§ó·s¯f¬r½X(AVG)
§@ªÌ:csc@ocean-pioneer.com
³Ì«á§ó·s¤é´Á:2004/03/31

AVG(www.grisoft.com)AVG6.0
¥»¤H¦Û¤v¼g¤F¤@­Ó¤pµ{¦¡,¥i¥H¦blinux¤U¦Û°Ê¤ñ¹ï¯f¬r½X¦@¤U¸ü³Ì·s¤Î¦bclientºÝwindows°õ¦æ§ó·sªºµ{¦¡


§ó·sAVG(°Ñ¦ÒAVGªºhelp ÀÉ)
AVG¨¾¬rµ{¦¡,´£¨Ñ³æ¤@ªº¤èªk¨Ó§ó·s,¤£¥u¬O¯f¬r½XÁÙ¥]§t¤Fµ{¦¡ªº§ó ·s,¥¦¥þ³¡À£ÁY¦b¤@­Ó§ó·sÀɤ¤
¦p¦ó¤â°Ê§ó·s,¨ìºô¯¸¤U¸üÀÉ®×*.bin¨Ã±NÀɮשñ¦bavg¦w¸Ë¥Ø¿ý¤U (¹w³]C:\Program Files\Grisoft\AVG6)ªºupdate¥Ø¿ý,±Ò°Êµ{¦¡avgw.exe,¸Óµ{¦¡´N·|¦Û°ÊÀˬd¬O§_»Ý­n§ó·s,¦pªG»Ý­n§ó·s«h·|±Ò°Ê§ó·sªº¨B ÆJ

