C # suspicious file Scan code (find Trojan) (Jane) _c# tutorial

Copy Code code as follows:

Using System;
Using System.IO;
Using System.Text.RegularExpressions;
Using System.Threading;
Using System.Windows.Forms;
Using System.Net;
Namespace Trojanscanning
{
public partial class Form1:form
{
Public Form1 ()
{
InitializeComponent ();
}
delegate void Settextcallback (string text);
delegate void SetTextCallback2 (bool b);
delegate void SetTextCallback3 (ListViewItem item);
private string fname, code;
Private Thread thr;
Private string[] Sarray;
private void Button1_Click (object sender, EventArgs e)
{
if (folderbrowserdialog1.showdialog () = = DialogResult.OK)
{
Scanpath. Text = Folderbrowserdialog1.selectedpath;
}
}
private void Startbtn_click (object sender, EventArgs e)
{
List. Items.clear ();
fname = Scanpath. Text;
THR = new Thread (new ThreadStart (scan));
Thr. IsBackground = true;
Thr. Start ();
}
private void Scan () {
FileSystemInfo s = getfilesysteminfo (fname);
if (s!= null) {SCANBTN (false); Listfiles (s); Scantext ("scan complete"); SCANBTN (TRUE); else {MessageBox.Show ("Please select the directory to scan First");}
}
Public FileSystemInfo Getfilesysteminfo (string path) {
if (file.exists (path))
return new FileInfo (path);
else if (directory.exists (path))
return new DirectoryInfo (path);
Else
return null;
}

private void Listfiles (FileSystemInfo info) {
if (info. Exists) {
DirectoryInfo dir = info as DirectoryInfo;
if (dir = null) return;
try{
filesysteminfo[] files = dir. Getfilesysteminfos ();
for (int i = 0; i < files. Length; i++) {
FileInfo file = Files[i] as FileInfo;
If file!= null && (file. Extension.tolower () = = ". asp" | | File. Extension.tolower () = = ". php" | | File. Extension.tolower () = = ". aspx" | | File. Extension.tolower () = = ". Master")
{
Scantext ("Scan" + file. FullName);
Chkfile (file. Fullname,file. Length);
}else{
Listfiles (Files[i]);
}
}
}
catch{}
}
}
private void Chkfile (String filepath,long filesize)
{
try{
if (Isfileinuse (filepath)) {System.Threading.Thread.Sleep (); Chkfile (filepath,filesize);}
StreamReader sr = new StreamReader (filepath);
String content = Sr. ReadToEnd ();
Sr. Close ();
String chkr=chkcontent (content);
if (chkr!= "") {
ListViewItem item = new ListViewItem ("suspicious");
Item. SubItems.Add (File.getlastaccesstime (filepath). ToString ());
Item. SubItems.Add (CHKR);
Item. SubItems.Add (filepath);
Item. SubItems.Add ((filesize/1024). ToString () + "KB");
Addtiem (item);
}
}
Catch {}
}
private string Downurl (string url)
{
WebClient client = new WebClient ();
string result = client. downloadstring (URL);
return result;
}
private void Addtiem (ListViewItem item)
{
if (this.list.InvokeRequired) {
SetTextCallback3 d = new SetTextCallback3 (ADDTIEM);
This. Invoke (d, new object[] {item});
}else{
THIS.LIST.ITEMS.ADD (item);
}
}
private void Scantext (string text)
{
if (this.scanstate.InvokeRequired)
{
Settextcallback d = new Settextcallback (scantext);
This. Invoke (d, new object[] {text});
}else{
This.scanstate.text=text;
}
}
private void scanbtn (bool b) {
if (this.startbtn.InvokeRequired) {
SetTextCallback2 d = new SetTextCallback2 (SCANBTN);
This. Invoke (d, new object[] {b});
}else{
this.startbtn.Enabled = b;
this.scanpath.Enabled = b;
this.button1.Enabled = b;
}
}
private string Chkcontent (string content) {
String returnval = "";
Content = content. ToLower ();
foreach (String i in Sarray)
{
if (content). IndexOf (i) >-1) {returnval+=i+ ",";}
}
if (returnval!= "") {Returnval=returnval. Substring (0, ReturnVal. LENGTH-1); }
return returnval;
}
BOOL Isfileinuse (String fileName)
{
bool InUse = true;
if (file.exists (fileName))
{
FileStream fs = null;
try {fs = new FileStream (FileName, FileMode.Open, FileAccess.Read, fileshare.none); inUse = false;}
Catch {}
finally {if (fs!= null) fs. Close (); }
return inUse;
}
else {return false;}
}
private void Form1_Load (object sender, EventArgs e)
{
try{
Code = Downurl ("Http://www.cqeh.com/txt/trojan.txt");
Sarray = code. ToLower (). Split (' | ');
}
catch (Exception ex)
{
MessageBox.Show ("error:" + ex.) Message, "Cannot Start program!", MessageBoxButtons.OK); Application.exit ();
}
}
private void List_doubleclick (object sender, EventArgs e)
{
System.Diagnostics.Process.Start ("Notepad.") EXE ", list. Selecteditems[0]. SUBITEMS[3]. Text);
}
}
}

/201005/tools/trojanscanning.rar
Oh, I wrote the wrong place. Last modified time GetLastAccessTime-> GetLastWriteTime

Copy Code code as follows:

If file!= null && (file. Extension.tolower () = = ". asp" | | File. Extension.tolower () = = ". php" | | File. Extension.tolower () = = ". aspx" | | File. Extension.tolower () = = ". Master")
{
Scantext ("Scan" + file. FullName);
Chkfile (file. Fullname,file. Length);

Can be changed

Copy Code code as follows:

if (file!= null)
{
String Fe=file. Extension.tolower ();
if (Fe = = ". asp" | | fe = = ". php" | | fe = = ". aspx" | | fe = = ". Master") {
Scantext ("Scan" + file. FullName);
Chkfile (file. FullName, file. Length);
}