4882l1.txt0100664000204600003300000000133607400510157011445 0ustar jillljedit4882l1 Listing 1. sigupdate Script #!/bin/sh mailto="admin@domain.com" tstamp=`date` hostname=`hostname` ### Create a temporary dir in /tmp pushd /tmp mkdir sigupdate pushd sigupdate ### Get signature update file via ftp ftp ftp.nai.com ### Unpack signature file export filename=`ls dat-*.tar` tar -xf $filename ### Move signature files to virus-scan directory mv *.dat /usr/local/uvscan ### Clean up temp directory and leave rm $filename rm * popd rmdir sigupdate popd ### Send an e-mail to the administrator about update export output=`/usr/local/uvscan/uvscan --version` mail -s "VIRUS SIGNATURE FILES UPDATED" $mailto < /dev/null cd /var/spool/smtpd/incoming echo "The time is $tstamp" count=`ls --ignore=smtpd*_d -1 | wc -l` # See how many email there are export email_total=$((email_total+count)) # Increment the total daily email counter if [ $count -eq 0 ]; then # Only continue if there is mail to scan echo "" echo "No e-mails to scan." echo "" echo "There have been $email_total e-mails processed today." echo "There have been $virus_total viruses found today." echo "" exit 0 fi emails=(`ls --ignore=smtpd*_d *`) # Load email list into an array echo "Scanning ${emails[*]} for viruses..." echo "" max=$count # Set the max amount for our while loop count=0 while [ $count -lt $max ] # The main loop. One iteration per email do echo "+------------------------------------------------------------------+" echo "Scanning ${emails[$count]} now..." echo "+------------------------------------------------------------------+" echo "" ### Check and make sure email isn't too big---- filesize=`ls -lap ${emails[$count]} | awk '{print $5}'` # Check filesize echo "This email is $filesize bytes long" echo "The maximum allowable email size is $maxsize bytes." if [ $filesize -gt $maxsize ]; then echo "File ${emails[$count]} exceeds the email size limit of $maxsize bytes." echo "Moving it to $quarantine." mv ${emails[$count]} $quarantine mail -s "OVERSIZED E-MAIL ALERT" $mailto < from <$respondto> was quarantined in "$quarantine" due to a suspicious attachment named $attachment. The trigger was $results. endofinput export virus_total=$((virus_total+1)) # Increment our daily virus counter break else echo "Okay." echo "There is nothing obviously wrong with $infected " echo "" fi ### Second scanning pass---- echo "Second pass scans for attachments with embedded viruses like macros..." echo "" if infected=`grep -slf $matchesdoc ${emails[$count]}`; then results=`grep -nsf $matchesdoc $infected` echo "Found an attached document. Decoding and scanning it now." mkdir $infected"_d" # Make a temp directory for the attachment mv $infected $infected"_d" # Move the email into it cd $infected"_d" /usr/bin/metamail -w -r -q $infected # Decode the attachment if scanresults=`/usr/local/bin/uvscan --noboot --secure --norename -v --summary .`; then echo "" mv $infected .. cd .. rm -rf $infected"_d" mv -v ${emails[$count]} $outgoing echo "Okay. No viruses found in $attachment." echo "" else echo "" cd .. mv $infected"_d" $quarantine echo "Found an infected file named $infected and moved it to $quarantine." echo "" mail -s "VIRUS INFECTED E-MAIL ALERT" $mailto < from <$respondto> was quarantined in "$quarantine" because the attached document named $attachment had a virus. The results were: $scanresults. An alert message was sent to <$respondto> letting them know about the virus. endofinput2 mail -s "VIRUS INFECTED E-MAIL ALERT" $respondto < /dev/null # Go back to where we came from ### Give a brief summary for command line use---- echo "There have been $email_total e-mails processed today." echo "There have been $virus_total viruses found today." ### Check and make sure mail isn't stacking up in the outqueue---- outqcount=`ls -1 $outgoing/* | wc -l` echo "There are $outqcount e-mails in the outgoing queue." echo "" if [ $outqcount -gt $outqthresh ]; then mail -s "MAIL BACKING UP IN OUT-QUEUE" $mailto < $etc/email-log.$date echo $virus_total > $etc/virus-log.$date ### Flush out the local sendmail queue---- /usr/sbin/sendmail -q exit 0 4882l3.txt0100664000204600003300000000152607400510157011450 0ustar jillljedit4882l3 Listing 3. grep Pattern Files -----matches.bad file---------------- filename.*\.vbs filename.*\.js filename.*\.exe filename.*\.scr filename.*\.bat filename.*\.com filename.*\.inf filename.*\.jsp filename.*\.jse filename.*\.pif filename.*\.reg filename.*\.vb filename.*\.vbe filename.*\.cmd filename.*\.msi filename.*\.lnk filename.*\.url filename.*\.vxd filename.*\.dll filename.*\.fav filename.*\.prf filename.*\.class filename.*\.ocx filename.*\.drv filename.*\.cif filename.*\.dun filename.*\.isp -----matches.doc file----------------- filename.*\.doc filename.*\.xls filename.*\.wpd filename.*\.dot filename.*\.htm filename.*\.html filename.*\.htt filename.*\.wk. filename.*\.123 filename.*\.pdf filename.*\.zip filename.*\.rar filename.*\.txt filename.*\.rtf filename.*\.dot filename.*\.xlt filename.*\.wri filename.*\.cab filename.*\.xml 4882l4.txt0100664000204600003300000000064307400510157011450 0ustar jillljedit4882l4 Listing 4. daysumm Script #!/bin/sh mailto="admin@domain.com" timestamp=`date '+%A - %B %d, %Y'` etc="/var/spool/smtpd/etc" date=`date '+%m%d%Y'` email_total=`cat $etc/email-log.$date` virus_total=`cat $etc/virus-log.$date` mail -s "DAILY E-MAIL SUMMARY" $mailto <