Dwarfsoft [GPA] » Work

SEP11 Scan Logs

dwarfsoft — Thu, 03 Mar 2011 01:29:08 +0000

I will start out by simply stating how much I HATE SEP11, and how it handles client scan logs. For some reason there is NO way of getting a client scan log out of the Central Management Console. The whole point of Central Management is being able to … manage CENTRALLY.

Anyway, enough rant. I wrote a batch file to pull the latest (or specified) log file from a list of servers (in a file called Servers.txt). More Source:

@echo off
if not exist "SEP11Logs" mkdir SEP11Logs
 
for /f "tokens=*" %%A IN (Servers.txt) DO (
  IF /I "%~1" EQU "" (
    CALL :GetLatestLog "%%A"
    CALL :CopyLog "%%A" "%%_LogFile%%"
    ) ELSE (
    CALL :CopyLog "%%A" "%~1"
    )
  )
 
GOTO:EOF
 
:GetLatestLog
SET _ServerName=%~1
FOR /F "tokens=* delims=" %%B IN ('dir "\\%_ServerName%\C$\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\*.log" /b /o:-d') DO (
  SET _LogFile=%%B
  ECHO "Logfile is %%B"
  GOTO:EOF
  )
GOTO:EOF
 
:CopyLog
ECHO Copying "%~2" on "%~1"
COPY /Y "\\%~1\C$\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\%~2" "SEP11Logs\%~1-%~2"
:EOF

This script goes through the list of servers copying the logs into a folder called SEP11Logs and renaming them to “-” so they come out as something like “SERVER-02262011.log”.

Once I received the logs I was then struck with a problem of not being able to easily determine the date and time of each finding. After a short search I managed to track down a description of the SEP11 log file format. I wrote a quick and [very] dirty script to add a little more detail to the original log.

' See http://www.symantec.com/business/support/index?page=content&id=TECH100099&locale=en_US
On Error Resume Next
Const ForReading = 1
Const ForWriting = 2
 
Dim fso, folder, files, NewsFile,sFolder
 
Set fso = CreateObject("Scripting.FileSystemObject")
sFolder = Wscript.Arguments.Item(0)
If sFolder = "" Then
    Wscript.Echo "No Folder parameter was passed"
    Wscript.Quit
End If
Set folder = fso.GetFolder(sFolder)
Set files = folder.Files
 
For each folderIdx In files
 
  Set LogFile = fso.OpenTextFile(folderIdx.Path, ForReading)
  Set LogFileCsv = fso.CreateTextFile(folderIdx.Path& ".csv", True)
  Do While not LogFile.AtEndOfStream
    line = LogFile.ReadLine
	Splt=Split(line,",")
	hTime = Splt(0)
	hTimeYear  = Right("0000" & (1970 + CLng("&H"&Mid(hTime,1,2))),4)
	hTimeMonth = Right("00" & CLng("&H"&Mid(hTime,3,2))+1,2)
	hTimeDay   = Right("00" & CLng("&H"&Mid(hTime,5,2)), 2)
	hTimeHour  = Right("00" & CLng("&H"&Mid(hTime,7,2)), 2)
	hTimeMin   = Right("00" & CLng("&H"&Mid(hTime,9,2)), 2)
	hTimeSec   = Right("00" & CLng("&H"&Mid(hTime,11,2)), 2)
 
	hDateAndTime = hTimeYear & "-" & hTimeMonth & "-" & hTimeDay & " " & hTimeHour & ":" & hTimeMin & ":" & hTimeSec
	hDate = hTimeYear & "-" & hTimeMonth & "-" & hTimeDay
	hTime = hTimeHour & ":" & hTimeMin & ":" & hTimeSec
 
