China DOS Union

I'd like the experts to take a look.
===========================
　　After our bureau's office LAN was built, it was troubled for a long time by system vulnerabilities and virus attacks, causing the network to crash frequently. To solve this problem, by using sharing we implemented a solution on the machine in the communications room (access method: \\10.157.xx.xx) to automatically install system patches and the latest virus definitions in the LAN. Below is an explanation of the script file.

@echo off
cls
echo.
echo 　＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
echo 　＊　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　＊　　
echo 　＊　　Function: a script for installing M$ patches on an internal　　＊
echo 　＊　　network that cannot access the Internet　　　　　　　　　　　＊
echo 　＊　　Limitation: this version can only be used with WINDOWS XP SP2　＊
echo 　＊　　　　　Simplified Chinese edition; other versions are　　　　＊
echo 　＊　　　　　currently being made.　　　　　　　　　　　　　　　＊
echo 　＊　　Author: Yu Zhenzhong　　　　　　　　　　　　　　　　　　＊
echo 　＊　　e-mail:yuzhenzhong@163.net　　　　　　　　　　　　　　　＊
echo 　＊　　Patch date: March 18, 2005 　　　　　　　　　　　　　　　＊
echo 　＊　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　＊
echo 　＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊
echo.
rem Set server IP and shared path
set HotPatch=\\c02\hotfix\xp\sp2
rem Create temporary folder
set mhnet=%temp%\mhnet
rem @rmdir /S /Q %mhnet% 2>NUL 1>NUL
mkdir %mhnet%

rem Main program starts
:Start
rem Check completeness of required files
rem call :AllFiles
rem Check whether it is a WINDOWS XP SP2 system
call :CheckSystem
rem Check whether administrator privileges are present
call :CheckAdmin
echo.
pause
rem Start upgrading the system
call :HotfixUp
rem Delete temporary directory, clear variables
rmdir /S /Q %mhnet% 2>NUL 1>NUL
set mhnet=
set HotPatch=
goto :eof
exit
:ends
rem Main program ends



rem *************************
rem *************************
rem Determine whether the system version is WINDOWS XP SP2, otherwise exit
rem *************************
rem *************************
:CheckSystem
rem First determine whether the system version belongs to the WINDOWS NT series; if it is the WIN98 series then exit
IF %OS%==Windows_NT (
rem Determine again whether the system version is SP2
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CSDVersion" >%mhnet%\banben.log
find "Service Pack 2" %mhnet%\banben.log >NUL
IF ERRORLEVEL 1 (
cls
echo.
echo Note: this program can only be used on systems running Windows XP SP2.
echo Please upgrade to Windows XP SP2 first, then run this program!!!
pause
exit
) else (
echo User is running a Windows XP SP2 system,
)
) else (
rem System is the win98 series.
cls
echo.
echo 　　　　　　　　Runtime error!
echo.
echo Note: this program cannot be used on systems of the %os% series.
pause
exit
)
goto :eof




rem *************************
rem *************************
rem Determine whether administrator privileges are present, otherwise exit
rem *************************
rem *************************
:CheckAdmin
net user %username% > %mhnet%\ifadmin.log
rem If not a system administrator
find "*Administrators " %mhnet%\ifadmin.log >NUL
IF ERRORLEVEL 1 (
cls
echo 　　　　Runtime error!
echo.
echo Note: the user is not a member of the system administrators group and cannot execute this program!!!
echo Please switch to a user with sufficient privileges and run this program again.
pause
exit
goto :eof
) else (
echo The user belongs to the system administrators group and can execute this program.
)
goto :eof



