杀毒软件的简单实现

最新推荐文章于 2023-07-05 15:51:26 发布

amh

最新推荐文章于 2023-07-05 15:51:26 发布

阅读量1.2k

点赞数

分类专栏：编程技术文章标签：杀毒软件 access null fp file path

本文链接：https://blog.csdn.net/amh/article/details/160418

版权

这是一个简单的杀毒软件实现，主要包含三个功能：扫描文件、处理病毒和删除注册表键值。程序首先通过特征码匹配扫描指定文件及其子文件夹，接着枚举并检查进程，若发现恶意进程则终止并删除相关文件。最后，删除注册表中特定键值。

摘要由CSDN通过智能技术生成

#include "FunDef.h"

int main (int argc, char *argv[])
{
if (argc==1)
{
Usage(argv[0]);
return 0;
}

if (!(ScanFileVXER(argv[1])))
{
printf("ScanFileVXER() GetLastError reports %d/n",erron);
return 0;
}

if (!(ProcessVXER()))
{
printf("Processes() GetLastError reports %d/n",erron);
return 0;
}

if (!(RegDelVXER()))
{
printf("RegDelVXER() GetLastError reports %d/n",erron);
return 0;
}

return 0;
}

BOOL ScanFileVXER (char *FileName)
{
int count=LOW;

WIN32_FIND_DATA FindFileData;
HANDLE hFind;
BOOL returnvalue=FALSE;
DWORD lpBufferLength=HIGH;
char lpBuffer[HIGH]={LOW};
char DirBuffer[MAX_PATH];

long FileOffset=0x1784; //偏移地址
int FileLength=0x77; //长度

unsigned char Contents[]={
0x49, 0x20, 0x6A, 0x75, 0x73, 0x74, 0x20, 0x77, 0x61, 0x6E, 0x74, 0x20, 0x74, 0x6F, 0x20, 0x73,
0x61, 0x79, 0x20, 0x4C, 0x4F, 0x56, 0x45, 0x20, 0x59, 0x4F, 0x55, 0x20, 0x53, 0x41, 0x4E, 0x21,
0x21, 0x20, 0x62, 0x69, 0x6C, 0x6C, 0x79, 0x20, 0x67, 0x61, 0x74, 0x65, 0x73, 0x20, 0x77, 0x68,
0x79, 0x20, 0x64, 0x6F, 0x20, 0x79, 0x6F, 0x75, 0x20, 0x6D, 0x61, 0x6B, 0x65, 0x20, 0x74, 0x68,
0x69, 0x73, 0x20, 0x70, 0x6F, 0x73, 0x73, 0x69, 0x62, 0x6C, 0x65, 0x20, 0x3F, 0x20, 0x53, 0x74,
0x6F, 0x70, 0x20, 0x6D, 0x61, 0x6B, 0x69, 0x6E, 0x67, 0x20, 0x6D, 0x6F, 0x6E, 0x65, 0x79, 0x20,
0x61, 0x6E, 0x64, 0x20, 0x66, 0x69, 0x78, 0x20, 0x79, 0x6F, 0x75, 0x72, 0x20, 0x73, 0x6F, 0x66,
0x74, 0x77, 0x61, 0x72, 0x65, 0x21, 0x21};
//具体内容，十六进制

//获取系统目录的完整路径
if (GetSystemDirectory(DirBuffer,lpBufferLength)!=LOW)
{
if (SetCurrentDirectory(DirBuffer)!=LOW) //设置为当前目录
{
hFind=FindFirstFile(F