淘特ASP木马扫描器的代码
程序员文章站
2023-11-17 20:55:04
＋-----------------＋ ｜淘特asp木马扫描器｜ ＋-----------------＋ 本程序可以扫描服务器上的所有指定类型(asp,cer,asa,...
＋-----------------＋
｜淘特asp木马扫描器｜
＋-----------------＋
本程序可以扫描服务器上的所有指定类型(asp,cer,asa,cdx)的文件，查出可疑的木马程序。系统采用扫描程序与病毒库分离的形式，
以后升级只需像杀毒软件那样升级病毒库就可以了。目前可以查杀所有流行的asp木马程序。
系统提供了全站扫描、按文件夹和指定文件扫描三种扫描方式，如果网站文件比较少的话，推荐使用"全站扫描",如果文件比较多，推荐
使用按文件夹扫描。扫描过程，系统会记录被扫描过的文件列表，同时对怀疑是木马程序的文件以列表的形式展现，为了便于比较最近有可能
被上传过asp木马程序，系统特别对当前时间7日内修改、创建的文件以加红显示；系统会对怀疑是木马的文件作出"级别"判断，并加以颜色区分
；建议对级别为"一般"的程序作手动检查后，再作处理，对级别为"严重"的文件，可以点击"文件名称"下的文件链接，一般打开后木马程序都会
有一个登录提示，这时就点击"文件名称"下的"删除"链接，直接将文件从服务器中删除即可。如果担心会误删除，可以先点击"下载"将文件备份。
使用方法：
将本程序解压后的文件上传至服务器中。执行:http://你的网址/scan.asp
＋-----------------＋
｜登录密码：totscan｜
＋-----------------＋
virus_lib.asp
<%
dim virus(1,7),virus_regx(1,4)
'定义木马组件
virus(0,0)="wscript"
virus(1,0)="级别：<font color=""green"">严重!</font><br>wscript 多为木马关键字"
virus(0,1)="shell"
virus(1,1)="级别：<font color=""green"">严重!</font><br>shell 多为木马关键字"
virus(0,2)="shell.application"
virus(1,2)="级别：<font color=""green"">严重!</font><br>asp 组件,一般多为木马所用"
'海阳组件
virus(0,3)="clsid:72c24dd5-d70a-438b-8a42-98424b88afb8"
virus(1,3)="级别：<font color=""green"">严重!</font><br>asp wscript 组件,一般多为木马所用"
virus(0,4)="clsid:f935dc22-1cf0-11d0-adb9-00c04fd58a0b"
virus(1,4)="级别：<font color=""green"">严重!</font><br>asp wscript 组件,一般多为木马所用"
virus(0,5)="clsid:093ff999-1ea0-4079-9525-9614c3504b74"
virus(1,5)="级别：<font color=""green"">严重!</font><br>asp net 组件,一般多为木马所用"
virus(0,6)="clsid:f935dc26-1cf0-11d0-adb9-00c04fd58a0b"
virus(1,6)="级别：<font color=""green"">严重!</font><br>asp net 组件,一般多为木马所用"
virus(0,7)="clsid:0d43fe01-f093-11cf-8940-00a0c9054228"
virus(1,7)="级别：<font color=""green"">严重!</font><br>asp fso 组件,一般多为木马所用"
'定义木马关键字
virus_regx(0,0)="@\s*language\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
virus_regx(1,0)="级别：<font color=""green"">严重!</font><br>脚本被加密了，一般asp文件是不会加密的。"
virus_regx(0,1)="\beval\b"
virus_regx(1,1)="级别：<font color=""gray"">一般!</font><br>eval()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ev"&"al(x)<br>但是javascript代码中也可以使用，有可能是误报。"
virus_regx(0,2)="[^.]\bexecute\b"
virus_regx(1,2)="级别：<font color=""gray"">一般!</font><br>execute()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ex"&"ecute(x)。"
virus_regx(0,3)="server.(execute|transfer)([ \t]*|\()[^""]\)"
virus_regx(1,3)="级别：<font color=""gray"">一般!</font><br>不能跟踪检查server.e"&"xecute()函数执行的文件。请管理员自行检查。"
virus_regx(0,4)="createobject[ |\t]*\(.*\)$[^adodb.recordset]"
virus_regx(1,4)="级别：<font color=""gray"">一般!</font><br>crea"&"teobject函数使用了变形技术，仔细复查"
%>
scan.asp
<%@language="vbscript" codepage="936"%>
<!--#include file="virus_lib.asp"-->
<%
server.scripttimeout =90000
dim act
act=request.querystring("act")
const password = "totscan"
if act="login" then
if request.form("pwd") = password then session("login")="ok"
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>asp木马扫描器</title>
<script language="javascript" type="text/javascript">
function confirmdel()
{
if(confirm("确认删除？并且不能恢复！"))
return true;
else
return false;
}
</script>
</head>
<body>
<div align="center"><h2>asp木马扫描器</h2></div>
<hr>
<%
if session("login") <> "ok" then
call loginform()
else
dim pathstr
if request("path")<>"" then
pathstr=request("path")
else
pathstr=server.mappath("/")
end if
response.write("<a href=""javascript:history.back();"">←返回</a><br>"&chr(10))
if act="scan" then
dim scanfiletype,suspect,scanfilenum,scanfoldernum,begintime,endtime,tmppath,report
scanfiletype = "asp,cer,asa,cdx"
suspect = 0
scanfilenum = 0
scanfoldernum =0
begintime = timer
response.write("<textarea name=""textarea"" style=""width:100%"" rows=""5"">"&chr(10))
response.write("扫描日志："&vbcrlf)
if(request.querystring("file")<>"") then
call scanfile(request.querystring("file"),"")
else
call scanfolder(pathstr)
end if
response.write("</textarea>")
call showresult()
endtime = timer
response.write "<br><font size=""2"">执行时间："&cstr(int(((endtime-begintime)*10000 )+0.5)/10)&"毫秒</font>"
elseif act="del" then
call delfile(request.querystring("file"))
response.write("<br><a href="""&request.servervariables("http_referer")&""">返回</a>")
elseif act="down" then
call download(request.querystring("file"))
else
call filelist(pathstr)
call scanform()
end if
end if
%>
<hr>
</body>
</html>
<%
sub loginform
%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pwd" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
end sub
sub scanform
%>
<form action="?act=scan" method="post">
<input type="submit" value=" 全站扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
end sub
'遍历处理path及其子目录所有文件
sub filelist(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)'目录下所有对象
set files = folders.files
set subfolders = folders.subfolders
'列表文件夹
for each fl in subfolders
response.write("<a href=""?path="&path&"\"&fl.name&"""><img src=""images/folder.gif"" border=""0"">"&fl.name&"</a>"&chr(10))
response.write("<a href=""?act=scan&path="&path&"\"&fl.name&""">扫描</a><br>"&chr(10))
next
'列表文件
for each file_f in files
response.write("<img src=""images/file.gif"">"&file_f.name&""&chr(10))
response.write("<a href=""?act=scan&file="&path&"\"&file_f.name&""">扫描</a><br>"&chr(10))
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
sub showresult
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
扫描完毕！一共检查文件夹<font color="#ff0000"><%=scanfoldernum%></font>个，文件<font color="#ff0000"><%=scanfilenum%></font>个，发现可疑点<font color="#ff0000"><%=suspect%></font>个
</td></tr></table>
<table width="100%" border="0" cellpadding="0" cellspacing="1" style="padding:5px; background-color:#666666;line-height:18px;clear:both;font-size:12px">
<tr>
<td width="30%" bgcolor="#ffffff">文件名称</td>
<td width="20%" bgcolor="#ffffff">特征码</td>
<td width="30%" bgcolor="#ffffff">描述</td>
<td width="20%" bgcolor="#ffffff">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/>
</p>
</table>
<%
end sub
'遍历处理path及其子目录所有文件
sub scanfolder(path)
dim folders,files,subfolders
scanfoldernum = scanfoldernum + 1
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)
set files = folders.files
for each myfile in files
if checkext(fso.getextensionname(path&"\"&myfile.name)) then
call scanfile(path&"\"&myfile.name, "")
end if
next
set subfolders = folders.subfolders
for each f1 in subfolders
scanfolder path&"\"&f1.name
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
dim fsos,ofile,filetxt,fileuri,vi
scanfilenum = scanfilenum + 1
response.write("扫描文件:"&filepath&vbcrlf)
response.flush()
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
fileuri = "<a href=""http://"&request.servervariables("server_name")&":"&request.servervariables("server_port")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a><br>"
fileuri=fileuri&"操作： <a href=""?act=del&file="&filepath&""" onclick=""return confirmdel()"">删除</a>"
fileuri=fileuri&" <a href=""?act=down&file="&filepath&""">下载</a>"
for vi=0 to ubound(virus,2)
if instr(filetxt, lcase(virus(0,vi))) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus(0,vi)&"</td><td>"&virus(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
for vi=0 to ubound(virus_regx,2)
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = virus_regx(0,vi)
if regex.test(filetxt) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus_regx(0,vi)&"</td><td>"&virus_regx(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
'check include file
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check include virtual
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if scanfiletype = "*" then checkext = true
ext = split(scanfiletype,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
'删除文件
sub delfile(filepath)
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
fso.deletefile(filepath)
response.write("<h2>成功删除文件:</h2>" &filepath)
else
response.write("<h2>删除失败!文件:"&filepath&"没有找到!</2>")
end if
set fso=nothing
end sub
'下载文件
sub download(filepath)
dim ostream
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
set ostream=server.createobject("adodb.stream")
ostream.type=1
ostream.open
on error resume next
ostream.loadfromfile(filepath)
if err.number=0 then
response.addheader "content-disposition", "attachment; filename=" & fso.getfilename(filepath)
response.addheader "content-length", ostream.size
response.contenttype="bad/type" 'yeu cau ie hien hop thoai save-as
response.binarywrite ostream.read
end if
ostream.close
set ostream=nothing
end if
set fso=nothing
end sub
function getdatemodify(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatemodify = s
end function
function getdatecreate(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatecreate = s
end function
%>
｜淘特asp木马扫描器｜
＋-----------------＋
本程序可以扫描服务器上的所有指定类型(asp,cer,asa,cdx)的文件，查出可疑的木马程序。系统采用扫描程序与病毒库分离的形式，
以后升级只需像杀毒软件那样升级病毒库就可以了。目前可以查杀所有流行的asp木马程序。
系统提供了全站扫描、按文件夹和指定文件扫描三种扫描方式，如果网站文件比较少的话，推荐使用"全站扫描",如果文件比较多，推荐
使用按文件夹扫描。扫描过程，系统会记录被扫描过的文件列表，同时对怀疑是木马程序的文件以列表的形式展现，为了便于比较最近有可能
被上传过asp木马程序，系统特别对当前时间7日内修改、创建的文件以加红显示；系统会对怀疑是木马的文件作出"级别"判断，并加以颜色区分
；建议对级别为"一般"的程序作手动检查后，再作处理，对级别为"严重"的文件，可以点击"文件名称"下的文件链接，一般打开后木马程序都会
有一个登录提示，这时就点击"文件名称"下的"删除"链接，直接将文件从服务器中删除即可。如果担心会误删除，可以先点击"下载"将文件备份。
使用方法：
将本程序解压后的文件上传至服务器中。执行:http://你的网址/scan.asp
＋-----------------＋
｜登录密码：totscan｜
＋-----------------＋
virus_lib.asp
复制代码 代码如下:
<%
dim virus(1,7),virus_regx(1,4)
'定义木马组件
virus(0,0)="wscript"
virus(1,0)="级别：<font color=""green"">严重!</font><br>wscript 多为木马关键字"
virus(0,1)="shell"
virus(1,1)="级别：<font color=""green"">严重!</font><br>shell 多为木马关键字"
virus(0,2)="shell.application"
virus(1,2)="级别：<font color=""green"">严重!</font><br>asp 组件,一般多为木马所用"
'海阳组件
virus(0,3)="clsid:72c24dd5-d70a-438b-8a42-98424b88afb8"
virus(1,3)="级别：<font color=""green"">严重!</font><br>asp wscript 组件,一般多为木马所用"
virus(0,4)="clsid:f935dc22-1cf0-11d0-adb9-00c04fd58a0b"
virus(1,4)="级别：<font color=""green"">严重!</font><br>asp wscript 组件,一般多为木马所用"
virus(0,5)="clsid:093ff999-1ea0-4079-9525-9614c3504b74"
virus(1,5)="级别：<font color=""green"">严重!</font><br>asp net 组件,一般多为木马所用"
virus(0,6)="clsid:f935dc26-1cf0-11d0-adb9-00c04fd58a0b"
virus(1,6)="级别：<font color=""green"">严重!</font><br>asp net 组件,一般多为木马所用"
virus(0,7)="clsid:0d43fe01-f093-11cf-8940-00a0c9054228"
virus(1,7)="级别：<font color=""green"">严重!</font><br>asp fso 组件,一般多为木马所用"
'定义木马关键字
virus_regx(0,0)="@\s*language\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
virus_regx(1,0)="级别：<font color=""green"">严重!</font><br>脚本被加密了，一般asp文件是不会加密的。"
virus_regx(0,1)="\beval\b"
virus_regx(1,1)="级别：<font color=""gray"">一般!</font><br>eval()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ev"&"al(x)<br>但是javascript代码中也可以使用，有可能是误报。"
virus_regx(0,2)="[^.]\bexecute\b"
virus_regx(1,2)="级别：<font color=""gray"">一般!</font><br>execute()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ex"&"ecute(x)。"
virus_regx(0,3)="server.(execute|transfer)([ \t]*|\()[^""]\)"
virus_regx(1,3)="级别：<font color=""gray"">一般!</font><br>不能跟踪检查server.e"&"xecute()函数执行的文件。请管理员自行检查。"
virus_regx(0,4)="createobject[ |\t]*\(.*\)$[^adodb.recordset]"
virus_regx(1,4)="级别：<font color=""gray"">一般!</font><br>crea"&"teobject函数使用了变形技术，仔细复查"
%>
scan.asp
复制代码 代码如下:
<%@language="vbscript" codepage="936"%>
<!--#include file="virus_lib.asp"-->
<%
server.scripttimeout =90000
dim act
act=request.querystring("act")
const password = "totscan"
if act="login" then
if request.form("pwd") = password then session("login")="ok"
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>asp木马扫描器</title>
<script language="javascript" type="text/javascript">
function confirmdel()
{
if(confirm("确认删除？并且不能恢复！"))
return true;
else
return false;
}
</script>
</head>
<body>
<div align="center"><h2>asp木马扫描器</h2></div>
<hr>
<%
if session("login") <> "ok" then
call loginform()
else
dim pathstr
if request("path")<>"" then
pathstr=request("path")
else
pathstr=server.mappath("/")
end if
response.write("<a href=""javascript:history.back();"">←返回</a><br>"&chr(10))
if act="scan" then
dim scanfiletype,suspect,scanfilenum,scanfoldernum,begintime,endtime,tmppath,report
scanfiletype = "asp,cer,asa,cdx"
suspect = 0
scanfilenum = 0
scanfoldernum =0
begintime = timer
response.write("<textarea name=""textarea"" style=""width:100%"" rows=""5"">"&chr(10))
response.write("扫描日志："&vbcrlf)
if(request.querystring("file")<>"") then
call scanfile(request.querystring("file"),"")
else
call scanfolder(pathstr)
end if
response.write("</textarea>")
call showresult()
endtime = timer
response.write "<br><font size=""2"">执行时间："&cstr(int(((endtime-begintime)*10000 )+0.5)/10)&"毫秒</font>"
elseif act="del" then
call delfile(request.querystring("file"))
response.write("<br><a href="""&request.servervariables("http_referer")&""">返回</a>")
elseif act="down" then
call download(request.querystring("file"))
else
call filelist(pathstr)
call scanform()
end if
end if
%>
<hr>
</body>
</html>
<%
sub loginform
%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pwd" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
end sub
sub scanform
%>
<form action="?act=scan" method="post">
<input type="submit" value=" 全站扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
end sub
'遍历处理path及其子目录所有文件
sub filelist(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)'目录下所有对象
set files = folders.files
set subfolders = folders.subfolders
'列表文件夹
for each fl in subfolders
response.write("<a href=""?path="&path&"\"&fl.name&"""><img src=""images/folder.gif"" border=""0"">"&fl.name&"</a>"&chr(10))
response.write("<a href=""?act=scan&path="&path&"\"&fl.name&""">扫描</a><br>"&chr(10))
next
'列表文件
for each file_f in files
response.write("<img src=""images/file.gif"">"&file_f.name&""&chr(10))
response.write("<a href=""?act=scan&file="&path&"\"&file_f.name&""">扫描</a><br>"&chr(10))
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
sub showresult
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
扫描完毕！一共检查文件夹<font color="#ff0000"><%=scanfoldernum%></font>个，文件<font color="#ff0000"><%=scanfilenum%></font>个，发现可疑点<font color="#ff0000"><%=suspect%></font>个
</td></tr></table>
<table width="100%" border="0" cellpadding="0" cellspacing="1" style="padding:5px; background-color:#666666;line-height:18px;clear:both;font-size:12px">
<tr>
<td width="30%" bgcolor="#ffffff">文件名称</td>
<td width="20%" bgcolor="#ffffff">特征码</td>
<td width="30%" bgcolor="#ffffff">描述</td>
<td width="20%" bgcolor="#ffffff">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/>
</p>
</table>
<%
end sub
'遍历处理path及其子目录所有文件
sub scanfolder(path)
dim folders,files,subfolders
scanfoldernum = scanfoldernum + 1
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)
set files = folders.files
for each myfile in files
if checkext(fso.getextensionname(path&"\"&myfile.name)) then
call scanfile(path&"\"&myfile.name, "")
end if
next
set subfolders = folders.subfolders
for each f1 in subfolders
scanfolder path&"\"&f1.name
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
dim fsos,ofile,filetxt,fileuri,vi
scanfilenum = scanfilenum + 1
response.write("扫描文件:"&filepath&vbcrlf)
response.flush()
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
fileuri = "<a href=""http://"&request.servervariables("server_name")&":"&request.servervariables("server_port")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a><br>"
fileuri=fileuri&"操作： <a href=""?act=del&file="&filepath&""" onclick=""return confirmdel()"">删除</a>"
fileuri=fileuri&" <a href=""?act=down&file="&filepath&""">下载</a>"
for vi=0 to ubound(virus,2)
if instr(filetxt, lcase(virus(0,vi))) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus(0,vi)&"</td><td>"&virus(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
for vi=0 to ubound(virus_regx,2)
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = virus_regx(0,vi)
if regex.test(filetxt) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus_regx(0,vi)&"</td><td>"&virus_regx(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
'check include file
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check include virtual
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if scanfiletype = "*" then checkext = true
ext = split(scanfiletype,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
'删除文件
sub delfile(filepath)
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
fso.deletefile(filepath)
response.write("<h2>成功删除文件:</h2>" &filepath)
else
response.write("<h2>删除失败!文件:"&filepath&"没有找到!</2>")
end if
set fso=nothing
end sub
'下载文件
sub download(filepath)
dim ostream
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
set ostream=server.createobject("adodb.stream")
ostream.type=1
ostream.open
on error resume next
ostream.loadfromfile(filepath)
if err.number=0 then
response.addheader "content-disposition", "attachment; filename=" & fso.getfilename(filepath)
response.addheader "content-length", ostream.size
response.contenttype="bad/type" 'yeu cau ie hien hop thoai save-as
response.binarywrite ostream.read
end if
ostream.close
set ostream=nothing
end if
set fso=nothing
end sub
function getdatemodify(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatemodify = s
end function
function getdatecreate(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatecreate = s
end function
%>