END
SAY "You can now use ClamAV, but please take your time to check the settings and read the documentation!"
SAY SysGetMessage( 1406 ) /* Corrected/Changed the message to "Press Enter to Continue..." */
PARSE PULL answer
END
ELSE DO
SAY ""
SAY SysGetMessage( 3211,, 'ClamAV' )
SAY SysGetMessage( 1975 )
END
My original instructions were missing an addition to the parameters field of the Daemon icon. The update is at HOBBES.
I would like to see the WPI updated, to include what you have developed, but I think it would help, if somebody, who knows what they are doing, could create a WPS extension to include the file, folder, and drive, menu extensions, to run these things (basically, what I do in my setup, but it isn't as good as it really should be). I have no idea what is required, to do that.
I have no doubt, that your program finds, and handles, found viruses. I just haven't actually seen it work.
I am still thinking about modifications to the resulting script, and I will post it, once I settle on, exactly, what I would like to see. That will take a couple of days, because I will be on a long day trip, tomorrow, and I have other things that need to take priority, today, and on Monday. If the WPI for ClamAV can be updated, most of the installation part (icons etc.), that you did, can be abandoned and the script, to run the scan, would be the main part. It should be possible to create a GUI type of interface, using DrDialog (which I am working at learning).
I need to think about this, some more. You have given me a few ideas, that I need to experiment with, but time is short, at the moment. Stay tuned...
Hello,
Great, we're eagerly awaiting the result, but take the time you need! :)
We'll get a neat GUI tool then since you're using DrDialog.
Don't hesitate to ask questions, post questions or discuss ideas here, it's a pleasure to peek into other peoples work.
//Jan-Erik
It is becoming evident, that I am just not going to have the time to do this, in the near future, so I will post the changes that I made to what your script produces. Perhaps it will give you some ideas about how to make your work a little better (IMO, it is up to you).
/* Script to scan and remove infected files */
CALL RxFuncAdd 'SysLoadFuncs', 'RexxUtil', 'SysLoadFuncs'
CALL SysLoadFuncs
virusReport='..\logs\ClamDel.log'
/* The following is not really necessary, but *NIX programs, generally, like the forawrd slash better */
UvirusReport=translate(virusReport,'/','\')
/* SAY SysGetMessage( 1658,, LEFT( FILESPEC( 'D', ARG(1) ), 1 ) ) */
SAY SysGetMessage( 1658,, ARG(1))
CALL SysFileDelete(virusReport)
'@CLAMDSCAN --log='UvirusReport' "'||ARG(1)||'"'
IF rc <> 0 THEN
DO WHILE LINES(virusReport)
PARSE VALUE LINEIN(virusReport) WITH fname": "exploit" FOUND"
fname = TRANSLATE( fname, '\', '/' )
IF LENGTH( fname ) > 0 THEN
IF STREAM( fname, 'C', 'QUERY EXISTS' ) <> '' THEN DO
retval = SysFileDelete( fname )
IF retval = 0 THEN
SAY exploit||' -> '||SysGetMessage( 3378 )
ELSE DO
SAY SysGetMessage( 1249,, exploit||' -> '||fname )
SAY SysGetMessage( 1739 )
PARSE PULL answer
IF LEFT( TRANSLATE( answer ), 1 ) = 'N' THEN RETURN 0
END
END
END
CALL STREAM virusReport, 'C', 'CLOSE'
'@E.EXE 'virusReport
EXIT