From: "Joel" <[email protected]> | I am trying to automate a file download, but the filename changes every | time there is an update.
| I have attempted to use a wildcard * to make this easier, but I am | getting an error. Below is the situation: | current file name: | http://download.avg.com/filedir/inst/avg_ipw_stf_all_85_339a1525.exe | my download attempt: | C:\wget>wget http://download.avg.com/filedir/inst/avg_ipw_stf_*.exe --15::55:30-- http://download.avg.com:80/filedir/inst/avg_ipw_stf_%2A.exe | => `[email protected]' | Connecting to download.avg.com:80... connected! | HTTP request sent, awaiting response... 404 Not Found 15::55:31 ERROR 404: Not Found. | Please let me know if I am doing something incorrectly. If not, would | it be possible to look into this? | Thanks! | - Joel - You can't use wildcards with HTTP, only FTP I wish it could. It would make harvesting malware easier to collect. What you can do is what I do in my Multi AV Scanning Tool which uses the KiXtart scripting language and the WGET utility. Example 1: ---------- McAfee uses what is called the SuperDAT. This is an EXE file that contains the the McAfee command line scanner engine and signature files. A new EXE is posted daily and its version number is incremented either daily of if there is a new, hot virus. Today that file is; sdat5636.exe Tomorrow that file may be; sdat5637.exe What I do is parse a known file, UPDATE.INI, that will have the latest version number and extract that version number. From that I can get the URL and then pass the URL (FTP or HTTP) to WGET and download the file. Example 2: ---------- Trend Micro has the Sysclean utility and packages the signatures for Sysclean in a ZIP file. That ZIP file has a version number associated with it and the version number is incremented as new signatures are released. What I do is use WGET to download the web page; www.trendmicro.com/download/viruspattern.asp and save it in a text file. I then pase the text file for the version number. Actual snippet... shell "c:\AV-CLS\wget http://www.trendmicro.com/download/viruspattern.asp"; copy "viruspattern.asp" "pattern.txt" del "viruspattern.asp" $SearchString="the latest pattern file number" IF Open(1,"pattern.txt",2)=0 $x="" cls $x=ReadLine(1) WHILE @ERROR=0 $x=ReadLine(1) if (INSTR($x,$SearchString))<>0 $PatternFile=$x $PatternFileNumber=SUBSTR($PatternFile,val(INSTR($x,$SearchString))+len($SearchString)+9,3) $PatternFile1="lpt"+$PatternFileNumber+".zip" endif LOOP Close(1) del "pattern.txt" The result will be the variable; $PatternFile1 will be the name of the file needed to be downloaded. I then call... shell "c:\AV-CLS\wget http://www.trendmicro.com/ftp/products/pattern/"+$PatternFile1 -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
