Alert if Uncleaned Infections are detected on Endpoint

Download JSON Download Python

Ratings

Release Time

06/05/2017

Downloads

1072 times

Update Time

11/18/2024

Views

1004 times

Share-it:

Tags

Script monitroing uncleaned detected infections

Please refer the below script monitor to,

Procedure will look for Uncleaned Infection Files on your endpoint by the Comodo Firewall Component, So before you check/run the script on your endpoint, you should have installed the CCS on your endpoint.

Note:
Please ensure that the CCS (Comodo Client Security) is installed on your endpoint to take the script effectively
Please refer the URL to Install CCS - https://forum.mspconsortium.com/foru...omodo-packages
Please refer the URL to Execute the Monitoring Script - https://forum.mspconsortium.com/foru...oring-upcoming

Please refer the wiki guide for how to use the custom monitoring scripts:

https://forum.mspconsortium.com/forum/products/other-comodo-products/comodo-device-management/wiki-faq-how-to/11486-how-to-use-custom-script-procedure-monitoring

Tested OS : This script has tested on Windows(7), Windows(8,8.1), Windows(10) Machines

Procedure's Instructions

import os
import sys
import subprocess
import ctypes
ps_command=r'Get-CimInstance -Namespace root/cis AvInfectedItem'
class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

def alert(arg): 
   sys.stderr.write("%d%d%d" % (arg, arg, arg))\
                             
with disable_file_system_redirection():
    cmd1='powershell "Set-ExecutionPolicy RemoteSigned -force"'
    process1=os.popen(cmd1).read()
    process=subprocess.Popen('powershell "%s"'%ps_command, shell=True, stdout=subprocess.PIPE)
result=process.communicate()
ret=process.returncode
if len(result[0])>0:
    alert(1)
    print '\nThe following Uncleaned-Infections are found at your endpoint\n%s'%(result[0])
else:
    alert(0)
    print '\nNo Uncleaned Infections Found :)'

Comments

No Comments.

Alert if Uncleaned Infections are detected on Endpoint

Comments

Leave a Comment