| $!
$! Routine Name : SHARED_MAIL.COM
$!
$! Author : Richard Griffiths
$!
$! Date : 2-FEB-1996
$!
$! Version : V1.0
$!
$! Description : Routine to find who owns a file within the shared
$! mail directory.
$!
$! Change History : V1.0 2-FEB-1996 Richard Griffiths
$!
$!----------------------------------------------------------------------------------------------------------------------------------
$! Routine requires user to have READALL or BYPASS privilege.
$!
$set noon
$ IF .NOT.F$PRIVILEGE("BYPASS").AND..NOT.F$PRIVILEGE("READALL")
$ THEN
$ WRITE SYS$OUTPUT " "
$ WRITE SYS$OUTPUT " This procedures requires either READALL or BYPASS privilege. No action taken."
$ WRITE SYS$OUTPUT " "
$ EXIT
$ ENDIF
$! Get a directory listing of DOCDB.DAT files if required.
$!
$ PID = F$GETJPI("","PID")
$ FIND_DOCDBS = 0
$ IF F$SEARCH("SYS$LOGIN:DOCDB.LIS").EQS.""
$ THEN
$ FIND_DOCDBS = 1
$ ELSE
$ IF F$CVTIME(F$FILE("SYS$LOGIN:DOCDB.LIS","CDT"),,"DATE").LTS.F$CVTIME("-7-0",,"DATE")
$ THEN
$ !READ/PROMPT="* SYS$LOGIN:DOCDB.LIS is over a week old. Generate a new one? [N]: " SYS$OUTPUT OPTION
$ !OPTION = F$EXTRACT(0,1,OPTION)
$ option = "Y"
$ IF OPTION.EQS."Y" THEN FIND_DOCDBS = 1
$ ENDIF
$ ENDIF
$!
$ IF FIND_DOCDBS
$ THEN
$LOOP1:
$ DEV = F$DEVICE("*D*","DISK",)
$ IF DEV .EQS. "" THEN GOTO END_LOOP1
$ MEDIA_TYPE = F$GETDVI(DEV,"MEDIA_TYPE")
$ IF F$GETDVI(DEV,"SHDW_MEMBER") .EQS. "FALSE" .AND. - ! Not a shadow member
(MEDIA_TYPE.EQS."DU" .OR. MEDIA_TYPE.EQS."DK" .OR. - ! DU or DK device media type
MEDIA_TYPE.EQS."DI" .OR. MEDIA_TYPE.EQS."DJ") .AND. - ! DJ or DI device media type
F$GETDVI(DEV,"SWL") .EQS. "FALSE" .AND. - ! Not software write locked
F$GETDVI(DEV,"MNT") .EQS. "TRUE" .AND. - ! Mounted
F$GETDVI(DEV,"ALL") .EQS. "FALSE" .AND. - ! Not allocated
F$GETDVI(DEV,"FOR") .EQS. "FALSE" .AND. - ! Not mounted foreign
F$GETDVI(DEV,"VOLNUMBER") .EQ. 1 ! Primary volume member
$ THEN
$!
$! Remove leading underscore from device name
$!
$ IF F$EXTRACT(0,1,DEV) .EQS. "_" THEN DEV = DEV - "_"
$!
$! If this device can be defined by a logical name in the
$! form DISK$volumelabel then use this instead of the physical name
$!
$ DEV = F$GETDVI(DEV,"LOGVOLNAM")
$ IF DEV.EQS."" THEN DEV = F$GETDVI(DEV,"VOLNAM")
$!
$ WRITE SYS$OUTPUT " Looking for DOCDB.DAT files on ''DEV'"
$ DIRECTORY/NOHEAD/NOTRAIL/OUTPUT=SYS$LOGIN:DOCDB_'DEV'_'PID'.TMP 'DEV':[*...]DOCDB.DAT
$ ENDIF
$ GOTO LOOP1
$END_LOOP1:
$ COPY SYS$LOGIN:DOCDB_*_'PID'.TMP SYS$LOGIN:DOCDB.LIS
$ DELETE SYS$LOGIN:DOCDB_*_'PID'.TMP;*
$ WRITE SYS$OUTPUT " Created file SYS$LOGIN:DOCDB.LIS"
$ ENDIF
$!----------------------------------------------------------------------------------------------------------------------------------
$! Get shared file to search for.
