Antivirus

as702 · **Joined:** Tue Jun 17, 2008 3:14 am **Posts:** 276

Appears to work fine. Tested using UBCD50b5 distribution (Parted Magic 3).

Icecube · **Joined:** Fri Jan 11, 2008 2:52 pm **Posts:** 1275

Should I suppress the following output?

Quote:

Connecting to google.com (64.233.187.99:80)
wget: can't open '/tmp/index.html': File exists

This is part of the code checks if there is a working internet connection.

I am glad that it works.

Did you also test xfprot?

as702 · **Joined:** Tue Jun 17, 2008 3:14 am **Posts:** 276

Yeah, get rid of that google stuff (maybe echo "Checking connection..." instead).

fpudate...not sure. I think it works(?).

Edit: I suspect it's working fine since the definitions are already up-to-date (see previous screen).

Victor Chew · **Joined:** Mon Feb 21, 2005 10:59 pm **Posts:** 1177

Quote:

Should I suppress the following output?
Quote:
Connecting to google.com (64.233.187.99:80)
wget: can't open '/tmp/index.html': File exists

This is part of the code checks if there is a working internet connection.

I second as702. It's kinda distracting. Would be even better if it tries to auto starts the network if it detects that there is no network connection.

Quote:

Did you also test xfprot?

I did under VMWare. Works like a charm!

Quote:

fpudate...not sure. I think it works(?).

fpupdate is too quiet.

Too bad it doesn't have a "--verbose" switch to make it display more output.

Quote:

You have to change the 2 help files for Parted Magic completely.

Done! But it's still for PMagic30. I will wait for the official PMagic31 before including it.

Icecube · **Joined:** Fri Jan 11, 2008 2:52 pm **Posts:** 1275

Victor Chew wrote:

Quote:

Should I suppress the following output?
Quote:
Connecting to google.com (64.233.187.99:80)
wget: can't open '/tmp/index.html': File exists

This is part of the code checks if there is a working internet connection.

I second as702. It's kinda distracting. Would be even better if it tries to auto starts the network if it detects that there is no network connection.

Patrick Verner doesn't make automatically a connection when a program requires this. There are also different ways (dhcp, static IP, ...) to connect to the internet. It is up to the user to configure it properly. SO I don't want to do this either for the moment.

In my test version I have silenced the google and wget output.

Victor Chew wrote:

Quote:

Did you also test xfprot?

I did under VMWare. Works like a charm!

Quote:

fpudate...not sure. I think it works(?).

fpupdate is too quiet.

Too bad it doesn't have a "--verbose" switch to make it display more output.

I think that I will edit fpupdate in the same way as the bash script that gets called by xfport's update function.

Icecube · **Joined:** Fri Jan 11, 2008 2:52 pm **Posts:** 1275

I found a way to update the f-prot definition files without using fpupdate. So this update method also works on windows.

Go the following link: http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2

For scripting you can use

Code:

wget -O fprot-update-link.xml "http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2"

The contents of the xml file (fprot-update-link.xml if you use the wget command above):

Quote:

<?xml version="1.0" encoding="ISO-8859-1"?>
<response>
<return><code>0</code><desc>Valid key</desc></return>
<servers><item weight="10">srv4.directupdates.f-prot.net</item><item weight="10">srv4.directupdates.f-prot.net</item></servers>
<components><item type="deffile"><name>antivir.def</name><path>/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def</path><uniqid><item type="defid">20081002105095f12f85faa69596e3eb299ddfa83dbb</item><item type="md5">97b8b646de317718e5fe6fcc14e03ed1</item><item type="sha1">b42ecc20edef6ebe21873a69fcf141ee1d1628d5</item><item type="size">33407284</item></uniqid></item></components>
<programversion></programversion>
</response>

To download the new definition file concatenate the 2 green parts:
http://srv4.directupdates.f-prot.net/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def

Code:

wget http://srv4.directupdates.f-prot.net/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def

Then you can can compress the files with 7z (will write this part later).

