这段代码应该怎样改! ( 积分: 100 )

  • 主题发起人 主题发起人 godyhook
  • 开始时间 开始时间
G

godyhook

Unregistered / Unconfirmed
GUEST, unregistred user!
最近朋友的网站被木马感染了。目录下的所有脚本文件都插入了恶意代码!~` 因为没备份的,就叫我给他能够批量清除的工具。那恶意代码是个隐藏框架,每个文件内的恶意代码都是相同的!``

program Project;

{$APPTYPE CONSOLE}

uses
SysUtils,
Classes;

// shellapi;

procedure showInfo;
begin
writeln('by www.web67.cn');
writeln('**** <filepath> <code>');
end;

procedure Delcode(filename,code:string)


var
i:integer;
n:integer;
str: TstringList;
F : Textfile;
function readFromFile(filename,code:string):TstringList
//内嵌函数,从文件读取数据保存在字符串数组中
var
s:string;
F:TextFile;
strlist:TstringList;
begin
n:=0;
assignfile(F,filename);
strlist:=TstringList.Create;
try
Reset(F);
while not Eof(F) do
begin
Readln(F, s);
if pos(code,s)=0 then //如果未含IP则保存
strlist.Append(s)
else
n:=n+1;
end;
result:=strlist;
finally
closefile(f);
end;
end;

begin

str:=readFromFile(filename,code);

assignfile(f,fileName);

try
rewrite(f);
for i:=0 to str.Count-1 do
writeln(f,str);
finally
closefile(f);
writeln(filename,' 中删除了',n,'行目标');

end;


end;




// 遍历某个文件夹下某种文件,
// ?? GetFileList(ListBox1.Items,'c:/*.doc');
// GetFileList(MyTStringList,'c:/*.exe');
// ================================================================
procedure GetFileList(var AStrings: TStringlist
ASourFile: string);
var sour_path,sour_file: string;
// TmpList:TStringList;
FileRec:TSearchrec;
begin

sour_path:=ExtractFilePath(ASourFile);
sour_file:=ExtractFileName(ASourFile);
AStrings:=TStringList.Create;
if not DirectoryExists(sour_path) then
begin
AStrings.Clear;
showInfo;
exit;
end;


AStrings.Clear;

if FindFirst(sour_path+sour_file,faAnyfile,FileRec) = 0 then
repeat
if ((FileRec.Attr and faDirectory) = 0) then
begin
AStrings.Add(sour_path+FileRec.Name)
end;
until FindNext(FileRec)<>0;

SysUtils.FindClose(FileRec);



end;

////////////////////////////////////////////////////////////////
//主函数开始

var
path,IP : string;
filelist : Tstringlist;
i : integer;

begin
if paramcount<>2 then
begin
showInfo;
exit;
end;


path := paramStr(1);
IP := paramStr(2);
try
GetfileList(filelist,path);
except

end;

for i:=0 to filelist.Count-1 do
try
delcode(filelist,IP);
except
writeln(filelist,' 无法更改,可能权限不够或者文件正在使用中..')
end;



end.
这段代码只能删除单个文件的。不知道要怎样改才能批量删除目录及子目录下所有感染的代码。
 
不太明白你的代码,看看我这样行不

{ 获取子文件夹文件列表 }
procedure GetSubDirFiles(Path, Filter: string
Strings: TStrings;
IncludeSubs: Boolean);
var
DirList: TStringList;

procedure GetSubDirs;
var
SR: TSearchRec;
begin
if FindFirst(Path + '*.*', faDirectory, SR) = 0 then
try
repeat
if (SR.Attr and faDirectory) = faDirectory then
if (SR.Name <> '.') and (SR.Name <> '..') then
DirList.Add(SR.Name);
until FindNext(SR) <> 0;
finally
FindClose(SR);
end;
end;

var
I: Integer;
begin
DirList := TStringList.Create;
try
GetSubDirs;
for i := 0 to DirList.Count - 1 do
GetFileList(Path + DirList, Filter, Strings, IncludeSubs);
finally
DirList.Free;
end;
end;

{ 获取文件夹文件列表 }
procedure GetFileList(Path, Filter: string
Strings: TStrings;
IncludeSubs: Boolean);
var
SR: TSearchRec;
begin
Path := IncludeTrailingPathDelimiter(Path);
if FindFirst(Path + Filter, faAnyFile, SR) = 0 then
try
repeat
if not ((SR.Attr and faDirectory) = faDirectory) then
Strings.Add(Path + SR.Name);
until FindNext(SR) <> 0;
finally
FindClose(SR);
end;
if IncludeSubs then
GetSubDirFiles(Path, Filter, Strings, IncludeSubs);
end;

{ 删除某些行 }
procedure DeleteCode(FileName: TFileName
Code: string);
var
I: Integer;
begin
with TStringList.Create do
try
LoadFromFile(FileName);
for I := Count - 1 downto 0 do
if Pos(Code, Strings) = 0 then
Delete(I);
SaveToFile(FileName)
//这里最好保存为新的文件,以防错删
finally
Free;
end;
end;

{ 清除所有文件中的某些行 }
procedure ClearCodes(Path, Filter, Code: string);
var
I: Integer;
Strs: TStrings;
begin
Strs := TStringList.Create;
try
UFileList.GetFileList(Path, Filter, Strs);
for I := 0 to Strs.Count - 1 do
DeleteCode(Strs, Code);
finally
Strs.Free;
end;
end;

{ 测试,删除C盘下所有js文件中,'Test'的行首的行 }
ClearCodes('C:', '*.js', 'Test');
 
接受答案了.
 
后退
顶部