¥H¤U¬O¤@¨Çµ{¦¡ªº°ò¥»°ÝÃD
  1. ¯f¬r½Xªº¸ê°T¦b¨ºùØ:ftp://ftp.grisoft.com/pub/softw/60/xx/avg6info.ctf
  2. AVG CTF File
    "d600ppxe.bin" s=2484161 v=6 t=120 r=0 l=2 ;
    "d6032pgl.bin" s=1547353 v=6 t=516 r=515 l=7 ;
    "d6032lhj.bin" s=3775889 v=6 t=516 r=0 l=7 ;
    "../xx/u6122pdc.bin" s=3011303 v=6 t=639 r=516 l=0 ;
    "../xx/u6122wbc.bin" s=959041 v=6 t=639 r=606 l=0 ;
    "../xx/u6122xxo.bin" s=801149 v=6 t=639 r=627 l=0 ;
  3. §Ú·Q¦pªG¥¿±`§ó·s«hª©¥»ªº®t²§¦b³Ì¤pªº½d³ò¤º,«h³Ì«á¤@¦æ´N¬O³Ì«á»Ý­n§ó·sÀÉ®×,u6122xxo.bin Àɮפj¤ps=801149,¨¾¬r³nÅ骺ª©¥»v=6,§ó·sµ{¦¡ªºª©¥»t=639,­n§ó·s¨ìªºª©¥»¤~¥i¥H¨Ï¥Î³o­Óª©¥»
  4. ¤U¸üÀÉ®×ftp://ftp.grisoft.com/pub/softw/60/xx/avginfo.ctf,Àˬd³o­ÓÀɮשM§AªºÀÉ®×, §Ú²q·Q¾ã­ÓÀɮפ£¬Û¦P´N¬O»Ý­n§ó·s,¦]¦¹¤U¸ü¨Ã¤ñ¹ïAVGINFO.CTF,¤£¦P«h¤U¸ü§ó·s
  5. ¨Ï¥Îpython»y¨¥¨Ó¼g
  6. ¨ä¥¦ªº³nÅé¤u¨ãlinux(wget,grep),windows(autoit)
  7. ¦bAVGªº¦w¸Ë¥Ø¿ý¤U¦³¤@­Ó§ó·s°O¿ýÀÉupdate.log
    ®Ú¾Ú»¡©ú¦b§ó·sÀÉbin¤º¥i¯à§t¦³¯f¬r½X,©Î¨ä¥¦§ó·s¤¸¥ó(¬O¤@­ÓÀ£ÁYÀÉ),¦]¦¹¤ÀªR¤W­zÀÉ®×ÅçÃÒu6122xxo.bin¥]§t¤F version.avg, avgcore.vxd,avg.ovl,microavi.avg,¦Ó°õ¦æavgw.exe®É·|ÀˬdbinÀÉ,¨Ã§ó·s¥²­n§ó·sªº¤¸¥ó
¹ê§@
  1. ¨Ï¥Îwget -O /tmp/avg6info.ctf ftp://ftp.grisoft.com/pub/softw/60/xx/avg6info.ctf
  2. ¨Ï¥Îpython¼Ò²Õre
    f=open("/tmp/avg6info.ctf").readlines()
    parse_string=f[len(f)-1]  ·|¨ú±o³Ì«á¤@¦æ
    "../xx/u6122xxo.bin" s=801149 v=6 t=639 r=627 l=0 ;
    last_file=re.search('[a-zA-Z0-9]*.bin',parse_string)     ³Ì«áÀɮצWºÙ
    last_version=re.search('t=[0-9][0-9][0-9]',parse_string) ³Ì«áªºª©¥»
    last_filesize=re.search('s=[0-9]*',parse_string)         ³Ì«áÀɮתº¤j¤p
  3. ¦]¬°¯f¬r½Xªº¦WºÙ¬°*.bin,§Ú­Ì¥u­n±NÀɮשñ¦b¥Ø¿ý¤U,§R°£ÂÂ*.bin
  4. ¦øªA¾¹ºÝ:¤U¸ü¤Î§ó·s¯f¬r½X
    ±N¥»µ{¦¡©ñ¦bcron.daily,¨Ã¦Û¤v­×§ïwork_dir°Ñ ¼Æ,³o¬O§A©ñ¸m¯f¬r½X©Ò¦b
    «h¨C¤Ñ·|¥hAVGªººô¯¸Àˬd¬O§_§ó·s¦pªG§ó·s«h¤U¸ü¨ìwork_dir¨Ã §ó§ïÀɦW¬°,¦]¬°§Úªº¤À¨É¥Ø¿ý©ñ¦bhpnse45ªºNT4.0ªº¦øªA¾¹¤W¦]¦¹¦h°õ¦æ¤Fmountªº«ü¥O,§A¥i¥H®Ú¾Ú§A»Ý¨D¨Ó­×§ï
  5. ¦]À³§O¤H­n¨Demail ³qª¾,¨Ï¥ÎÃþ§Osmtplib
    server=smtplib.SMTP('localhsot')
    server.sendmail("±H¥óªÌ","¦¬¥óªÌ","¤º®e") -¦pªG»Ý­n¥D¦®½Ð¥[¦b¤º®e"Subject: ¤å¦r \n¨ä¥¦¤º®e"
    server.quit()
  6. ¸ÕµÛ¨Ï¥Î¥~³¡¶l¥ó,¤]´N¬O¼g¦n¤@­Ó¶l¥ó,Ū¶i¨ÓµM«á¨Ï¥Î5ªº©R¥O¨Ó°email
  7. rm ¥i¥H¦X¨Örm -f *.txt & rm -f *.bin ¬° rm -f *.txt *.bin¤§Ãþ
avg.py(¥i¥H¨Ï¥Î¦ý©|¥¼§ó·s¨ì³Ì·s)
#!/usr/bin/python
import re,string,commands,sys,string,os.path
import smtplib
from time import localtime,time,strftime

status_n,status_s=commands.getstatusoutput('mount -t smbfs -o username=abc,password=abc //hpnse45/vol1 /mnt/update_v')
if status_n:
   print " Mount my other smb file error!"
   sys.exit(1)


work_dir='/mnt/update_v/temp/update_v/avg'
version_file='avg6info.ctf'

#avg ftp site
avg_ftp="ftp://ftp.grisoft.com"

#virus info data
virus_data_url='/pub/softw/60/xx/avg6info.ctf'
virus_data_dir='/pub/softw/60/xx'