To download the last definition files for clamav, do:

Code:

wget http://db.local.clamav.net/main.cvd
wget http://db.local.clamav.net/daily.cvd

For linux I have this script:

Code:

#!/bin/sh
mkdir -p /tmp/clamav/usr/share/clamav/
echo -e "Start downloading the definition files for ClamAV:\n\n"
wget -P /tmp/clamav/usr/share/clamav/ http://db.local.clamav.net/daily.cvd
echo
wget -P /tmp/clamav/usr/share/clamav/ http://db.local.clamav.net/main.cvd

echo -e "\n\nMake clamav-definitions.7z ...\n"

# 7zip the definition files of clamav
7za a -mx=9 -ms=on './clamav-definitions.7z' '/tmp/clamav/*'

if [ $? = 0 ]; then
    echo -e "\nYou can find the updated 'clamav-definitions.7z' at './clamav-definitions.7z'."
    echo "Copy it to the /pmagic/pmodules/ directory of your usb thumb drive or to your hard drive."
    read -s -n1
    exit 0
else
    echo -e "\nSomething went wrong while compressing the definition files."
    read -s -n1
    exit 1
fi

NoSubstitute · **Joined:** Fri Jan 11, 2008 12:41 am **Posts:** 5

Icecube wrote:

I found a way to update the f-prot definition files without using fpupdate. So this update method also works on windows.

Go the following link: http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2

For scripting you can use

Code:

wget -O fprot-update-link.xml "http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2"

The contents of the xml file (fprot-update-link.xml if you use the wget command above):

Quote:

<?xml version="1.0" encoding="ISO-8859-1"?>
<response>
<return><code>0</code><desc>Valid key</desc></return>
<servers><item weight="10">srv4.directupdates.f-prot.net</item><item weight="10">srv4.directupdates.f-prot.net</item></servers>
<components><item type="deffile"><name>antivir.def</name><path>/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def</path><uniqid><item type="defid">20081002105095f12f85faa69596e3eb299ddfa83dbb</item><item type="md5">97b8b646de317718e5fe6fcc14e03ed1</item><item type="sha1">b42ecc20edef6ebe21873a69fcf141ee1d1628d5</item><item type="size">33407284</item></uniqid></item></components>
<programversion></programversion>
</response>

To download the new definition file concatenate the 2 green parts:
http://srv4.directupdates.f-prot.net/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def

Code:

wget http://srv4.directupdates.f-prot.net/files/defs/v.6/20081002-1202-d7b970dea7f3d1ad260d53b53dff9c1a/antivir.def

Then you can can compress the files with 7z (will write this part later).

I had a friend help me script this part.
Here's something that works in linux, but sadly not in windows. Perhaps someone here can help us debug it so it works in windows too. I have most of the GNUWin32 tools needed and a working install of Strawberry Perl, but I'm getting errors when trying to run it in windows vista.

Code:

wget -O fprot-update-link.xml "http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2"
cat fprot-update-link.xml | perl -ne 'print "http://"; $line=~s/<servers><item.*?>(.*)?<\/item>/$1/; print $line; $line2=~s/<path>(.*)?<\/path>/$1/; print $line2;' | wget -O \opt\f-prot\antivir.def

grr, silly tags. The above code should only be 2 lines of text.
The 1st wget-line ends with the 'CABA2"'.
The 2nd line begins with 'cat' and ends with '.def'.
Please, edit and verify code to suit your/our needs.

Icecube · **Joined:** Fri Jan 11, 2008 2:52 pm **Posts:** 1275

I have a working version for a long time now.
It is a lot longer than 2 lines (114 for the moment). Most code does check if the paths exists and if there is a newer version online or that we already have the last files and it has a lot of comments and echo lines. It also compresses the output to a 7zip archive.

Perl is a no-go (doesn't come preinstalled on Windows) because it is relatively large.

