ClamWin Free Antivirus :: View topic - How I automated clamscans in my network using batch files

Posted: Mon Aug 23, 2010 4:44 pm

First, all the desktops had to have Clamwin installed. Our office installs it whenever we set up a new pc. You may wish to do it automatically to existing pc's. There are other threads to cover this.

Second: Using our group policy computer startup script (which applies only to xp boxes via filtration), I have the system check for the .bat upon every boot. If it does not find it, it copies it from a share and creates a scheduled task to run it at 9:30pm every night

This is the group policy computer startup script:

Code:

if exist C:\clamscan1.bat goto :label
echo ***************THE FOLLOWING COPIES \\10.0.1.5\Public\clamscan1.bat to the local disk **********************************>>c:\computerstartup.log
schtasks /create /TN Clamscan /SC DAILY /ST 21:30:00 /RU username /RP password /TR C:\clamscan1.bat>>C:\computerstartup.log 2>&1
copy /y \\apvdbs03\Public\clamscans\clamscan1.bat c:\>>c:\computerstartup.log
CACLS c:\clamscan1.bat /E /T /C /G clambot:F>>c:\computerstartup.log
echo ***************end*****************************>>c:\computerstartup.log
:label

line 3 above creates a scheduled task. I made RU a username on the network (created for this purpose) that would have access to a shared location because the actual clamscan.bat I made saves log info to that location.
line 3 also contains ">>C:\computerstartup.log 2>&1" which I used to troubleshoot syntax errors I had when making this. It may be useful but it isn't necessary.
line 4 copies the actual scan batch file to the root directory
line 5 grants full access on the scan batch file (clamsan1.bat) to the same username. I do this because the pc's are pretty well locked down for normal users. It may or may not be necessary for you.
lines 1 and 7 are there to skip if the others have already been done
lines 2 and 6 are there to record completion to a log file

Now for the actual scan batch file (clamscan1.bat):

Code:

echo %COMPUTERNAME% started clamscan of drive C: on %DATE% at %TIME%>>\\sharebox\Public\clamscans\%COMPUTERNAME%.txt
C:\"Program Files"\ClamWin\bin\clamscan c:\ --memory -k -i -r -d "C:\Documents and Settings\All Users\.clamwin\db">>\\sharebox\Public\clamscans\%COMPUTERNAME%.txt
echo %COMPUTERNAME% finished clamscan of drive C: on %DATE% at %TIME%>>\\sharebox\Public\clamscans\%COMPUTERNAME%.txt
echo *****************************************************************************************************************>>\\sharebox\Public\clamscans\%COMPUTERNAME%.txt

lines 1,3 and 4 are for logging purposes only.
line 2 sets up a notify only scan on the c drive.
Everytime you see >>\\sharebox\Public\clamscans\%COMPUTERNAME%.txt, that is how I log the results to my share. Each text file is named by the system so I can track what's going on.

The only bad thing about this method is that the scans don't generate emails when viruses are found. I have to search the log folder for the string "infected:" to find real problems (you need the colon there). Here is an example using this method of a scan that found a test virus (I manually ran the scheduled task and limited the .bat to run on just 1 folder to save time:

Code:

*****************************************************************************************************************
WXP2010043001 started clamscan of drive C: on Mon 08/23/2010 at 12:29:07.10
*** Scanning Programs in Computer Memory ***
---Please login as an Administrator to scan System processes loaded in computer memory---
*** Memory Scan: using ToolHelp ***

*** Scanned 2 processes - 37 modules ***
*** Computer Memory Scan Completed ***

c:\testscan\eicar_com.zip.infected: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 816957
Engine version: 0.96.2
Scanned directories: 1
Scanned files: 41
Infected files: 1
Data scanned: 27.55 MB
Data read: 3641.24 MB (ratio 0.01:1)
Time: 9.703 sec (0 m 9 s)
WXP2010043001 finished clamscan of drive C: on Mon 08/23/2010 at 12:29:16.90
*****************************************************************************************************************

I noticed just now that it didn't run the memory scan. I may tweak this time permitting to do that and automate clamwin updates and automate searching the log share for the "infected:" string to send an email whenever it gets a hit.