rem *************************
rem *************************
rem Map the shared patch package directory on the server to local drive S, and run the patch packages one by one
rem *************************
rem *************************
:HotfixUp
net use S: %HotPatch%
S:
cls
echo 　　　　Note! Do not close this program. It will exit automatically after the system upgrade is finished.
echo 　　The system is being upgraded, please wait......
IF not EXIST %SystemRoot%\KB834707.log KB834707.exe /passive /norestart
IF not EXIST %SystemRoot%\KB867282.log KB867282.exe /passive /norestart
IF not EXIST %SystemRoot%\KB873333.log KB873333.exe /passive /norestart
IF not EXIST %SystemRoot%\KB873339.log KB873339.exe /passive /norestart
IF not EXIST %SystemRoot%\KB885250.log KB885250.exe /passive /norestart
IF not EXIST %SystemRoot%\KB885835.log KB885835.exe /passive /norestart
IF not EXIST %SystemRoot%\KB886185.log KB886185.exe /passive /norestart
IF not EXIST %SystemRoot%\KB887742.log KB887742.exe /passive /norestart
IF not EXIST %SystemRoot%\KB888113.log KB888113.exe /passive /norestart
IF not EXIST %SystemRoot%\KB890047.log KB890047.exe /passive /norestart
IF not EXIST %SystemRoot%\KB890175.log KB890175.exe /passive /norestart
IF not EXIST %SystemRoot%\KB891781.log KB891781.exe /passive /norestart
IF not EXIST %SystemRoot%\KB887472.log KB887472.exe /q
rem Fix the pending file version problem that may be caused by running multiple patch packages at once without rebooting the system
Qchain.exe
rem Delete the local shared mapped drive
C:
net use S: /Delete /Y
goto :eof


rem ----- this is the end of this batch file -------

The script is written very well, but I feel it isn't necessary, because Microsoft's Software Update Service (that is, SUS) can provide automatic updating of critical patches, and it is fully automatic (because it uses Microsoft's Automatic Updates feature). Of course, SUS can only be used with Windows 2000/XP/2003, but how many people are still using Win9x now? Even if they are, Win9x basically doesn't need many patches anymore. I suggest you take a look at this article: http://www.cctips.com/show.aspx?id=78&cid=6

Microsoft's Software Update Service (that is, SUS) can provide automatic updating of critical patches, and it is fully automatic (because it uses Microsoft's Automatic Updates feature), ===========but Microsoft's Software Update Service costs money. You also have to set up a dedicated server for it. I think it would be better to use FreeDBS+Samba, completely free and with no copyright issues.

SUS is free. I've been using it for a long time. Compared with the maintenance time you spend downloading patches and writing upgrade scripts, one server is nothing.

SUS is free. I've been using it for a long time. Compared with the maintenance time you spend downloading patches and writing upgrade scripts, one server is nothing.====================1. SUS must use WIN2000/2003 server. Do you think maintaining a WIN server is easy? (It has to be rebooted every day, and every month there are lots of patches to install; even then I still don't dare relax.) I don't believe it. M$ stuff is too lousy, only suitable for ordinary users as desktops. I don't like using it as a server. For servers, FreeBSD\Linux\or other commercial UNIX systems are secure, stable, and reliable. 2. If your network has only 20-30 machines, do you think a unit of that size would be willing to buy a server just to run SUS? (This patch script can be made into a CD and sent to them; they can share it from any machine running win98 or WINXP.) 3. I want to use FreeBSD+Samba as the server, and from there handle patching M$ clients and upgrading virus definitions. Using FreeBSD as the system means there are no copyright issues with the software and it can be used for free. How much does a set of WIN2000/2003 server cost? The only option is to use pirated copies.

If you are willing to spend so much time and effort maintaining patch updates yourself, of course I have no objection. Although win2000/2003 is not free, sus really is free. FreeBSD is free too, but it still needs to occupy a machine that is not free. Actually the costs are about the same. Microsoft's systems are not as bad as they are made out to be on the Internet either; after all, they still hold the main market share. I don't want to discuss the pros and cons of Windows and Unix systems, because there is no point in discussing that. The tools are all here now, so just do whatever you feel is more convenient. Anyway, I think SUS is quite simple. After installing it, you basically don't need any maintenance tools anymore; at most you tick a few boxes every month and that's it. I think it greatly saves my time and energy.