$!
$LOOP2:
$ IF P1.EQS.""
$ THEN
$ READ/PROMPT="* Give shared filename: " SYS$OUTPUT SHARED_FILESPEC
$ ELSE
$ SHARED_FILESPEC = P1
$ ENDIF
$ IF F$SEARCH(SHARED_FILESPEC).EQS.""
$ THEN
$ WRITE SYS$OUTPUT " File ''SHARED_FILESPEC' not found."
$ GOTO LOOP2
$ ENDIF
$!
$! Ensure filespec in format OA$SHARy:file.typ
$!
$ IF F$LOCATE("[",SHARED_FILESPEC).NE.F$LENGTH(SHARED_FILESPEC)
$ THEN
$ DIRE_SPEC = F$PARSE(SHARED_FILESPEC,,,"DIRECTORY")
$ SHARED_DIRECTORY = F$ELEMENT(1,".",DIRE_SPEC) - "]" + ":"
$ FILE_NAME = F$PARSE(SHARED_FILESPEC,,,"NAME")
$ FILE_TYPE = F$PARSE(SHARED_FILESPEC,,,"TYPE")
$ SHARED_FILESPEC = "OA$" + SHARED_DIRECTORY + FILE_NAME + FILE_TYPE
$ ENDIF
$!----------------------------------------------------------------------------------------------------------------------------------
$! Search all the DOCDB.DAT files for this message file.
$!
$ IF P2.NES."RECURSIVE"
$ THEN
$ OPEN/WRITE OUTFILE SYS$LOGIN:SHARED_MAIL.LIS
$ WRITE OUTFILE " "
$ ENDIF
$ OPEN/READ/SHARE INFILE SYS$LOGIN:DOCDB.LIS
$ SET MESSAGE/NOF/NOI/NOS/NOT
$ FILE_FOUND = 0
$LOOP3:
$ READ/END=END_LOOP3 INFILE LINE
$ DOCDB = F$ELEMENT(0,";",LINE)
$ SEARCH/NOOUTPUT 'DOCDB' 'SHARED_FILESPEC'
$ IF $SEVERITY.EQ.1
$ THEN
$ FILE_FOUND = 1
$ WRITE OUTFILE " Message pointer ''SHARED_FILESPEC' found in ''DOCDB'"
$ WRITE SYS$OUTPUT " Message pointer ''SHARED_FILESPEC' found in ''DOCDB'"
$ SEARCH/OUTPUT=SYS$LOGIN:SHARED_MAIL_'PID'.TMP4 'DOCDB' 'SHARED_FILESPEC'
$ EXCHANGE/NET/FDL=SYS$INPUT SYS$LOGIN:SHARED_MAIL_'PID'.TMP4 SYS$LOGIN:SHARED_MAIL_'PID'.TMP5
RECORD; FORMAT FIXED; SIZE 255
$ OPEN/READ INFILE2 SYS$LOGIN:SHARED_MAIL_'PID'.TMP5
$ READ INFILE2 LINE
$ CLOSE INFILE2
$ WRITE OUTFILE " Folder : " + F$EDIT(F$EXTRACT(1,31,LINE),"TRIM")
$ WRITE OUTFILE " Subject: " + F$EDIT(F$EXTRACT(115,72,LINE),"TRIM")
$ WRITE OUTFILE " Sender : " + F$EDIT(F$EXTRACT(187,30,LINE),"TRIM")
$ WRITE OUTFILE " "
$ WRITE SYS$OUTPUT " Folder : " + F$EDIT(F$EXTRACT(1,31,LINE),"TRIM")
$ WRITE SYS$OUTPUT " Subject: " + F$EDIT(F$EXTRACT(115,72,LINE),"TRIM")
$ WRITE SYS$OUTPUT " Sender : " + F$EDIT(F$EXTRACT(187,30,LINE),"TRIM")
$ WRITE SYS$OUTPUT " "
$ ENDIF
$ GOTO LOOP3
$END_LOOP3:
$ SET MESSAGE/F/I/S/T
$ CLOSE INFILE
$!
