...

USING DOS BATCH FILES TO AUTOMATE YOUR COLLECTION

-- by Arkhangel

This article is for those people who actively collect viruses (which is

most of us) and are wanting to make it easier to sort and clean their

files. Everything expressed here in is totally the opinion of myself,

and you may choose to do something similar or not at all with your

collection. Choose whatever you'd like, and make it personal. That's half

the fun!!

PURPOSE

The use of DOS batch files in organizing your collection can help speed

the whole process up. I admit that it does take some time to create all

the files and make sure that everything does work, but it is worth it.

Once you have a system in place to organize your files, you just

double-click an icon and the computer does the rest. Much more efficient.

Here we will discuss how to create your BAT files, as well as how to

automate various tasks so that you can have as much free time as possible.

DIRECTORY

The first step we want to do is to figure out how you want to organize

your collection. Most of us already have this system in place. And we

all do things differently. Of course how you create the BAT files will

all be based on how you sort your collection. If you compress your

files, then you will have to add extra information to do this for you. For

the purpose of this article, I will describe how I do this with a few

extra comments.

Example directory structure:

-- AVP

-- DOWNLOAD

-- FPROT

-- LOGS

-- NEWVIRUS

-- TRADE

-- UNKNOWN

-- VS2000

-- VX -----

|----- BAITED

|----- CORRUPT

|----- FAKES

|----- F-PROT

|----- INTENDED

|----- MAIN

| |----- 0

| |----- 1

| |----- 2

| |----- 3

| |----- ..

| |----- D

| |----- E

| |----- F

|----- MULTIPLES

|----- NOT-VIRUS

|----- PARTS

|----- SCANSTR

| |----- CORRUPT

| |----- FAKES

|----- SUSPICIOUS

|----- WARNINGS

Most of the directories above should be self explanatory so I will not

go into it at the moment. This setup also might not work for everyone,

so feel free to personalize things for your taste. For the rest of this

article, we are going to assume that everything has been installed

already and that the paths for VS2000 and other tools are the default

paths. You might have to customize things for your setup.

TRADING

Now we will go step by step through the process and as we come across

it, we will explain. So, someone sends you their log files and their

request. Download these into the LOGS directory. Make sure the files you

have are "avp.log," "fprot.log", or "request.log" Pretty easy. Rename

where needed. Now, for our first BAT file. All batch files were created

and used at ROOT directory in my case, as this entire hard drive is for

viruses. Got to love it.

OK, now we will make "compare.bat" or something similar (Mine was

titled compare_logs.bat but it's your choice) and edit it as follows:

@ECHO OFF

D:

CD \

:BEGIN

CLS

IF EXIST D:\LOGS\AVP.LOG GOTO AVP

IF EXIST D:\LOGS\FPROT.LOG GOTO FPROT

GOTO END

:AVP

CD \VS2000\CONSOLE\VS2000\DOS

VS2000 -C D:\LOGS\AVP.LOG

MOVE NEWAVP.LOG D:\LOGS\NEWAVP.LOG

GOTO END

:FPROT

CD \VS2000\CONSOLE\VS2000\DOS

VS2000 -C D:\LOGS\FPROT.LOG

MOVE NEWFPROT.LOG D:\LOGS\NEWFPROT.LOG

GOTO END

:END

EXIT

For those who know what you're looking at...GREAT! Otherwise, let's

review some commands:

@ECHO OFF This will not output the commands to the screen.

:LABEL This command defines sections within the file to allow moving

around. Works with GOTO.

IF [NOT] EXIST ... This is our IF statement. IF something EXIST then

do this. What we are saying in our case is

if there is a file in the

D:\LOGS directory named AVP.LOG then GOTO AVP section. Pretty easy!

Now, once the program determines whether to do AVP or FPROT, then we

need to compare that log file with our collection. So, VS2000 -C is

perfect. After this compare just MOVE the NEWAVP.LOG file to the LOGS

directory for later use! Pretty simple process. So to recap, download the

log files and the request from your friend. Change name to "avp.log" or

"fprot.log" and then run the above file. Now you will have your

"newavp.log" in your LOGS directory.