Here is a stripped down version (no error checking whatsoever):

Quote:

#!/bin/bash

mkdir -p "/tmp/ubcd-temp/fprot/definitions/opt/f-prot/"
FPROT_TEMPDIR='/tmp/ubcd-temp/fprot'

wget -O "${FPROT_TEMPDIR}/fprot-update-link.xml" 'http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2'

URL_UPDATE_SITE=`grep -m 1 -o srv[[:digit:]].directupdates.f-prot.net "${FPROT_TEMPDIR}/fprot-update-link.xml"`
URL_UPDATE_PATH=`grep -m 1 -o /files/defs/.*/antivir.def "${FPROT_TEMPDIR}/fprot-update-link.xml"`

# Download antivir.def file
wget -P "${FPROT_TEMPDIR}/definitions/opt/f-prot/" "${URL_UPDATE_SITE}${URL_UPDATE_PATH}"

# Compress, the definition file of F-Prot
7z a -mx=9 -ms=on 'fprot-definitions.7z' "${FPROT_TEMPDIR}/definitions/*"

The bold lines replace the perl stuff in your script.

For Windows, you can change:/tmp/ to the temp directory of the user.

From Windows you can run fprot.cmd:

Code:

@echo off
setlocal
set path=unxutils\bin;%PATH%
bash --norc fprot.sh
endlocal

Put all GNUWin32 tools in unxutils\bin (or edit the set path line to the right directory).

NoSubstitute · **Joined:** Fri Jan 11, 2008 12:41 am **Posts:** 5

Thank you

I ended up doing this in linux, since it never really worked for me in windows.

NoSubstitute · **Joined:** Fri Jan 11, 2008 12:41 am **Posts:** 5

I totally forgot to come back here and post my working code.

Code:

@echo off 
rem START of batch file

REM Updating F-PROT definitions.
REM Create TEMP dirs. Only needed on first run.
REM mkdir .\tmp\fprot\definitions\opt\f-prot

REM Cleaning up old files
del /Q fprot-definitions.7z
REM Cleaning up old temporary files
del /Q update
del /Q .\tmp\fprot\*.*
del /Q .\tmp\fprot\definitions\opt\f-prot\*.*

REM Downloading update xml
wget -O ".\tmp\fprot\fprot-update-link.xml" "http://directupdates.f-prot.net/cgi-bin/get_update_info?protocol=2&key=AFPXJ5KN83983257LJHG64S7NSTA6CABA2"

REM Pulling the relevant info from the update xml
setlocal enableextensions 
 
for /f "tokens=*" %%a in ( 
'grep -z -m 1 -o srv[[:digit:]].directupdates.f-prot.net ".\tmp\fprot\fprot-update-link.xml"'
) do ( 
set updsite=%%a 
) 
 
for /f "tokens=*" %%b in ( 
'grep -z -m 1 -o /files/defs/.*/antivir.def ".\tmp\fprot\fprot-update-link.xml"'
) do ( 
set updpath=%%b 
)

REM Concatenating the two values above into a single line variable with a leading http:// (else wget complains)
set updateurl=http://%updsite%%updpath%
echo/%updateurl% | sed "s/ //g" > update
set /p updatefull=<update

REM Download new defs
wget -P "./tmp/fprot/definitions/opt/f-prot/" %updatefull%

REM Compress, the definition file of F-Prot
7z a -mx=9 -ms=on fprot-definitions.7z ".\tmp\fprot\definitions\*"

REM Cleaning up temporary files
del /Q update
del /Q .\tmp\fprot\*.*
del /Q .\tmp\fprot\definitions\opt\f-prot\*.*

endlocal

REM Updating ClamAV definitions

REM Create TEMP dirs. Only needed on first run.
REM mkdir .\tmp\clamav\usr\share\clamav

REM Removing old files
del /Q clamav-definitions.7z
del /Q .\tmp\clamav\usr\share\clamav\*.*

REM downloading new defs
wget -P .\tmp\clamav\usr\share\clamav\ http://db.local.clamav.net/daily.cvd 
wget -P .\tmp\clamav\usr\share\clamav\ http://db.local.clamav.net/main.cvd 

REM Compressing new defs
7z a -mx=9 -ms=on .\clamav-definitions.7z .\tmp\clamav\*

REM Removing temporary files
del /Q .\tmp\clamav\usr\share\clamav\*.*

REM END of batch file

As you can see in the code the following files are needed:
7z.exe
wget.exe
sed.exe
grep.exe
also a few support files for 7z.

I packed them all in a file and put them here:
http://www.mediafire.com/?d4ymuygyzuu

Antivirus

Who is online