LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-09-2010, 05:39 AM   #1
joje47
LQ Newbie
 
Registered: Mar 2010
Posts: 7

Rep: Reputation: 0
How do I parse a textfile to move some files?


Hi,
I use avg free as antivirus scanner. I looked some time for a scanner to scan and remove viruses. Problem is avg 8.5 will only detect viruses, not remove them...
I use a oneliner looking like this:

Code:
/usr/bin/avgscan / -x /mnt -x /dev --heur --ignerrors -r /var/log/"scanlog"`eval date +%Y%m%d`".txt"
resulting in a textfile like this:

Code:
AVG command line Anti-Virus scanner
Copyright (c) 2009 AVG Technologies CZ

Virus database version: 271.1.1/2731
Virus database release date: Mon, 08 Mar 2010 20:33:00 +01:00

Scan command: /opt/avg/avg8/bin/avgscan -x /mnt -x /dev --heur --ignerrors -r /var/log/scanlog20100309.txt / 

/home/msprofiles/kareri/.msprofile/Lokala inställningar/Temporary Internet Files/Content.IE5/IW35SR02/px[1].data  Trojan horse SHeur2.CLDP
/home/msprofiles/kareri/.msprofile/Lokala inställningar/Temp/387.exe  Trojan horse SHeur2.CLDP
/home/kareri/RECYCLERS/runmgr.exe  Virus identified Worm/Generic_r.GC
/home/kareri/RECYCLERS/runmgr.exe  Virus identified Worm/Generic_r.GC
------------------------------------------------------------------------------
Scan started at: Tue, 09 Mar 2010 09:43:38 +01:00
Scan ended at: Tue, 09 Mar 2010 12:40:54 +01:00

Elapsed time:  10636s
------------------------------------------------------------------------------
Files scanned     :  1145523(1144343)
Infections found  :  4(4)
PUPs found        :  0
Files healed      :  0
Warnings reported :  0
Errors reported   :  101
------------------------------------------------------------------------------

Now I want to parse that file to pick the infected files and use mv to secure the system.. is there any way to acomplish that?

I guess I could start with looking for the lines starting with / evaluate them so when they get two spaces, then it cuts. (Filename comes first, then two spaces, then description of virus..)

then use the line to mv the file someware. For instance /var/quarantine/

I know there are problably other programs that do work. But it took me some time to install and figure out this one, and now when I got it working it seems like avg has stopped the healing function in this upgrade.. They are "working on it"..
If you have a tip about a free anti-virus software that is easy to figure out, it would be nice. But I would also like to learn some parsing. This was a bit tuff for me right now. But if someone please can get me started im shure I can figure it out. I know a bit of bash and php, not so much about pearl but anything is apreciated.
 
Old 03-09-2010, 06:01 AM   #2
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Well you have a few options; you can try this with Bash using a for loop and the cut command, or you can use your favourite scripting language, up to you.

A 30second script in python to do this simply:
Code:
#!/usr/bin/env python
#-* coding:utf-8 -*-
#
# Open the file, try and find viruses
# uses certain assumptions based on length of header in file
# and so on

report = open( "./avg_out", 'r' ).readlines()
for i in range( len( report ) ):
    if not i <= 8: 
        if report[i] == "\n" or report[i][0] == "-" :
            break
        print report[i].split(" ")[0]
(Like I say, 30second, and only tested on that output of yours. You will have to change the print line to delete the file. Thats an exercise for you)
 
Old 03-09-2010, 08:29 AM   #3
joje47
LQ Newbie
 
Registered: Mar 2010
Posts: 7

Original Poster
Rep: Reputation: 0
hmm, thanks

Tried it on some sample outputs, and it seems to work. Have to try a bit more. Dont know much about python, but I think i understood most of it, but I have to try to search a bit to understand how to use dates and to move files, but this is a good starter. Tx.
 