NOW, the second part of the trade is getting their request together.

There are several ways of doing this and whatever you choose is good.

This is how we do it with a BAT file.

D:

CD \VS2000\CONSOLE\VS2000\DOS

VS2000 -IC D:\LOGS\REQUEST.LOG D:\TRADE\

CD \LOGS

REQUEST.BAT

This one is pretty simple. We are just telling VS2000 to copy the

requested files to the TRADE directory. From there you can simply compress

the request and send. I use to have automatic compression setup, but

have moved away from that for personal reasons. You can do whatever you'd

like though.

RECEIVING TRADE

Once you have sent your "newavp.log" and their requested files, they

should, in good faith, send you your request. Just download the files to

the DOWNLOAD directory. Uncompress all files. Then run this BAT file

(line spaces added to split up processes):

@ECHO OFF

D:

CD \AVP

AVPDOS32 /O- /S /Y /* /M /B /P /V /MD /MP /K /W+=AVPNEW.LOG

D:\DOWNLOAD

CD \VS2000\CONSOLE\STRIPLOG

STRIPLOG -MOD D:\AVP\AVPNEW.LOG D:\NEWVIRUS

CD \VS2000\CONSOLE\RENFILES

RENFILES -REC D:\NEWVIRUS

RENFILES -RC D:\NEWVIRUS

CD \VS2000\CONSOLE\FAKESCAN

FAKESCAN -PKM D:\NEWVIRUS

CD \VSTOOLS\FWEED

FWEED /SF /SP /SC /SS /SB /SD /M /SDIR D:\NEWVIRUS

CD \

COPY D:\NEWVIRUS\0*.* D:\VX\MAIN\0\*.* /-Y

.... entire HEX set ....

COPY D:\NEWVIRUS\F*.* D:\VX\MAIN\F\*.* /-Y

DEL D:\NEWVIRUS\*.* /Y

COPY D:\FWEED\BAITED\*.* D:\VX\BAITED\*.* /-Y

COPY D:\FWEED\CORRUPT\*.* D:\VX\CORRUPT\*.* /-Y

COPY D:\FWEED\FAKES\*.* D:\VX\FAKES\*.* /-Y

COPY D:\FWEED\PARTS\*.* D:\VX\PARTS\*.* /-Y

COPY D:\FWEED\SCANSTR\CORRUPT\*.* D:\VX\SCANSTR\CORRUPT\*.* /-Y

COPY D:\FWEED\SCANSTR\FAKES\*.* D:\VX\SCANSTR\FAKES\*.* /-Y

DEL D:\FWEED\*.* /Y

OK, let's start at the top. We are having AVP scan our DOWNLOAD

directory and create AVPNEW.LOG. Now, you have STRIPLOG move the files to the

NEWVIRUS directory. Then you have RENFILES rename extensions and then

to CRC32. Run FAKESCAN across the NEWVIRUS directory, then FWEED. Now

that you have a "clean" collection...let's copy the files.

The reason we did the COPY command with the /-Y argument was to see if

we already had this file in our collection. If you have "Some.Exe" and

the BAT tries to copy it again, it will let you know! After the copy,

then you can DEL the files (don't need them anymore) for the next use.

Next we copy the FWEED files to their appropriate directories, and then

DEL the FWEED directory for the next use. I did not take the time to

get into the VS2000 commands and what we were doing. VirusBuster has more

information for you within his program. Just read it!

Now with all of this, you have scanned the new files, found the ones

that were detected by AVP and then renamed their extensions, their CRC32

names, and moved them to the appropriate directory after making sure

that are not fakes, parts, or baited files. All within a matter of just

one click, leaving the unknown files alone for future AV updates!

AUTOMATED SCANNING AND UPDATING

I have had several people ask me how I do my automatic updating of my

definition files, scanning my collection, and then uploading the results

to my website. Well, it's time to fully explain what I do, and it's

extremely easy!!