$ IF FILE_FOUND.EQ.1
$ THEN
$!
$! End of search - file located in DOCDB.DAT file(s).
$!
$ CLOSE OUTFILE
$ WRITE SYS$OUTPUT " File SYS$LOGIN:SHARED_MAIL.LIS created."
$ DELETE SYS$LOGIN:SHARED_MAIL_'PID'.TMP*;*
$ EXIT
$ ENDIF
$!----------------------------------------------------------------------------------------------------------------------------------
$! File not found in DOCDBs - must be an attachment.
$! Search sDAF files for file to which this message is attached.
$!
$ AREA = F$EXTRACT(7,1,SHARED_FILESPEC)
$ SET MESSAGE/NOF/NOI/NOS/NOT
$ SEARCH/OUTPUT=SYS$LOGIN:SHARED_MAIL_'PID'.TMP OA$SHAR'AREA':OA$DAF_'AREA'.DAT "''SHARED_FILESPEC'"
$ SEARCH/OUTPUT=SYS$LOGIN:SHARED_MAIL_'PID'.TMP2 SYS$LOGIN:SHARED_MAIL_'PID'.TMP "''SHARED_FILESPEC' "/MATCH=NAND
$ SEVERITY = $SEVERITY
$ SET MESSAGE/F/I/S/T
$ DELETE SYS$LOGIN:SHARED_MAIL_'PID'.TMP;*
$ IF SEVERITY.NE.1
$ THEN
$ SDAFS = ""
$ IF F$TRNLNM("OA$SHARA").NES."".AND.AREA.NES."A" THEN SDAFS = SDAFS + "OA$SHARA:OA$DAF_A.DAT,"
$ IF F$TRNLNM("OA$SHARB").NES."".AND.AREA.NES."B" THEN SDAFS = SDAFS + "OA$SHARB:OA$DAF_B.DAT,"
$ IF F$TRNLNM("OA$SHARC").NES."".AND.AREA.NES."C" THEN SDAFS = SDAFS + "OA$SHARC:OA$DAF_C.DAT,"
$ IF F$TRNLNM("OA$SHARD").NES."".AND.AREA.NES."D" THEN SDAFS = SDAFS + "OA$SHARD:OA$DAF_D.DAT,"
$ IF F$TRNLNM("OA$SHARE").NES."".AND.AREA.NES."E" THEN SDAFS = SDAFS + "OA$SHARE:OA$DAF_E.DAT,"
$ SDAFS = SDAFS + "ZZZ" - ",ZZZ" ! Remove trailing comma.
$ SET MESSAGE/NOF/NOI/NOS/NOT
$ SEARCH/OUTPUT=SYS$LOGIN:SHARED_MAIL_'PID'.TMP 'SDAFS' "''SHARED_FILESPEC'"/NOHEAD
$ SEARCH/OUTPUT=SYS$LOGIN:SHARED_MAIL_'PID'.TMP2 SYS$LOGIN:SHARED_MAIL_'PID'.TMP "''SHARED_FILESPEC' "/MATCH=NAND
$ SEVERITY = $SEVERITY
$ SET MESSAGE/F/I/S/T
$ DELETE SYS$LOGIN:SHARED_MAIL_'PID'.TMP;*
$ IF SEVERITY.NE.1
$ THEN
$ WRITE SYS$OUTPUT " File ''SHARED_FILESPEC' not referenced in any of the sDAF files."
