Conference iosg::all-in-1

    SWEEP from Sophos now has a VMS verson VSWEEP that can be run against
    PC files on VMS disks to detect viruses and the latest version even
    claims to be able to disinfect them (although it does not seem to do a
    great job). 
    
    Regards
    Keith

    .6 talks about using VSWEEP to scan for Viruses
    
    According to the VSWEEP documentation I have just got a copy of, the
    files to be scanned must be "under PATHWORKS File Services or Disk
    Services"
    
    How have people who've been using VSWEEP on ALL-IN-1 systems been
    setting it up?  I don't know much about Pathworks (though we have
    people here who do when I need them), but do I need a file service or a
    disk service?  Doesn't pathworks but ACLS all over the place?  Does
    this interfere with the ACLs that are already on ALL-IN-1 drawers?
    
    If VSWEEP runs from DCL, why does it need Pathworks?  In fact, I can't
    see why it won't do the VMS scan on a machine without Pathworks from my
    quick scan of the manual.
    
    Has anyone had any problems or successes with VSWEEP on an ALL-IN-1
    system?
    
    Jenny
    

    I'm running VSWEEP on a few ALL-IN-1 systems.  It finds a lot of files,
    but I'm not sure how much disinfecting it really does.  The number of
    CONCEPT viruses has dwindled a lot, but now we have a lot of LAROUX
    viruses.  I can't tell if many of the CONCEPT documents were deleted
    because I don't have the old reports. The big problem is that if you
    find a document with a virus and VSWEEP doesn't clean it up (there's a
    parameter to disinfect which I just leave on all the time), then you
    have to do it from the PC via PATHWORKS.  So you find 20 viruses in 20
    different shared areas.  Do you map each drive as a PATHWORKS drive and
    then scan it?  Knowing what user owns it doesn't help you there.  What
    I have been doing is to copy the file to my VMS directory and cleaning
    it from there.  I use F-MACROW to clean it, but F-MACROW sometimes
    doesn't agree that there is a virus.  This gets a bit tedious. Also,
    F-MACROW doesn't like 9-character filenames; you can scan a file with
    an NT-style name, such as "THISWEE~.DOC", but ZMUMBLEZZ.DOC is
    invisible.  
    
    People really such be running XLSCAN or MVTOOL/SCANPROT.DOT on their
    system to prevent macro viruses.  You still have to invoke one of these
    with mail messages, but at least there is something you can do.
    
    Ben

    re .23
    
    Could you give me a pointer to any information about XLSCAN or
    MVTOOL/SCANPROT.DOT - what they are, how they work etc.
    
    re .22
    
    Identifying who "owns" the file doesn't help me disinfect it - if I
    tell the owner it's their responsibility nothing will be done about it.

    re .24
    you mention a parameter to tell VSWEEP to disinfect documents - which
    parameter is that (I can't find it in the documentation I have.
    
    Jenny

        $ vsweep :== $dev$manager:[vsweep]vsweep_axp
        $ vsweep
        
        and it will output:
        
The VSWEEP command format is:

    $ VSWEEP {qualifiers} VMS_filespec{qualifiers}{,VMS_filespec{qualifiers}...}

where 'VMS_filespec' specifies PATHWORKS file services.
All normal VMS wildcard characters and logical names can be used, e.g.

    $ VSWEEP $DISK1:[SYS0.PCSAV40...]%.EXE

will sweep files %.EXE;* in $DISK1:[SYS0.PCSAV40] and all subdirectories.

The optional command line qualifiers are:

/AD    AUTODEFAULT MODE: ignores name.type;version in VMS_filespecs,
       sweeps *.COM;*,*.EXE;*,*.OV%,*.SYS;* in specified VMS directories,
       or (*.COM,*.EXE,*.OV?,*.SYS) in *.DSK;* if /DS is specified
/AL    in autodefault mode, sweep *.*;* (not just *.COM;* etc.)
/CC{=f} generate checksum values for clean files
       and add to temporary file "f" (default = INTERCHECK_COMMS_DIR:IC.WRK)
/DA    in autodefault mode, check *.* within each virtual disk
/DI    disinfect infected items
/DL    list all files checked within each DOS virtual disk
/DS{=(DOS_filespec{,DOS_filespec...})}  DISK SERVICE MODE
       process VMS_filespec as virtual DOS disks, sweeping only specified DOS
       files within each virtual disk (default = *.* unless /AD is specified)
/FF    treat fixed-length sequential as an expected record format
/FI    do not warn of unexpected record formats
/FO    do not sweep files with unexpected record formats
/IL    ignore files locked by other processes
/NC    replace concealed device names with physical device names
/NS    list all files as they are checked
/OUT{=f} write reports to file "f" (default = SWEEP.LOG)
/QU    quick sweeping
/RW    attempt to sweep files already opened for writing
/SC    sweep compressed files
/VF{=f}  list VMS names of infected files to file "f" (default = SWEEP.VIR)

%CLI-F-INSFPRM, missing command parameters - supply all required parameters

        according to which /DI is it.
        
        _veli
        

    Re: .26
    
>    Could you give me a pointer to any information about XLSCAN or
>    MVTOOL/SCANPROT.DOT - what they are, how they work etc.
    
    For MVTOOL/SCANPROT.DOT:
    
    http://www-is-security.mso.dec.com/is-sec/pc-sec/anti-virus-table1.html
    
    XLSCAN is from Microsoft.  The pointer I had is:
    
    http://www.microsoft.com/kb/articles/q150/9/90.htm
    
    There was a memo that went out about this internally, but I'm not sure
    where it is.   You can probably get either tool internally fairly
    easily, such as \\xxx-OFFICE-1\SECTOOLS, where xxx is a facitily name
    such as TAY.
    
    These tools are similar in that they both run from the "Office" product
    (Excel or Word).  XLSCAN actually works automatically.  However one way
    around them is to open a message from Exchange.  
    
    RE: .26  
    
    The command we use for VSWEEP is 
    
    $ @DISK$:[VSWEEP]VSWEEP_MANAGER.COM -
        DEFAULT DEFAULT DEFAULT SCAN_AND_DISINFECT
    
    Perhaps this translates to /DI; I've never checked. It says it is
    disinfecting, but doesn't always seem to.  I know that SWEEP's idea of
    disinfecting is usually a RENAME.  
    
    
    Ben

        The latest version of VSWEEP (or VSWEEP_MANAGER) appears to do
        the disinfection automatically. It appears to disinfect
        successfully WORD documents containing MDMA and NPDA viruses. It
        does not discinfect Excel spreadsheets containing e.q. Laroux
        virus.
        
        _veli

    One of the reasons that Office 97 is not supported internally yet is
    that if documents are stored in the new format, the current virus
    scanners don't work yet.  There's supposed to be some sort of built in
    protection, but I'm not sure how well it works.
    
    Ben