	Select Case Splt(1)
	  Case 1
	    hEvent = "GL_EVENT_IS_ALERT"
      Case 2
        hEvent = "GL_EVENT_SCAN_STOP"
      Case 3
        hEvent = "GL_EVENT_SCAN_START"
      Case 4
        hEvent = "GL_EVENT_PATTERN_UPDATE"
      Case 5
        hEvent = "GL_EVENT_INFECTION"
      Case 6
        hEvent = "GL_EVENT_FILE_NOT_OPEN"
      Case 7
        hEvent = "GL_EVENT_LOAD_PATTERN"
      Case 8
        hEvent = "//GL_STD_MESSAGE_INFO NOT USED"
      Case 9
        hEvent = "//GL_STD_MESSAGE_ERROR NOT USED"
      Case 10
        hEvent = "GL_EVENT_CHECKSUM"
      Case 11
        hEvent = "GL_EVENT_TRAP"
      Case 12
        hEvent = "GL_EVENT_CONFIG_CHANGE"
      Case 13
        hEvent = "GL_EVENT_SHUTDOWN"
      Case 14
        hEvent = "GL_EVENT_STARTUP"
      Case 16
        hEvent = "GL_EVENT_PATTERN_DOWNLOAD"
      Case 17
        hEvent = "GL_EVENT_TOO_MANY_VIRUSES"
      Case 18
        hEvent = "GL_EVENT_FWD_TO_QSERVER"
      Case 19
        hEvent = "GL_EVENT_SCANDLVR"
      Case 20
        hEvent = "GL_EVENT_BACKUP"
      Case 21
        hEvent = "GL_EVENT_SCAN_ABORT"
      Case 22
        hEvent = "GL_EVENT_RTS_LOAD_ERROR"
      Case 23
        hEvent = "GL_EVENT_RTS_LOAD"
      Case 24
        hEvent = "GL_EVENT_RTS_UNLOAD"
      Case 25
        hEvent = "GL_EVENT_REMOVE_CLIENT"
      Case 26
        hEvent = "GL_EVENT_SCAN_DELAYED"
      Case 27
        hEvent = "GL_EVENT_SCAN_RESTART"
      Case 28
        hEvent = "GL_EVENT_ADD_SAVROAMCLIENT_TOSERVER"
      Case 29
        hEvent = "GL_EVENT_REMOVE_SAVROAMCLIENT_FROMSERVER"
      Case 30
        hEvent = "GL_EVENT_LICENSE_WARNING"
      Case 31
        hEvent = "GL_EVENT_LICENSE_ERROR"
      Case 32
        hEvent = "GL_EVENT_LICENSE_GRACE"
      Case 33
        hEvent = "GL_EVENT_UNAUTHORIZED_COMM"
      Case 34
        hEvent = "GL_EVENT_LOG_FWD_THRD_ERR"
      Case 35
        hEvent = "GL_EVENT_LICENSE_INSTALLED"
      Case 36
        hEvent = "GL_EVENT_LICENSE_ALLOCATED"
      Case 37
        hEvent = "GL_EVENT_LICENSE_OK"
      Case 38
        hEvent = "GL_EVENT_LICENSE_DEALLOCATED"
      Case 39
        hEvent = "GL_EVENT_BAD_DEFS_ROLLBACK"
      Case 40
        hEvent = "GL_EVENT_BAD_DEFS_UNPROTECTED"
      Case 41
        hEvent = "GL_EVENT_SAV_PROVIDER_PARSING_ERROR"
      Case 42
        hEvent = "GL_EVENT_RTS_ERROR"
      Case 43
        hEvent = "GL_EVENT_COMPLIANCE_FAIL"
      Case 44
        hEvent = "GL_EVENT_COMPLIANCE_SUCCESS"
      Case 45
        hEvent = "GL_EVENT_SECURITY_SYMPROTECT_POLICYVIOLATION"
      Case 46
        hEvent = "GL_EVENT_ANOMALY_START"
      Case 47
        hEvent = "GL_EVENT_DETECTION_ACTION_TAKEN"
      Case 48
        hEvent = "GL_EVENT_REMEDIATION_ACTION_PENDING"
      Case 49
        hEvent = "GL_EVENT_REMEDIATION_ACTION_FAILED"
      Case 50
        hEvent = "GL_EVENT_REMEDIATION_ACTION_SUCCESSFUL"
      Case 51
        hEvent = "GL_EVENT_ANOMALY_FINISH"
      Case 52
        hEvent = "GL_EVENT_COMMS_LOGIN_FAILED"
      Case 53
        hEvent = "GL_EVENT_COMMS_LOGIN_SUCCESS"
      Case 54
        hEvent = "GL_EVENT_COMMS_UNAUTHORIZED_COMM"
      Case 55
        hEvent = "GL_EVENT_CLIENT_INSTALL_AV"
      Case 56
        hEvent = "GL_EVENT_CLIENT_INSTALL_FW"
      Case 57
        hEvent = "GL_EVENT_CLIENT_UNINSTALL"
      Case 58
        hEvent = "GL_EVENT_CLIENT_UNINSTALL_ROLLBACK"
      Case 59
        hEvent = "GL_EVENT_COMMS_SERVER_GROUP_ROOT_CERT_ISSUE"
      Case 60
        hEvent = "GL_EVENT_COMMS_SERVER_CERT_ISSUE"
      Case 61
        hEvent = "GL_EVENT_COMMS_TRUSTED_ROOT_CHANGE"
      Case 62
        hEvent = "GL_EVENT_COMMS_SERVER_CERT_STARTUP_FAILED"
      Case 63
        hEvent = "GL_EVENT_CLIENT_CHECKIN"
      Case 64
        hEvent = "GL_EVENT_CLIENT_NO_CHECKIN"
      Case 65
        hEvent = "GL_EVENT_SCAN_SUSPENDED"
      Case 66
        hEvent = "GL_EVENT_SCAN_RESUMED"
      Case 67
        hEvent = "GL_EVENT_SCAN_DURATION_INSUFFICIENT"
      Case 68
        hEvent = "GL_EVENT_CLIENT_MOVE"
      Case 69
        hEvent = "GL_EVENT_SCAN_FAILED_ENHANCED"
      Case 70
        hEvent = "GL_EVENT_MAX_EVENT_NUMBER"
      Case 71
        hEvent = "GL_EVENT_HEUR_THREAT_NOW_WHITELISTED"
      Case 72
        hEvent = "GL_EVENT_INTERESTING_PROCESS_DETECTED_START"
      Case 73
        hEvent = "GL_EVENT_LOAD_ERROR_COH"
      Case 74
        hEvent = "GL_EVENT_LOAD_ERROR_SYKNAPPS"
      Case 75
        hEvent = "GL_EVENT_INTERESTING_PROCESS_DETECTED_FINISH"
      Case 76
        hEvent = "GL_EVENT_HPP_SCAN_NOT_SUPPORTED_FOR_OS"
      Case 77
        hEvent = "GL_EVENT_HEUR_THREAT_NOW_KNOWN"
	End Select
 