$ EXIT
$ ENDIF
$ ENDIF
$ EXCHANGE/NET/FDL=SYS$INPUT SYS$LOGIN:SHARED_MAIL_'PID'.TMP2 SYS$LOGIN:SHARED_MAIL_'PID'.TMP3
RECORD; FORMAT FIXED; SIZE 80
$ DELETE SYS$LOGIN:SHARED_MAIL_'PID'.TMP2;*
$ OPEN/READ INFILE SYS$LOGIN:SHARED_MAIL_'PID'.TMP3
$ READ INFILE LINE
$ CLOSE INFILE
$ DELETE SYS$LOGIN:SHARED_MAIL_'PID'.TMP3;*
$ NEW_SHARED_FILESPEC = F$EDIT(F$EXTRACT(F$LOCATE("OA$SHAR",LINE),40,LINE),"TRIM")
$ WRITE OUTFILE " File ''SHARED_FILESPEC' is attached to ''NEW_SHARED_FILESPEC'"
$ WRITE SYS$OUTPUT " File ''SHARED_FILESPEC' is attached to ''NEW_SHARED_FILESPEC'"
$ @'F$ENVIRONMENT("PROCEDURE") "''NEW_SHARED_FILESPEC'" "RECURSIVE"
$ EXIT
|
| The lines marked with ****** must be changed for your site.
$ set noon
$ set noverify
$ on control_y then goto end
$ write sys$output -
"Lookup information about documents in shared areas of ALL-IN-1 File Cabinet"
$ write sys$output "Documents detected by VSWEEP to have viruses"
$ write sys$output ""
$! If VSWEEP finds any new viruses in the ALLIN-1 file cabinet, then
$! lookup the owner/source using ye old SHARED_MAIL.COM and send result
$! as email to whoever.
$!
****** $ vsweep$dir == "DISK$USER2:[VSWEEP]"
$ reports$dir = vsweep$dir - "]" + ".REPORTS]"
$
$ write sys$output "Checking SWEEP report files..."
$! any new VSWEEP WIDE report files (just the last one tanks!)
$ directx /since=today 'reports$dir'vsweep_*_wide.txt;0/out=temp1.tmp-
/col=1/nohead/notrail
$ if .not. $status then goto end1
$
$ count = 0
$ open/error=end infile1 temp1.tmp
$ ! now scan each report file...
$ open/write outfile temp2.tmp
$ write outfile "$ write sys$output ""Start time ",f$cvtime(),""""
$
$ file_loop:
$ ! get filename of new WIDE report file
$ read/end=end infile1 file1
$ write sys$output file1
$ if file1 .eqs. "" then goto end
$
$ ! open that WIDE report file
$ open/read infile2 'file1
$ read_loop:
$ ! get each infected file name out of that report file
$ read/end=end_read_loop infile2 line
$! write sys$output line
$ filename = f$edit(f$extract(16,90,line),"COMPRESS")
$ write sys$output " ",filename
$ ! if the filename contains OA$SHARE then its one we want
$ if f$locate("OA$SHARE",filename) .ne. f$length(filename)
$ then ! you're the one that I want, oo-oo-oo
$ count = count + 1
$ write outfile "$ write sys$output "" """
$ write outfile "$ write sys$output ""***",filename,"***"""
$ write outfile "$ @",vsweep$dir,"shared_mail ",filename
$ endif
$ goto read_loop
$ end_read_loop:
$ write outfile "$ write sys$output "" """
$ write outfile "$ write sys$output ""End time ",f$cvtime(),""""
$ close infile2
$ goto file_loop
$
$ end:
$ close outfile
$ close infile1
$ delete temp1.tmp;
$ if count .gt. 0
$ then
$ write sys$output "Have built list of infected files."
$ write sys$output "Now looking up document information..."
$ ! we have now a temp2.tmp command file containing the DCL to lookup
$ ! the owners of infected files.
$ @temp2.tmp/out=temp3.tmp
$ write sys$output ""
$ write sys$output "Sending mail about the documents..."
$ mail/subj="UA:Viruses found in shared areas of ALL-IN-1 File Cabinet" -
****** temp3.tmp system ! send mail to WHO???
$ delete temp2.tmp;
$ write sys$output " "
$ write sys$output "Mail sent contains:"
$ type temp3.tmp
$ else
$ write sys$output "No infected documents in ALLIN1 shares."
$ endif
$ write sys$output ""
$ delete temp3.tmp;
$ write sys$output "Exit."
$ exit
$ error:
$ write sys$output "Cleanup..."
$ close infile1
$ close infile2
$ close outfile
$ delete temp1.tmp;,temp2.tmp;,temp3.tmp;
$ exit
$ end1:
$ write sys$output "No new virus WIDE report files found."
$ delete temp1.tmp;
$ exit
|