Python instance: globally searches for trojan files.

The idea of searching Trojan Files globally is as follows:

You need to prepare an uninfected complete source code and possibly infected source code in advance, and then run the following script to find out which files have been infected or modified.

The main idea is to compare the md5 values of two files to filter files that may be infected with Trojans (specifically, the files that have been modified after a specific time)

The Python script is as follows:

 

Copy codeThe Code is as follows:
_ Author _ = 'flying'
# Coding: UTF-8
# Date: 2014.6.5
# Detect modified files
Import OS, sys, hashlib, datetime
Global_DirOld = ""
Global_DirNew = ""
Global_FilesList = []
# Enter the file path to be compared
Def InputDirPath ():
Global global_DirOld, global_DirNew
Global_DirOld = unicode (raw_input ("Enter the directory where the backup file is located:"), "UTF-8 ")
While not OS. path. exists (global_DirOld ):
Print u "the specified path does not exist. Please enter it again"
Global_DirOld = unicode (raw_input ("Enter the directory where the backup file is located:"), "UTF-8 ")
Global_DirNew = unicode (raw_input ("Enter the directory of the file to be checked:"), "UTF-8 ")
While not OS. path. exists (global_DirNew ):
Print u "the specified path does not exist. Please enter it again"
Global_DirNew = unicode (raw_input ("Enter the directory of the file to be checked:"), "UTF-8 ")

 

# Save data to a file
Def SaveToFile (filePath, content ):
Try:
F = open (filePath, "a + ")
F. write (content. encode ("UTF-8") + "\ n ")
F. close ()
Failed t Exception, ex:
Print "Error:" + str (ex)

# Calculate the MD5 value of a file
Def cal1_5 (filepath ):
Try:
# Open in binary format
With open (filepath, 'rb') as f:
Md5obj = hashlib. md5 ()
Md5obj. update (f. read ())
Hash = md5obj. hexdigest ()
Return hash
Failed t Exception, ex:
Print "Error:" + str (ex)
Return None

# Traverse all files in the directory
Def GetAllSubFiles ():
Global global_FilesList
For dir in OS. walk (global_DirNew ):
For file in dir [2]:
FilePath = dir [0] + OS. sep + file
Global_FilesList.append (filePath [len (global_DirNew) + 1:])

# List new and changed files
Def ListChangedFiles ():
Global global_DirOld, global_DirNew, global_FilesList
Print u "changed or added files :"
For file in global_FilesList:
FilePathOld = global_DirOld + OS. sep + file
FilePathNew = global_DirNew + OS. sep + file
If not OS. path. exists (filePathOld) or cal1_5 (filePathOld )! = Cal1_5 (filePathNew ):
Content = "[" + datetime. datetime. now (). strftime ('% Y-% m-% d % H: % M: % s') + "]" + filePathNew
Print content
SaveToFile ("ChangedFiles.txt", content)

If _ name __= = "_ main __":
InputDirPath ()
GetAllSubFiles ()
ListChangedFiles ()

 

Script Execution result