Microsoft's systems are not as bad as they are made out to be on the Internet either; after all, they still hold the main market share. I don't want to discuss the pros and cons of Windows and Unix systems, because there is no point in discussing that.-----------------------In many units I have seen (20-50 machines or fewer), the situation is this: 1. Basically they use pirated M$ WIN98 and XP; even if some brand-name machines came with genuine preinstalled copies, after the system could no longer boot they were later reinstalled by repair people (hired from outside) with pirated copies. 2. 100% of the machines have no patches installed, and the virus definitions are two or three years old!!! 3. 100% of the machines have various viruses (Trojans), and some machines have ten kinds; hundreds or even thousands of files are infected. The systems are extremely slow. 4. There is no dedicated maintenance staff in those units, or nobody is willing to do this kind of "thankless hard work." Therefore I want to write this patch script and make it into a CD that can be shared from any machine running win98 or WINXP to solve this.

This only means the people doing maintenance in those units are too poor at it. Don't you think computer users in China generally lack maintenance common sense too much? It's just like someone driving a car without knowing how to maintain it. That is not the car's problem, but the person's problem. As for whether the software is pirated or not, that doesn't really matter either. In China, at present, piracy is a good way to save money. Besides, even if it is FreeBSD or Linux or even AIX, if maintenance and upgrading are neglected, there will still be many security problems. They only seem safer because their market share is too low, so their security problems do not stand out as much, that's all. A long time ago, there were patch collections for Win98 and other Windows systems on the Internet; I also made one myself, but maintaining a patch collection is really too difficult and too time-consuming. I know that from deep experience.

This only means the people doing maintenance in those units are too poor at it. Don't you think computer users in China generally lack maintenance common sense too much?
------------------------------
Making patch collections for Win98 and other Windows systems is exactly for the broad mass of users who "don't understand computer maintenance very well."

We cannot expect every person who uses a "computer" to be a maintenance expert. It is precisely to keep "viruses and Trojans" from spreading at will that I want to do this.

It is not only system maintenance experts who need to know how to patch a system; that is a mistaken understanding. That is why I say the overall quality of computer users in China is generally low. Packaging a patch collection may indeed be something only experts do. Although it is not complicated, it really does require some skill.

Packaging a patch collection may indeed be something only experts do. Although it is not complicated, it really does require some skill.------------------------So I hope the experts can give some pointers. Also: our internal network must be physically isolated from the Internet; a machine is not allowed to connect to the Internet at one moment and to the internal network the next. In that case, how can SUS be used?

I think machines that are physically isolated from the Internet do not need patching at all, because there is no possibility of being infected by worms. But since they have been infected by worms, that shows someone is still violating the rules and connecting to the Internet. In that case, as the MIS department, there is even less reason to obey this rule. My own unit also has this rule, and I have always taken a scornful attitude toward it (of course, security work still has to be done properly). You can install a SUS server on the Internet side. Since SUS automatically downloads critical updates locally, you can use it only to automatically download the patch programs, then copy those patch programs into the internal network with a mobile hard disk, and then use the automatic update script you wrote earlier to upgrade the machines on the internal network.

I think machines that are physically isolated from the Internet do not need patching at all, because there is no possibility of being infected by worms. But since they have been infected by worms, --------------------some units really are physically isolated from the Internet (monitoring software with VRV can guarantee it), but users install software recklessly and there is no antivirus protection, so the network still gets infected by worms. I still want to do it with "physical isolation," because the higher-ups require it to be this way. You can install a SUS server on the Internet side. Since SUS automatically downloads critical updates locally, you can use it only to automatically download the patch programs, then copy those patch programs into the internal network with a mobile hard disk, and then use the automatic update script you wrote earlier to upgrade the machines on the internal network.-------------------------Are there any other methods? I looked through some materials, and some units use "website mirroring." I wonder whether that can achieve "physical isolation."

Bump

Replying with a bump, a model off-topic thread from the Union, ^_^