	Select Case Splt(2)
	  Case 1
	    hCategory = "GL_CAT_INFECTION"
	  Case 2
	    hCategory = "GL_CAT_SUMMARY"
	  Case 3
	    hCategory = "GL_CAT_PATTERN"
	  Case 4
	    hCategory = "GL_CAT_SECURITY"
	End Select
 
    hLogger = Splt(3)
	hComputer = Splt(4)
	hUser = Splt(5)
	hVirus = Splt(6)
	hFile = Splt(7)
 
	Select Case Splt(8)
	  Case 1
	    hAction = "Quarantine"
      Case 2
	    hAction = "Rename"
	  Case 3
	    hAction = "Delete"
	  Case 4
	    hAction = "Leave Alone"
	  Case 5
	    hAction = "Clean File"
	  Case 6
	    hAction = "Clean Macros"
	  Case Else
	    hAction = "Unknown Action"
	End Select
 
	Select Case Splt(9)
	  Case 1
	    hAction2 = "Quarantine"
      Case 2
	    hAction2 = "Rename"
	  Case 3
	    hAction2 = "Delete"
	  Case 4
	    hAction2 = "Leave Alone"
	  Case 5
	    hAction2 = "Clean File"
	  Case 6
	    hAction2 = "Clean Macros"
	  Case Else
	    hAction2 = "Unknown Action"
	End Select
 
	Select Case Splt(10)
	  Case 1
	    hAction3 = "Quarantine"
      Case 2
	    hAction3 = "Rename"
	  Case 3
	    hAction3 = "Delete"
	  Case 4
	    hAction3 = "Leave Alone"
	  Case 5
	    hAction3 = "Clean File"
	  Case 6
	    hAction3 = "Clean Macros"
	  Case 7
	    hAction3 = "Saved file as..."
      Case 8
	    hAction3 = "Sent to Intel (AMS)"
      Case 9
	    hAction3 = "Moved to backup location"
      Case 10
        hAction3 = "Renamed backup file"
      Case 11
        hAction3 = "Undo action in Quarantine View"
      Case 12
        hAction3 = "Write protected or lack of permissions - Unable to act on file"
      Case 13
	    hAction3 = "Backed up file"
	  Case Else
	    hAction3 = "Unknown Action"
	End Select
 
	hVirusType = Splt(11)
	hFlags = Splt(12)
	hDescription = Splt(13)
	hScanId = Splt(14)
	hNewExt = Splt(15)
	hGroupId = Splt(16)
	hEventData = Splt(17)
	hQuarantineID = Splt(18)
	hVirusID = Splt(19)
	hQuarantineStatus = Splt(20)
	hAccess = Splt(21)
 
	outline = hDate & "," & hTime & "," & Splt(1) & "," & hEvent & "," & Splt(2) & "," & hCategory & "," & Splt(3) & "," & Splt(4) & "," & Splt(5) & "," & Splt(6) & ","
	outline = outline & Splt(7) & "," & Splt(8) & "," & hAction & "," & Splt(9) & "," & hAction2 & "," & Splt(10) & "," & hAction3
	For i = 11 to UBound(Splt)
	  outline=outline&","&Splt(i)
	Next
 
	LogFileCsv.WriteLine(outline)
  Loop
  LogFileCsv.Close
  LogFile.Close
 
Next

I know, not exactly brimming with comments. I leave this code here, as is. Worked for me… Just take note, that in these logs there are a lot of files that get picked up that have 3 actions listed as “Leave Alone” but (if opened in Excel) under column X it lists a File Remediation and a Delete action. The log file format is abysmal and the above linked description of the format does not accurately explain the remediation information… I have as yet been unable to determine which field of the description the remediation is supposed to be in.