Update, there were 2 issues that prevented memory scans in some cases, one was not running the task as administrator, the other was having an old version of clamwin. I went to all the pc's remotely by putting in their systemname into explorer (\\systemname which makes their scheduled tasks available), changing the account the task runs as to an admin account. Using the remote install method on the reply below takes care of the old version problem.

Posted: Mon Sep 13, 2010 1:12 pm

When you get all the prerequisites in order, all you'll have to do is run a batch file and clamwin will install to all network pcs. THis is good for first time install or upgrade installs. Only tested on XP pro.

== Automated ClamWin Installation ==

* You need to have the latest clamwin installation executive in a network share location
NOTE: anytime you see "\\apvdbs03\Public\clamscans\" below, that is my network share. You need to replace that with your network share. This share need to have a zip file containing the clamwin install .exe file and install.bat (below). It also needs to have remoteinstall1.bat and a folder called installlogs
* You need to have psexec (Microsoft's PS Tools https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx ) installed on the system you run this from
* update the install.bat text with the file name of the current clamwin install executable
* you need to have 7-zip installed (you should have it anyway, it's great and it's open source)

What the batch files do:
* runs CopyFile2all.bat (must have computers.txt where run from). This puts the whatever file you choose onto the c:\ drive of all network desktops. The file you'll put on there in this case is remoteinstall.bat, which you'll have on the network share mentioned above. This batch file first pings and makes noreply.log for pc's it can't connect to.
* runs claminstall2all.bat. This file connects (by psexec) to each pc in the computers.txt list and runs the installation batch file. This is 2 parts. First, a zip file is pulled from the share to the root, unzipped by 7zip. That zip file contains the clamwin install exe file and install.bat. Install.bat first kills any running clamwin and then installs.
* The above batch files are all called by clamwin_networkinstall.bat which is the file you'll run. Each pc that is successful will send a log file to your share

Here are the batch files you'll need:

claminstall2all.bat:

Code:

@echo on & setLocal EnableDELAYedeXpansion
for /f "tokens=* delims= " %%a in (computers.txt) do (
ping %%a | find /i "reply" > nul
if errorlevel 1 (
>> noreply_claminstall2all.log echo %%a
) else (
psexec \\%%a c:\remoteinstall1.bat >>claminstall2all.log 2>&1

)
)

CopyFile2all.bat:

Code:

@echo on & setLocal EnableDELAYedeXpansion
for /f "tokens=* delims= " %%a in (computers.txt) do (
ping %%a | find /i "reply" > nul
if errorlevel 1 (
>> noreply.log echo %%a
) else (
copy /Y \\apvdbs03\Public\clamscans\remoteinstall1.bat \\%%a\c$\
)
)

clamwin_networkinstall.bat:

Code:

call CopyFile2all.bat>>networkinstall.log 2>&1
call claminstall2all.bat

remoteinstall1.bat:

Code:

echo Begin remote installation of Clamwin AV -- %DATE% %TIME% >>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
copy \\apvdbs03\Public\clamscans\silentinstall.zip c:\>>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
c:\"program files"\7-zip\7z e c:\silentinstall.zip -oc:\clamscan\ -y>>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
c:\clamscan\install.bat>>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
echo End remote installation of Clamwin AV -- %DATE% %TIME%>>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
echo ****************************************************************>>c:\remoteinstall_%COMPUTERNAME%.log 2>&1
copy c:\remoteinstall_%COMPUTERNAME%.log \\apvdbs03\Public\clamscans\installlogs\

install.bat:

Code:

TASKKILL /F /IM clamtray.exe
c:\clamscan\clamwin-0.96.2.1-setup.exe /sp- /verysilent /norestart /log="\\apvdbs03\Public\clamscans\installlogs\%COMPUTERNAME%.log" /NOTB