#Email notify when update
#Email_notify=1 enable email notify otherwise Email_notiyf=0 to turn it off
email_notify=1
notify_from ="set you sender email address"
notify_email="your email address"
notify_time=strftime('%m-%d-%H:%M',localtime(time()))
notify_message="AVG update virus at "+notify_time
notify_subject='Update AVG notify'


print "Download virus info file....."
virus_info_url=avg_ftp+virus_data_url
print virus_info_url
status_n,status_s=commands.getstatusoutput('wget -O /tmp/avg6info.ctf '+virus_info_url)
if status_n:
    print "Download virus information file  error!"
    sys.exit(1)
else :
    print "Download successful !"
 
last_file=open("/tmp/avg6info.ctf").readlines()

parse_string=last_file[len(last_file)-1]
last_file=re.search('[a-zA-Z0-9]*.bin',parse_string)
if last_file==None:
   print "Parse last file  error !"
   sys.exit(1)
last_file=last_file.group()
last_version=re.search('t=[0-9][0-9][0-9]',parse_string)
if last_version==None:
   print "Parse last file version error !"
   sys.exit(1)
last_version=last_version.group()
last_filesize=re.search('s=[0-9]*',parse_string)
if last_filesize==None:
   print "Parse last file size error !"
   sys.exit(1)
last_filesize=last_filesize.group()
print "=======last virus file ========"
print "file ="+last_file
print "version="+last_version[2:]
print "size="+last_filesize[2:]
print "*******************************"
need_update=0
#compare version file and last_file
if os.path.exists(work_dir+"/"+version_file):
   current_file=open(work_dir+"/"+version_file).readlines()
   parse_string=current_file[len(current_file)-1]
  
   current_file=re.search('[a-zA-Z0-9]*.bin',parse_string)        
   if current_file==None:
      print "Parse current file error !"
      sys.exit(1)
   current_file=current_file.group()
   current_version=re.search('t=[0-9][0-9][0-9]',parse_string)
   if current_version==None:
      print "Parse current version error!"
      sys.exit(1)
   current_version=current_version.group()
   current_filesize=re.search('s=[0-9]*',parse_string) 
   if current_filesize==None:
      print "parse current file size error!"
      sys.exit(1)
   current_filesize=current_filesize.group()
   print "=======current file ==========="
   print "file="+current_file
   print "version="+current_version[2:]
   print "size="+current_filesize[2:]

   last_file=open("/tmp/avg6info.ctf").readline()
   current_file=open(work_dir+"/"+version_file).readline()
   if last_file==current_file:
      need_update=0
      commands.getstatusoutput('rm -f '+version_file)
   else:
      need_update=1
else:
   print "avg6info.ctf no exists ,need update!"
   need_update=1

if need_update==1: 
   #get last_file
   print "Download update file............."
   update_url=avg_ftp+virus_data_dir+"/"+last_file
   print update_url
   status_n,status_f=commands.getstatusoutput('wget -O /tmp/'+last_file+' '+update_url)
   if status_n:
      print "can't get last update file!"
      sys.exit(1)
   status_n,status_s=commands.getstatusoutput('rm -f '+work_dir+'/'+current_file)
   status_n,status_s=commands.getstatusoutput('rm -f '+work_dir+'/*.txt')
   status_n,status_s=commands.getstatusoutput('mv -f /tmp/'+last_file+' '+work_dir)

   if status_n:
      print "update bin file fails!"
   else:
      status_n,status_s=commands.getoutput('mv -f /tmp/'+version_file+' '+work_dir)
      if status_n:
          print "update version file fails!"
      else:
          if email_notify :
              notify_message="Subject: "+notify_subject+"\n"+notify_message+"\n version="+last_version[2:]
              server=smtplib.SMTP('localhsot')
              server.sendmail(notify_from,notify_email,notify_message)
              server.quit()
         print "complete update file!"
else:
   print "virus_file is up to date!"