Old 03-09-2010, 08:39 AM   #4
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Well, python has an interactive shell; so type in 'python' at a terminal. Libraries are imported with 'import', and every library/module/$terminology, assuming documented properly, is can be called in 'help()' as so:
Code:
>>> import time
>>> help(time)
Help on module time:

NAME
    time - This module provides various functions to manipulate time values.
<snip>
The module for moving files is 'shutil', so once again import and help. You'll pick it up as you go along, try http://diveintopython.org to learn it in a couple of hours, or just google.

But yes, there are neater and smaller ways, but the above is quick, efficient and easy enough to change and adapt.

EDIT:
Just realised I made a mess of the first example anyway;
Code:
#!/usr/bin/env python
#-*- coding:utf-8 -*-

report = open( "./avg_out", 'r' ).readlines()
for line in report[8:]:
    if not line == "\n" and not line[0] == "-":
        print line.split("  ")[0]
    else: break

Last edited by jamescondron; 03-09-2010 at 08:50 AM. Reason: re-post code
 
Old 03-10-2010, 03:16 AM   #5
joje47
LQ Newbie
 
Registered: Mar 2010
Posts: 7

Original Poster
Rep: Reputation: 0
Now I think it works

Hi again,

Tx for your clarification. I noticed that small miss with double spaces. Now I got it this far..

I changed the oneliner to:

Code:
/usr/bin/avgscan / -x /mnt -x /dev --heur --ignerrors --hidext -r /var/log/"scanlog_"`eval date +%Y-%m-%d`".txt"
so I got the date like this 2010-03-10, instead of how Im used to write it: 20100310. I couldnt figure out how to get the date in that form with python But down I guess its a bit crude, but It passed som testfiles I did, I have to test it a couple of times more.


Code:
# Open the file, try and find viruses
# uses certain assumptions based on length of header in file
# and so on

import datetime
import subprocess

today = datetime.date.today()
scanlog = "./scanlog_" + str(today) + ".txt"
basedir = "/var/quarantine/"

report = open( scanlog, 'r' ).readlines()
for i in range( len( report ) ):
    if not i <= 8:
        if report[i] == "\n" or report[i][0] == "-" :
            break
        src = report[i].split("  ")[0]
        fn = report[i].split("  ")[0]
        fn = fn.strip()
        dest = basedir + fn.replace('/','_')
        print str(dest)
        #subprocess.Popen("mv" + " " + src + " " + dest,shell=True)
 
Old 03-10-2010, 08:03 AM   #6
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Or....
Code:
#!/usr/bin/env python
#-* coding:utf-8 -*-
#
# Open the file, try and find viruses
# uses certain assumptions based on length of header in file
# and so on

import shutil, time

report_title = time.strftime( "%Y%m%d" )
report = open( "./scanlog_%s.txt" % report_title, 'r' ).readlines()

for line in report[8:]:
    if not line == "\n" and not line[0] == "-":
        file = line.split("  ")[0]
        print "Quarantined: %s" % file
        shutil.move( file, "/var/quarantine/%s" % file.split("/")[-1] )
    else: break
I used time.strftime() to formate the time (using the time library) to the format you wanted, and I used shutil.move( src, dst ) to move the file to /var/qua.

You may find it easier, incidentally, to use %s in strings that are using variables; http://homepage.mac.com/andykopra/pd...n_strings.html has a quick skim on it if you're not a C programmer (Where we use this sort of thing a lot).

Basically, the first %s a string. We define this at the end:
Code:
s = "string"
print "this is a %s" % (s)
..
a = "hello"
b = "world"
print "%s %s" % (a,b)
and so on
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] how to find a word in a textfile starting from the BOTTOM of the textfile ? markraem Linux - Software 3 02-08-2010 06:12 AM
Parse Log files nima0102 Linux - Server 2 11-23-2009 11:24 AM
cannot using FTP move command to move files adrianmak Linux - Networking 4 04-21-2009 12:01 PM
Apache2 doesn't parse php4 files (RHEL 4) Bartoldo Red Hat 2 09-19-2007 01:52 PM
Parse configuration files introuble Programming 14 09-01-2006 01:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 02:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration