G
godyhook
Unregistered / Unconfirmed
GUEST, unregistred user!
最近朋友的网站被木马感染了。目录下的所有脚本文件都插入了恶意代码!~` 因为没备份的,就叫我给他能够批量清除的工具。那恶意代码是个隐藏框架,每个文件内的恶意代码都是相同的!``
program Project;
{$APPTYPE CONSOLE}
uses
SysUtils,
Classes;
// shellapi;
procedure showInfo;
begin
writeln('by www.web67.cn');
writeln('**** <filepath> <code>');
end;
procedure Delcode(filename,code:string)
var
i:integer;
n:integer;
str: TstringList;
F : Textfile;
function readFromFile(filename,code:string):TstringList
//内嵌函数,从文件读取数据保存在字符串数组中
var
s:string;
F:TextFile;
strlist:TstringList;
begin
n:=0;
assignfile(F,filename);
strlist:=TstringList.Create;
try
Reset(F);
while not Eof(F) do
begin
Readln(F, s);
if pos(code,s)=0 then //如果未含IP则保存
strlist.Append(s)
else
n:=n+1;
end;
result:=strlist;
finally
closefile(f);
end;
end;
begin
str:=readFromFile(filename,code);
assignfile(f,fileName);
try
rewrite(f);
for i:=0 to str.Count-1 do
writeln(f,str);
finally
closefile(f);
writeln(filename,' 中删除了',n,'行目标');
end;
end;
// 遍历某个文件夹下某种文件,
// ?? GetFileList(ListBox1.Items,'c:/*.doc');
// GetFileList(MyTStringList,'c:/*.exe');
// ================================================================
procedure GetFileList(var AStrings: TStringlist
ASourFile: string);
var sour_path,sour_file: string;
// TmpList:TStringList;
FileRec:TSearchrec;
begin
sour_path:=ExtractFilePath(ASourFile);
sour_file:=ExtractFileName(ASourFile);
AStrings:=TStringList.Create;
if not DirectoryExists(sour_path) then
begin
AStrings.Clear;
showInfo;
exit;
end;
AStrings.Clear;
if FindFirst(sour_path+sour_file,faAnyfile,FileRec) = 0 then
repeat
if ((FileRec.Attr and faDirectory) = 0) then
begin
AStrings.Add(sour_path+FileRec.Name)
end;
until FindNext(FileRec)<>0;
SysUtils.FindClose(FileRec);
end;
////////////////////////////////////////////////////////////////
//主函数开始
var
path,IP : string;
filelist : Tstringlist;
i : integer;
begin
if paramcount<>2 then
begin
showInfo;
exit;
end;
path := paramStr(1);
IP := paramStr(2);
try
GetfileList(filelist,path);
except
end;
for i:=0 to filelist.Count-1 do
try
delcode(filelist,IP);
except
writeln(filelist,' 无法更改,可能权限不够或者文件正在使用中..')
end;
end.
这段代码只能删除单个文件的。不知道要怎样改才能批量删除目录及子目录下所有感染的代码。
program Project;
{$APPTYPE CONSOLE}
uses
SysUtils,
Classes;
// shellapi;
procedure showInfo;
begin
writeln('by www.web67.cn');
writeln('**** <filepath> <code>');
end;
procedure Delcode(filename,code:string)
var
i:integer;
n:integer;
str: TstringList;
F : Textfile;
function readFromFile(filename,code:string):TstringList
//内嵌函数,从文件读取数据保存在字符串数组中
var
s:string;
F:TextFile;
strlist:TstringList;
begin
n:=0;
assignfile(F,filename);
strlist:=TstringList.Create;
try
Reset(F);
while not Eof(F) do
begin
Readln(F, s);
if pos(code,s)=0 then //如果未含IP则保存
strlist.Append(s)
else
n:=n+1;
end;
result:=strlist;
finally
closefile(f);
end;
end;
begin
str:=readFromFile(filename,code);
assignfile(f,fileName);
try
rewrite(f);
for i:=0 to str.Count-1 do
writeln(f,str);
finally
closefile(f);
writeln(filename,' 中删除了',n,'行目标');
end;
end;
// 遍历某个文件夹下某种文件,
// ?? GetFileList(ListBox1.Items,'c:/*.doc');
// GetFileList(MyTStringList,'c:/*.exe');
// ================================================================
procedure GetFileList(var AStrings: TStringlist
ASourFile: string);
var sour_path,sour_file: string;
// TmpList:TStringList;
FileRec:TSearchrec;
begin
sour_path:=ExtractFilePath(ASourFile);
sour_file:=ExtractFileName(ASourFile);
AStrings:=TStringList.Create;
if not DirectoryExists(sour_path) then
begin
AStrings.Clear;
showInfo;
exit;
end;
AStrings.Clear;
if FindFirst(sour_path+sour_file,faAnyfile,FileRec) = 0 then
repeat
if ((FileRec.Attr and faDirectory) = 0) then
begin
AStrings.Add(sour_path+FileRec.Name)
end;
until FindNext(FileRec)<>0;
SysUtils.FindClose(FileRec);
end;
////////////////////////////////////////////////////////////////
//主函数开始
var
path,IP : string;
filelist : Tstringlist;
i : integer;
begin
if paramcount<>2 then
begin
showInfo;
exit;
end;
path := paramStr(1);
IP := paramStr(2);
try
GetfileList(filelist,path);
except
end;
for i:=0 to filelist.Count-1 do
try
delcode(filelist,IP);
except
writeln(filelist,' 无法更改,可能权限不够或者文件正在使用中..')
end;
end.
这段代码只能删除单个文件的。不知道要怎样改才能批量删除目录及子目录下所有感染的代码。