------------------
C.Jones

Note : When you download the 4044updt.exe files from their website you have to execute it, then during the execute the setup writes all its files to C:\TEMP\~EXB0000 or C:\WINDOWS\TEMP\~EXB0000. These files must be copied to @LDRIVE + "\Virus"
Also, Mcafee can't disable it's own scanner, It copies the SCAN.DAT file as SCAN.OLD, when you then restart your PC, SCAN.OLD overwrites SCAN.DAT. So it takes 2 login times to update the scanner ...

Hope this helps a bit...

:VIRUS

$DATPath = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan","DAT")

$Start = LEN($DATPath)

If ($Start = 0)
$DATPath = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Scan95","DAT")

$Start = LEN($DATPath)
If ($Start = 0)
RETURN
Endif
Endif

If NOT SUBSTR($DATPath,$Start,1) = "\"
$DATPath = $DATPath + "\"
Endif

$File1 = $DATPath + "CLEAN.DAT"
$File2 = @LDRIVE + "\Virus\CLEAN.DAT"

IF COMPAREFILETIMES($File1, $File2) = -1
MD $DATPath + "Upgr"
DEL $DATPath + "Upgr\*.*"
COPY @LDRIVE + "Virus\*.*" $DATPath + "Upgr\*.*"
RUN $DATPath + "Upgr\Setup.exe -s -hsetup.iss"
;RUN $DATPath + "Upgr\Setup.exe"
GOSUB VIRUSINFO
ENDIF

RETURN

:VIRUSINFO

CLS
SMALL
COLOR w/n
AT (1,1) "Your anti-virus software is being upgraded :"
BIG
COLOR g+/n
AT ( 3,1) "Anti-Virus"
SMALL
COLOR w+/n
AT (12, 35) @TIME " - " @DAY ", " @MDAYNO " " @MONTH " "@YEAR
COLOR g/n
BOX(13,0,23,79,FULL)
COLOR g+/n
AT (14,2) "Product : "
AT (15,2) "Language : "
AT (16,2) "Serial number : "
AT (17,2) "Company : "
AT (18,2) "Destination : "
AT (20,2) "URL : "

AT (14,46) "Product Version : "
AT (15,46) "Engine Version : "
AT (16,46) "Version : "
AT (17,46) "Timestamp : "

COLOR w+/n

$Product = READPROFILESTRING(@LDRIVE + "\Virus\SETUP.ISS", "Application", "Name")

$Version = READPROFILESTRING(@LDRIVE + "\Virus\SETUP.ISS", "Application", "Version")

$Company = READPROFILESTRING(@LDRIVE + "\Virus\SETUP.ISS", "Application", "Company")

$URL = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan","szVirusInfoURLValue")

$EngineVersion = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan","szEngineVer")

$SerialNumber = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan","szSerialNum")

$ProductVersion = ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan","szProductVer")

$TimeStamp = GETFILETIME(@LDRIVE + "\Virus\SCAN.DAT")

AT (14,22) $Product
AT (15,22) "English"
AT (16,22) $SerialNumber
AT (17,22) $Company
AT (18,22) $DATPath
AT (20,22) $URL

AT (14,65) $ProductVersion
AT (15,65) $EngineVersion
COLOR r+/n
AT (16,65) $Version
AT (17,65) SUBSTR($TimeStamp,9,2) + "/" + SUBSTR($TimeStamp,6,2) + "/" + SUBSTR($TimeStamp,1,4)
COLOR w+/n

SLEEP 10

RETURN

------------------
C.Jones

1) look for any antivirus products in their line
2) check the version of the pattern files
3) check the version of the engine
4) unzip files
5) stop the antivirus program
6) update pattern files (takes effect without reboot)
7) update engine (needs a reboot)
8) restart the antivirus software

All in one neat executable.. it leaves a logfile which you specify on the commandline.
The only issue I have had with this is that I need to write something which examines the output from a TLIST command (list of processes) to force the updater script to wait for the antivirus to finish loading before running the superdat file (because otherwise I have seen the two fight when the updater fires off at the same time the antivirus is loading, it will spit out a corrupt definitions-file message)...

Here's my script-- (built around my main logon script, but hope this helps also)

; /* UPDATES ANTIVIRUS ENGINE AND VIRUS PATTERN DEFINITIONS FOR BOTH 95/NT */
;
;
;
; $script_name is the name of this script without the extension

If $os = "Windows 95"
$Rtn = Exist ("c:\program files\network associates\mcafee virusscan\vshwin32.exe")
If $Rtn = 0
; /* Not installed on Win95 */
? "Antivirus not installed for Win95, exiting script"
$continue=1
Return
Else
? "Detected antivirus software for Win95"
Endif
Endif

; loop...
; Grep a tlist output of processes and wait until the antivirus has completed starting
; before running the superdat install to avoid conflicts
; fail after a certain time period of not finding the antivirus software process..