status_s=commands.getoutput('umount /mnt/update_v')


serverºÝ¤U¸ü§ó·s³]©w
1.¨C¤Ñ¤@¦¸,±Nµ{¦¡ª½±µ½Æ»s¨ì/etc/cron.daily,§ïÅܬ°¥i¥H°õ¦æchmod +x avg.py
2.ª`·Nsamba¤À¨ÉªºÅv­­,¦]¬°¨Ï¥Îsamba¨Ó¤À¨É,Åv­­¥²¶·¥i¥HŪ,¦Óclient ­n¼g¤J¹q¸£¦WºÙ.txt
¦]¦¹­n¥i¥H¼g¤J
3.¨C¤Ñ¤G¦¸0ÂI10¤À,6ÂI10¤À,¦b/etc/cron.d(¦]¬°§ó·sªº³t«×¨S¦³³o»ò§Ö©Ò¥H¤@¤Ñ¤@¦¸´N¦n¤F)
  ¼g¤@­ÓÀÉ®×symantec
  10 0,6 * * *  root /root/symantec.py
  ·N¸q¦p¤U:
  ¤À ®É ¤é ¤ë ¶g  °õ¦æªÌªº¨­¥÷ °õ¦æªºµ{¦¡



client ºÝªº³B²z­ì«h
¦p¦ó±oª¾client¤w¸g§ó·s¤F,³Ì²³æªº¤èªk¦bserver¥Ø¿ý¤¤©ñ¸m¤@­ÓÀɮר̧Aªº¾÷¾¹©R¦W(¦p:server1.txt),·íseverºÝ§ó·s®É·| ±N¸ÓÃþ«¬ÀÉ®×§R°£(*.txt),¤@¥¹§A°õ¦æ§ó·s«á, ¦bserver³£·|¦³¤@­Ó§AªºÀÉ®×,´N¥i¥H®Ú¾Ú³o­ÓÀɮרӨM©w¬O§_­n§ó·s

¼g¤@­Óautoitªºµ{¦¡¨Ó°õ¦æ³o­Ó°Ê§@
avg.au3
if Not FileExists(@ScriptDir&"\"&@computername&".txt") Then
   filedelete("C:\Program Files\Grisoft\AVG6\UPDATE\*.bin")
   filecopy (@ScriptDir&"\*.bin","C:\Program Files\Grisoft\AVG6\UPDATE")
   run("C:\Program Files\Grisoft\AVG6\avgw.exe")
   FileOpen(@ScriptDir&"\"&@computername&".txt",2)
endif
exit
±N³o­Óµ{¦¡½sͦ¨¬°exeÀÉ
©ñ¦b¯f¬r½X§ó·s¥Ø¿ý¤¤´N¥i¥H,¦]¬°§Ú¬O³]¦b/home/samba/vol1/update_v/avg¦]¦¹´N¥i¥H©ñ¦b³oùØ,«h±N³o­Ó¥Ø¿ý¤À¨É ¥X¥h´N¥i¥H,¨Ï¥Îµn¤Jªº¤è¦¡©Î¬O±Æµ{¨Ó§ó·s§Aªº¯f¬r½X

µn¤J§å¦¸Àɳ]©w
¥[¤J¤W­z¥Ø¿ýªº¤À¨É¸ô®|(¨Ò¦p:/home/samba/vol1¤À¨É¬°f:)
¨Ò:
f:\update_v\avg\avg.exe

¨C¦¸µn¤J·|Àˬd¦b°õ¦æavg.exe¥Ø¿ý¤U¬O§_¦³§A¹q¸£¦WºÙ.txt,¦pªG¨S¦³°õ¦æ§ó·sªº°Ê§@¨Ã¦b¸Ó¥Ø©ñ¸m¹q¸£ªº¦WºÙ.txt,«h§_´Nª½±µÂ÷¶}

¦pªG¤£¬O¨Ï¥Îµn¤Jºô°ìªº¤è¦¡,¨Ï¥Î±Æµ{µ{¦¡,¿ï¾Ü"¦b¨Ï¥ÎªÌµn¤J°õ¦æ"