So, Run the Batch File to copy the logs into the SEP11Logs folder. Run the VBScript with the path to SEP11Logs and it will create a copy of the log files with a .csv extension that has a bit more information.

Enjoy.

Cheers, Chris.

SYSTEM Account Permissions

dwarfsoft — Tue, 25 May 2010 01:08:45 +0000

Recently I have been working on some rather complicated projects preparing our SOE to move from Novell eDirectory to an Active Directory environment. One of the packages I built was required to run periodically and so I set up a Scheduled Task to accomplish this. Rather than introduce a security risk by creating a new Administrator Account I just created the scheduled task to run as the local SYSTEM account. It turns out that the SYSTEM account does not have as much access as I required, especially when managing user registry hives.

After quite some time looking in to how to achieve my goal I came up with a rather simple, yet ultimately hacky, solution. Give the SYSTEM Account Administrative Privileges.

It turns out that the SYSTEM Account, despite not having Administrator level permissions, does have permission to modify group memberships. As such I came up with two functions to manage these permissions for itself:

'*****************************************************************
' Elevates the System Account to a Member of the Administrators Group
Function ElevateSystem
  strSystemUser = "WinNT://NT AUTHORITY/SYSTEM"
  Set objGroup = GetObject("WinNT://./Administrators,group")
  If Not objGroup.isMember(strSystemUser) Then
    objGroup.Add (strSystemUser)
  End If
End Function
 
'*****************************************************************
' Removes the System Account from the Administrators Group
Function RelegateSystem
  strSystemUser = "WinNT://NT AUTHORITY/SYSTEM"
  Set objGroup = GetObject("WinNT://./Administrators,group")
  If objGroup.isMember(strSystemUser) Then
    objGroup.Remove (strSystemUser)
  End If
End Function

I just run ElevateSystem at the start of the script and then RelegateSystem at the end of the script and I have no issue with permissions anymore.

Elegant, yet hacky. Hope somebody found this useful, because it sure beats creating (and then managing) a new Administrator User on thousands of Workstations.

N.B. I should also point out that if you are installing a script onto Workstations that you will be using this kind of workaround on, make sure you set the permissions on it. The last thing you need is somebody hijacking your script to do whatever they want with Administrative Privileges.

Cheers, Chris.

Last Login Time

dwarfsoft — Thu, 22 Apr 2010 01:54:33 +0000

I have recently been having a look into determining the Last Login Time of a user for a BGInfo implementation. Firstly I had a look at the getCurrentUserLastLoginTime script suggested for use with BGInfo. The limitation of this script, however, is that it will reset the login time to the last time the Windows login box was Authenticated against, which also includes the time that the workstation was unlocked.

In order to maintain current BGInfo information the implementation is running periodically, so this is unnacceptable. Therefore I had to work to resolve the issue manually. As I have had a fair bit of experience with Windows Profiles recently (see the last blog post) I was familiar with the ProfileLoadTimeHigh and ProfileLoadTimeLow registry keys in the ProfileList. So I set out to determine how to actually use these to determine the login time. I first wrote some code to get the User SID based on the users “%userdomain%” and “%username%”:

DIM oNet, strComputerName, strUserName, strUserDomain
SET oNet = CreateObject("WScript.Network")
strComputerName = oNet.Computername
strUserName = oNet.UserName
strUserDomain = oNet.UserDomain
SET oNet = nothing
 
Set WMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
 
SubKey = ""
 
Set wmiCol = WMI.ExecQuery ("SELECT Domain, Name, SID FROM Win32_Account where Name="""&strUserName&""" And Domain="""&strUserDomain&"""")
For each wmiItem in wmiCol
  SubKey = wmiItem.SID
  Exit For
Next

So I set Subkey to be the String SID of the user, which I could then use to read the ProfileLoadTimeHigh and ProfileLoadTimeLow keys for the correct profile. I used the basic script from MyITForum, however this failed to take into account the timezone on the local machine. Therefore the first thing I needed to do was get the users timezone.

tz = 0
For Each os In GetObject("winmgmts:").InstancesOf ("Win32_OperatingSystem")
  tz = os.CurrentTimeZone
  Exit For  
Next

Then I integrated the Timezone offset (in minutes) into the original ProfileLoadTime script.