; Code looking for different types of updates (sdat, pattern only, etc...)
; Right now it is only configured to work if a single sdat file is found in the update dir

; /* Read the filename in the directory to know what to run automatically (dir sdat*.exe) */
; If more than one is detected, then compare the file dates
; (set manually until coded)

$sdat_dir = "$updates_directory\$script_name"

; /* Obtain the filename of the superdat file or abort on error */
? "Scanning for sdat files in: $sdat_dir"
$sdat = ""

$FileName = Dir("$sdat_dir\sdat*.exe")
While ($FileName <> "") and (@ERROR = 0)
If $sdat = ""
$sdat = $Filename
? "Found: $sdat_dir\$sdat"
Else
? "Found: $sdat_dir\$filename"
? "Error: Multiple sdat files detected, script aborting"
; shell net send mis error message...
$Continue=1
Return
Endif
$Filename = Dir() ; retrieve next file
Loop
If $sdat = ""
? "No sdat files found"
$Continue=1
Return
Endif

$superdat = $sdat
;$superdat = "sdat4043.exe"

? "Current version : $superdat"

; /* Exit if we've already received the current update */
If $stage_completed = $superdat
? "No new update available"
$continue=1
Return
Endif

$av_logfile = "$script_name" + ".txt"

? "Deleting old logfile: $logfile_directory\$av_logfile"
del "$logfile_directory\$av_logfile"
copy "$updates_directory\$script_name\$superdat" "$logfile_directory"
$av_logcmd = "/logfile $logfile_directory\$av_logfile"
$cmd = "%comspec% /e:1024 /c $logfile_directory\$superdat /silent $av_logcmd"

; /* Sleep some to give the antivirus program a chance to startup and avoid conflicts */
sleep 5

? "Executing: $cmd"
shell "$cmd"

; /* Read logfile to determine if the update failed */
; Product may not be installed... if this is the case, send an alert to mis,
; then set stage_completed = ""
;
; Determine any other reasons why it may have failed (already had newest pattern)..etc

$stage_completed = $superdat
$continue=1
Return

code:

---

:VARDEC
   Global $HKLM_S, $netlog
   $HKLM_S="$HKLM\SOFTWARE\"
   $netlog=Substr(@LDRIVE,1,Len(@LDRIVE)-1)
;
; $OS is set in another subroutine.  It will either be:
; "Win9x" or "Windows NT"
;
; I can supply that subroutine if anyone is interested.
Return
;
;****************************************************************************************
:VIRUSUPD
; Description:
; This subroutine will first check to see if Network Associates' McAfee Virus Scan has
; been installed on this system.  If it has, it will compare the installed virus definition
; version to that on the server.  If the server version is newer, it will install it.
; The macro @LDRIVE reports a letter and a colon on Win9x computers and a UNC on NT.
;
; Input:
; $HKLM_S, $netlog, $OS
;
; Output:
; None
;****************************************************************************************
; Modification History
; Date		Initials	Description
; 10 Sep 99	bvv		Wrote first cut.
; 14 Sep 99	bvv		Adjusted script to accomodate @ldrive macro.
;****************************************************************************************
;
   Dim $key, $avversion, $newversion, $versiondif, $newvernum, $virfile
   $key=$HKLM_S+"McAfee\VirusScan"
   If ExistKey("$key")=0
      $avversion=ReadValue("$key","szVirDefVer")
      If @ERROR=0
         $avversion=Val(Substr($avversion,Len($avversion)-3,4))
         If @ERROR=0
            If $OS="Win9x"
               $virfile="$netlog:\sdat*.exe"
            Else
               $virfile="$netlog\sdat*.exe"
            Endif
            ; In case someone leaves old virus definition files around, will take advantage
            ; of the fact that McAfee uses 4 digits in its file names which gets incremented
            ; by one with each new version.
            $newverion=Dir("$verfile")
            While $newversion<> "" and @ERROR=0
               $savename=$newversion
               $newversion=Dir()
            Loop
            $newversion=$savename
            ; The above loop will find all the virus definitions in the netlogon share.  By
            ; virtue of the fact that the filenames have 4 digits in them and that they are
            ; incremented by one with each new version, the last name found will be the newest.
            ; Each time through the loop, save the found name.  The last time through the
            ; loop, $newversion="".  So, set it to the last saved name.
            $newvernum=Val(Substr($newversion,5,4))
            $versiondif=$newvernum-$avversion
            If $versiondif>0
               If $OS="Win9x"
                  Copy "$netlog:\$newversion" %TEMP%
               Else
                  Copy "$netlog\$newversion" %TEMP%
               Endif
               ? "Updating virus definitions.  The version being installed is: $newversion."
               $selection=Messagebox("The virus definitions on your computer are being updated.  As a result, your system may reboot itself.  If it does, just login again.", "Important Notice",4160,7)
               Shell "$comd $newversion /logfile %TEMP%\mcafeedat.txt /silent /reboot"
               ; The system may reboot here.
            Else
               ? "The virus definitions are up to date.  Currently installed version is:"
               ? "$avversion.  And the new version is: $newvernum."
            Endif
         Else
            ? "There was an error reading the new virus definition file."
            ? "The error is: "+@SERROR
            ? "Netlog is: "+$netlog
         Endif
      Else
         ? "Could not read the version of the virus defenition files."
         ? "Error is: "+@SERROR
      Endif
   Else
      ? "McAfee is not installed on this system!"
   Endif
Return
;
;****************************************************************************************

---