First you want to update your definition files. FPROT comes with this

lovely utility to do this for you. Fprot-up.exe should be in the FPROT

directory. Use this and you will get all the updated file you need. AVP

will be different. Now this process still requires minimal user

assistance. What we have created so far is a way to FTP the daily updates from

Kaspersky to our AVP directory, but not the Cumulative or Weekly

updates. These still have to be done manually at this time. If we figure out

a way, we will definitely let you know. But here is the simple AVP

process:

CD \AVP

FTP -S:FTP.TXT DOWNLOADS0.KASPERSKY-LABS.COM

This will run the DOS FTP command and look for the subcommands within

FTP.TXT. So, here is the rest.

anonymous

email@domain.com

cd updates

binary

get avp.klb

get avp.set

get daily.avc

quit

So, FTP will log you in as anonymous, and then download your needed

updates in binary format then log you off. Works everytime!

So we have updated our definition files and need to scan the

collection. This is EXTREMELY similar to the BAT files you have seen for trading.

But here you go again:

DEL D:\LOGS\OLD.TXT

IF EXIST D:\LOGS\LIST.TXT REN D:\LOGS\LIST.TXT OLD.TXT

DIR D:\VX /W /S > D:\LOGS\LIST.TXT

CD \AVP

AVPDOS32 /O- /S /Y /* /M /B /P /V /MD /MP /K /W+=AVP.LOG D:\VX

CD \LOGS

COPY D:\AVP\AVP.LOG /Y

CD \FPROT

F-PROT /DUMB /ARCHIVE /PACKED /NOMEM /COLLECT /REPORT=FPROT.LOG D:\VX

CD \LOGS

COPY D:\FPROT\FPROT.LOG /Y

CD \VS2000\CONSOLE\VS2000\DOS

COPY D:\AVP\AVP.LOG /Y

COPY D:\FPROT\FPROT.LOG /Y

VS2000 -A FPROT.LOG

VS2000 -A AVP.LOG

VS2000 -L

VS2000 -G

VS2000 -GH

VS2000 -W

VS2000 -T AVP.LOG

VS2000 -T FPROT.LOG

CD \

CD \LOGS

DEL *.ZIP

PKZIP AVP.ZIP AVP.LOG

PKZIP FPROT.ZIP FPROT.LOG

DEL *.LOG

CD \

FTP -S:FTP.TXT FTP.MYSERVER.COM

The first few lines here are just something I do as a smaller reference

than the log files. What we are doing is exporting the DIR information

for the entire VX folder (including subdirectories) into a text file.

It's here just to show what can be done. The rest of the file scans

the directory, use VS2000 to sort and organize the information and then

FTP to the webserver. Again, we use FTP.TXT to tell the FTP program how

to update, and here this is important:

loginname

password

lcd d:\logs

ascii

put list.txt

binary

put fprot.zip

put avp.zip

lcd d:\vs2000\console\vs2000\dos

ascii

put stats.htm

disconnect

quit

You need to make sure that the BINARY and ASCII lines are in those

places. ZIP files will not work or open if uploaded in ASCII mode (I found

this out the hard way). After this entire process, you will have

updated your definition files, updated your log files, VS2000 database, and

uploaded your log files for other traders.

But wait, did I say something about automation?? How is this automation

is I have to run the file?? Well...let me show you the easy part!

WINDOWS! As much as I dislike Microsoft, so many things tend to be useful.

In our case, use the Task Scheduler and tell it to run these update

files at the specified times you would like to run them. In my case, I do

this early in the morning when I'm sleeping and just after Kaspersky

usually updates the daily defs. (I like in the USA, so a different

schedule than Russia.) I run the FPROT update first, then AVP, and then SCAN.

So this is how it is done. Like I said, there are several different

ways of doing things, and you might have to change it around a bit to your

liking, but this will get you started.

HAPPY TRADING!!