[ngw] Virus Blocking

Chad Leeper chad at Capitalcityfruit.com
Fri Dec 7 16:15:47 UTC 2001


I am using the inoculan command line scanner on a 95 workstation and Guinevere is blocking any email with attachment. including .doc and .xls files.  Any Ideas?????

/Chad

>>> tvissoc at scitexdpi.com 12/6/01 12:24:15 PM >>>
Here's mine.  It works.

rem @echo off
GOTO Main
:VirusScan
REM critical lines below for attachment blocking
SET BA=
REM add as many as you want
if exist %2\%1\*.vbs SET BA=VBS
if exist %2\%1\HAPPY99.EXE SET BA=HAPPY99
if exist %2\%1\*.shs SET BA=SHS
if exist %2\%1\NAVIDAD.EXE SET BA=NAVIDAD
if exist %2\%1\EMANUEL.EXE SET BA=NAVIDAD
if exist %2\%1\*.chm SET BA=ROMEO_CHM
if exist %2\%1\XROMEO.EXE SET BA=ROMEO_EXE
if exist %2\%1\CREATIVE.EXE SET BA=TROJ_PROLIN
if exist %2\%1\JOKE.EXE SET BA=SNOW_WHITE1
if exist %2\%1\MIDGETS.SCR SET BA=SNOW_WHITE2
if exist %2\%1\DWARF4YOU.EXE SET BA=SNOW_WHITE3
if exist %2\%1\nakedwife.EXE SET BA=n_wife
if exist %2\%1\SERVER.EXE SET BA=SUBSEVEN
if exist %2\%1\homepage.html.vbs SET BA=COOL_HOMEPAGE
if exist %2\%1\ilfcijil.exe SET BA=ILFCIJIL
if exist %2\%1\readme.exe SET BA=README
if exist %2\%1\admin.dll SET BA=ADMIN
if exist %2\%1\wtc.exe SET BA=WTC
if exist %2\%1\gone.scr SET BA=GONER

REM next 2 lines must also be present
if "%BA%"=="" goto RealScan
echo %BA% attachment detected and blocked > %3\%1.TPB

:RealScan
rem intel lan desk
rem Again, vscand.EXE and its associated files are assumed
rem to be in the current path.
echo Scanning for Viruses
SET VIR=/A /NB /NM /NC /U 
if exist %TEMP%\%1.INF del %TEMP%\%1.inf
vscand %2\%1\*.* %VIR% /L=%TEMP%\%1.INF

>>> mbarham at hnncsb.org 12/06/01 11:50AM >>>


Here it is...

@echo off
GOTO Main
:VirusScan

REM ATTACHMENT BLOCKING
SET BA=

IF "%BA%"=="" GOTO JIMSCAN
ECHO %BA% ATTACHMENT DETECTED AND BLOCKED>%3\%1.TPB
rem ECHO %BA%>>F:\PUBLIC\LOGS\GUINBLK.LOG

:JIMSCAN
IF EXIST %2\%1\*.VBS SET BA=VBS
if exist %2\%1\HAPPY99.EXE SET BA=HAPPY99
if exist %2\%1\creative.exe SET BA=CREATIVE
REM this list is Microsoft's recommended list
if exist %2\%1\naked*.exe SET BA=nwf
if exist %2\%1\*.ade SET BA=ADE
if exist %2\%1\*.ink SET BA=INK
if exist %2\%1\*.adp SET BA=ADP
if exist %2\%1\*.bas SET BA=BAS
if exist %2\%1\*.bat SET BA=BAT
if exist %2\%1\*.chm SET BA=CHM
if exist %2\%1\*.cmd SET BA=CMD
if exist %2\%1\*.com SET BA=COM
if exist %2\%1\*.cpl SET BA=CPL
if exist %2\%1\*.crt SET BA=CRT
if exist %2\%1\*.exe SET BA=EXE
if exist %2\%1\*.hlp SET BA=HLP
if exist %2\%1\*.hta SET BA=HTA
if exist %2\%1\*.inf SET BA=INF
if exist %2\%1\*.ins SET BA=INS
if exist %2\%1\*.isp SET BA=ISP
if exist %2\%1\*.js SET BA=JS
if exist %2\%1\*.jse SET BA=JSE
if exist %2\%1\*.lnk SET BA=LNK
if exist %2\%1\*.mdb SET BA=MDB
if exist %2\%1\*.mde SET BA=MDE
if exist %2\%1\*.msc SET BA=MSC
if exist %2\%1\*.msi SET BA=MSI
if exist %2\%1\*.msp SET BA=MSP
if exist %2\%1\*.mst SET BA=MST
if exist %2\%1\*.pcd SET BA=PCD
if exist %2\%1\*.pif SET BA=PIF
if exist %2\%1\*.reg SET BA=REG
if exist %2\%1\*.scr SET BA=SCR
if exist %2\%1\*.sct SET BA=SCT
if exist %2\%1\*.shs SET BA=SHS
if exist %2\%1\*.shb SET BA=SHB
if exist %2\%1\*.url SET BA=URL
if exist %2\%1\*.vb SET BA=VB
if exist %2\%1\*.vbe SET BA=VBE
if exist %2\%1\*.wsc SET BA=WSC
if exist %2\%1\*.wsf SET BA=WSF
if exist %2\%1\*.wsh SET BA=WSH


IF "%BA%"=="" GOTO REALSCAN
ECHO %BA% ATTACHMENT DETECTED AND BLOCKED>%3\%1.JIM

REM END ATTACHMENT BLOCKING

rem inoculan
echo Scanning for Viruses
SET VIR=/NS /LIS %TEMP%\%1.INF
inocucmd %2\%1 %VIR%

rem from Cheyenne user manual



--
Visit http://www.ngwlist.com for help with the list.
Visit http://www.concentrico.net for GroupWise, NDS, or DirXML
development needs and product information.


--
Visit http://www.ngwlist.com for help with the list.
Visit http://www.concentrico.net for GroupWise, NDS, or DirXML development needs and product information.





------------------------------------------------------------------------
[Confidentiality Notice]
------------------------------------------------------------------------
The information transmitted is intended only for the person or entity
to which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of,
or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.  If you
received this transmission in error, please contact the sender by reply e-mail
or by telephone (515-981-5111) and delete and destroy all copies of the
material, including all copies stored in the recipient's computer, printed or
saved to disk.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://ngwlist.com/pipermail/ngw/attachments/20011207/f5ce66b8/attachment.html 


More information about the ngw mailing list