Const HKEY_LOCAL_MACHINE = &H80000002
 
strReturn = ""
 
Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv"  )
strKeyPath = "SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\ProfileList\" & SubKey 
 
strValueName = "ProfileLoadTimeHigh"
Return = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,lngHighValue)
strValueName = "ProfileLoadTimeLow"
Return = objReg.GetDWORDValue(HKEY_LOCAL_MACHINE,strKeyPath,strValueName,lngLowValue)
If typename(lngHighValue) <> "Null" then
  NanoSecs = (lngHighValue * 2 ^ 32 + lngLowValue)
  '' /* Returns time in Workstation Timezone */
  DT = #1/1/1601# + (NanoSecs / 600000000 / 1440) + (tz / 1440)
  strReturn = CDate(DT)
End if

Finally the output is printed as per a standard BGInfo script

On Error Resume Next
	call WScript.Echo(strReturn)	'for cmd line
	call Echo(strReturn)	'for BGInfo
on error goto 0

This works for Power Users as well, which the original script did not (due to permissions issues). Hope this helped you in some way

Cheers, Chris.

Preoccupied

dwarfsoft — Sat, 11 Apr 2009 13:52:23 +0000

I have been a little preoccupied of late, and this is due to some of the most hectic things requiring my attention, and therefore interrupting my development attempts.

First, I have been travelling a fair bit for my wife, as we are getting many scans and specialist appointments. The pregnancy has not been going as well as it could have been, but at least things are looking positive now. Understandably the requirement to have enough “stuff” set up for baby, who should be here very soon, has taken much of my time.

Secondly, the job in which I am currently sitting has been advertised for Permanency. This of course requires my time for writing the application. Hopefully the fact that I sit in the position currently will put me in a good position, especially considering in the current economic climate that there might be the newly skilled unemployed seeking to get into my role.

Those are the two major time sinks that I have at the moment, although there are a few other smaller sinks. Bare with me while I push to get back on track with development .

Cheers, Chris.

Changing Roles

dwarfsoft — Mon, 30 Jun 2008 12:38:50 +0000

Interesting moves happening at work. Today I moved into a Networks role. Originally it was intended that I be doing 80% Servers and 20% Networks due to the solid input I have provided within the Server team to date. This has now been changed to 80% Networks and 20% Servers. The guy who I am filling in for didn’t like the idea of his role being technically abandonned, and I agree with him. There will definitely be some Server Action from my end anyway, because I have a keen interest in running with a few ideas.

Trav and I have approached the Server team with an idea on distributing apps more effectively, relying mainly on network addresses of the PCs to correctly locate an application server. This brings up a few logistical hurdles.

The restructuring of our Applications such that we can point to a mapped network drive instead of relying on UNC paths.
The fact that some applications are released with site specific information. As we currently have to modify every new release of these apps to include that information, we should approach the issue from a more managable perspective.
The Implementation of Login Scripts to Base Drive Mapping on current Network Location instead of the Current Login or Workstation Context or Group (as this then provides a benefit of decreased WAN traffic for Mobile Computers and Distributed Applications).
The Politics of testing and gaining approval for implementing a new process into something that is seen as a working system. This is possibly the greatest hurdle to overcome in regards to the push for initiative.

At least with respect to point Number 4, Trav and I raised this with one of our counterparts in the Server Team, and although we were given some good reasons why some of the ideas we initially had could not go any further than the drawing board, he did provide some additional ideas on how to proceed to at least implement some positive change so that we can all manage our site specific apps (Point number 2) more effectively.

The thing we need to concentrate on first is going to be appropriating some hardware and then building an environment in which we can test some of our theories that are not being implemented. In the mean time I will start testing some of the ideas that the team has approved at this point.

Hopefully we can implement a ZfS Server that creates NALs under the District Container (as opposed to our site containers) which uses %DEST-APPS1% as X:\ instead of a UNC path, and use a Cluster Wide Login Script to appropriately map X:\.

One parting thought on another issue this could have on us, that the X:\ drive is not consistent around the state. From ZfS’s perspective, everything is all well, however there are a lot more things stored on the X:\ drive that are used constantly from a Technical perspective. This will possibly require some more training, or at least another drive mapping…

Until I start looking into DFS at least

In three weeks time we shall see what position I am in though, before too many things are set in stone.

Cheers, Chris.