一個小小的殺毒程式

一個小小的殺毒程式
今天機子中毒了,鬱悶,原來是一個木馬,所有htm/html/asp/aspx/shtml都被感染!沒辦法殺毒也查不出來,無奈就自己殺吧!寫了一個殺毒的程式!呵呵,還能用,不過也發現一寫問題以前老師說檔案的一行最大是1024個字元,以前我對此深信不疑,今天做這個才發現不見得都是,一寫網頁的代碼中就能超過1024有的是很多,幸虧我還有懷疑精神啊,呵呵,就改了,
下面是殺毒的原始碼:

//coded by winc_co

////////////////////////////
//
// coded by winc_fan 2007-4-27
//
//////////////////////////////////
#include <io.h>
#include <stdio.h>
#include <direct.h>
#include <ctype.h>
#include <iostream>
#include <fstream>
#include <string>
using namespace std;

// 感染的木馬
std::string virus = "<iframe src=http://pp.900666.com/abc.htm width=0 height=0></iframe>";
//方法聲明

void DirPath();
void inter();
void killer(std::string path);
bool chkFileEx(std::string filename);
void init();

void main()
{
 inter();
 init();
 
 cout << "............殺毒完成........." << endl;
}

//開始介面設計
void inter()
{
 cout << "======================================================" << endl;
 cout << "歡迎使用winc_co的殺毒軟體！" << endl;
 cout << "殺毒開始..........." << endl;
}

///瀏覽目錄
void DirPath(std::string path)
{
 if(chkFileEx(path))
 {
  cout << "找到目標檔案" << endl;
  cout << path << endl;
  killer(path);
 }
 
 //定義檔案的結構體
 int len=path.length();
 int idx=path.find_last_of('.');
 
 if(idx==len-1)
  return;
 
 struct _finddata_t c_file; //head file <io.h>
 long findFile;
 
 path=path+ "//";
 std::string filename=path;
 path+="*.*";
 
 findFile = _findfirst(path.c_str(), &c_file);
 
 while( _findnext( findFile, &c_file ) == 0 )
 {
  if(chkFileEx(c_file.name))
  {
   cout << "找到目標檔案" << endl;
   cout << filename+c_file.name << endl;
   killer(filename+c_file.name);  
   
   continue;
  }
  
  DirPath(filename+c_file.name);
 }
 
 _findclose( findFile );
}

//程式的開始。。。。。
void init()
{
 //獲得盤符的根目錄
 std::string dsk;
 
 for(int drive = 1; drive <= 26; drive++ )
 {
  //head file <direct.h>
  if( !_chdrive( drive ) )
   dsk=drive + 'A' - 1;
  dsk+=":";
 
  DirPath(dsk);
 }
}

//處理感染檔案
void killer(std::string path)
{
 fstream log;//記錄檔
 fstream temp; //臨時檔案
 fstream target;//目標檔案
 
 std::string tempfile= path.substr(0,path.find_last_of('//'))+"[url=file:////temp.txt]//temp.txt[/url]";
 
 temp.open(tempfile.c_str(),std::ios::out);
 target.open(path.c_str());
 
 char buf[511025];
 
 std::string contp; // 臨時檔案的存放的內容
 while(!target.eof())
 {
  target.getline(buf,511024);
  std::string cockhorse; //木馬
  cockhorse=buf;
               
  //處理病毒的關鍵步驟跳過木馬
  if(cockhorse.find(virus)!=-1L)
  {
   int i=cockhorse.find(virus);

   if(i!=0)
   {
    contp+=cockhorse.substr(0,i-1);
   }
   
   continue;
  }
  
  contp+=buf;
  contp+='/n'; //添加換行
 }
       
 //儲存內容
 temp.write(contp.c_str(),contp.length());
 temp.close();
 target.close();
 
 //刪除目標檔案，用臨時檔案代替
 remove(path.c_str());
 rename(tempfile.c_str(),path.c_str());
 
 //記錄日誌
 log.open("c://log.txt",std::ios::out|std::ios::in|std::ios::app);
 std::string logstr=path+'/n';
 path+='/n';
 
 log.write(path.c_str(),path.length());
 log.close();
}

//尾碼名判斷
bool chkFileEx(std::string filename)
{
 std::string exname;
 int ex=filename.find_last_of(".");
 
 if(ex==-1)
  return false;
 exname=filename.substr(ex);
 
 //尾碼名的檢驗
 if(exname==".html"||exname==".aspx"||exname==".htm"||exname==".asp"||exname==".shtml")
  return true;
 
 return false;
}
 

//=========================================================

日誌:

C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarkbackups/bookmarks-2004-10-15.html
C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarkbackups/bookmarks-2007-04-15.html
C:/Documents and Settings/_CSU/Application Data/Mozilla/Firefox/Profiles/l0zhbjov.default/bookmarks.html
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/GDMG02V1/pv[1].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/GDMG02V1/welcome[1].shtml
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/MUGLZBF5/s[1].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/MUGLZBF5/s[2].aspx
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/YU4SUCI0/upload[1].html
C:/Documents and Settings/_CSU/Local Settings/Temporary Internet Files/Content.IE5/YU4SUCI0/Url_Count[2].aspx
C:/Inetpub/iissamples/sdk/asp/applications/Application_JScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Application_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Session_JScript.asp
C:/Inetpub/iissamples/sdk/asp/applications/Session_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/AdRotator_JScript.asp
C:/Inetpub/iissamples/sdk/asp/components/AdRotator_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/BrowserCap_JScript.asp
C:/Inetpub/iissamples/sdk/asp/components/BrowserCap_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/components/redirect.asp
C:/Inetpub/iissamples/sdk/asp/database/AddDelete_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/AddDelete_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/LimitRows_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/LimitRows_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/MultiScrolling_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/MultiScrolling_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/SimpleQuery_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/SimpleQuery_VBScript.asp
C:/Inetpub/iissamples/sdk/asp/database/StoredProcedures_JScript.asp
C:/Inetpub/iissamples/sdk/asp/database/StoredProcedures_VBScript.asp

.........

太多了,就列這些吧

 //後發現有的檔案是大寫的所以在尾碼名判斷的那裡有點問題,換用CString 把它轉換成小寫就好!

CString cexname=exname;
 cexname.MakeLower();
 if( cexname==".html"||
  cexname==".aspx"||
  cexname==".htm"||
  cexname==".asp"||
  cexname==".shtml"
  )