荔园在线
荔园之美,在春之萌芽,在夏之绽放,在秋之收获,在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: popstar (孤狼), 信区: Virus
标 题: [转载]查杀新欢乐时光(VBS.KJ,folder.htt)的程序
发信站: 荔园晨风BBS站 (Wed Jun 26 22:27:42 2002), 转信
发信人: RoachCock (chen3feng), 信区: Virus
标 题: 查杀新欢乐时光(VBS.KJ,folder.htt)的程序
发信站: BBS 水木清华站 (Wed Jun 12 14:12:16 2002)
我也用VBS编写,:)
//yxm的ftp也不开了,要不然就放到那儿了
Option Explicit
'全局变量
Dim FSO, WsShell, WinPath, SubE, FinalyDisk, FileScaned, FileRepaired,
OnlyF
ixHttFile
Main()
Sub Main()
If MsgBox("本程序专用于查杀VBS.KJ蠕虫(Folder.htt),由于没有进行严格的
测试
,不能保证可以修复所有的受感染文件,也不保证不损害染毒文件本身,因此,请先
将具有
下列扩展名的重要文件备份,然后才可以继续进行,继续吗?", vbYesNo Or
vbExclam
ation) = vbYes Then
If (MsgBox("清除html,vbs,asp,jsp等文件可能会造成数据损坏,继续吗
?",
vbYesNo Or vbInformation) = vbNo) Then
FixOnlyHttFile = True
End If
Initialize
RemoveMilieu
ScanAllDisk
MsgBox "共扫描文件" & FileScaned & "个" & vbCrLf & "修复文件"
& File
Repaired & "个"
Else
MsgBox "好的,请先备份文件或者改日再查,谢谢!", vbInformation
End If
End Sub
Function RemoveFrom(FilePath, TypeStr)
Dim ReadTemp, TmpStr, FileTemp
On Error Resume Next
Set ReadTemp = FSO.OpenTextFile(FilePath, 1)
'只读方式打开
TmpStr = ReadTemp.ReadAll
'读入文件
FileRepaired = FileRepaired + 1
If InStr(TmpStr, "KJ_start()") = 0 Or Len(TmpStr) < 1 Then '如果
未感
染或者是空文件
ReadTemp.Close
'退出
Exit Function
End If
If TypeStr = "htt" Then
ReadTemp.Close
Set FileTemp = FSO.OpenTextFile(FilePath, 2)
TmpStr = Right(TmpStr, Len(TmpStr) - InStr(TmpStr, "<html>")
+ 1
)
TmpStr = Left(TmpStr, InStr(TmpStr, "</html>") + 6)
FileTemp.Write TmpStr
FileTemp.Close
Else
ReadTemp.Close
Set FileTemp = FSO.OpenTextFile(FilePath, 2)
If TypeStr = "html" Then
TmpStr = Left(TmpStr, InStrRev(TmpStr, "<html>"))
FileTemp.Write TmpStr
ElseIf TypeStr = "vbs" Then
TmpStr = Left(TmpStr, "KJ_Start")
FileTemp.Write TmpStr
End If
FileTemp.Close
Else
FileRepaired = FileRepaired - 1
End If
End Function
Function RemoveMilieu()
On Error Resume Next
Dim TempPath, StartUpFile
TempPath = ""
If Not (FSO.FileExists(WinPath & "WScript.exe")) Then
TempPath = "system32\"
End If
If TempPath = "system32\" Then
StartUpFile = WinPath & "SYSTEM\Kernel32.dll"
Else
StartUpFile = WinPath & "SYSTEM\Kernel.dll"
End If
FSO.DeleteFile StartUpFile
FSO.DeleteFile WinPath & "web\kjwall.gif"
FSO.DeleteFile WinPath & "system32\kjwall.gif"
Call RemoveFrom(WinPath & "web\Folder.htt", "htt")
WsShell.RegDelete
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current
Version\Run\Kernel32"
WsShell.RegDelete "HKEY_CLASSES_ROOT\.dll\Content Type",
"application/x-
msdownload"
WsShell.RegDelete "HKEY_CLASSES_ROOT\dllfile\ScriptEngine\"
WsShell.RegDelete "HKEY_CLASSES_ROOT\dllFile\Shell\Open\command"
WsShell.RegDelete "HKEY_CLASSES_ROOT\dllFile\Shell\Open\"
WsShell.RegDelete
"HKEY_CLASSES_ROOT\dllFile\ShellEx\PropertySheetHandle
rs\WSHProps\"
WsShell.RegDelete "HKEY_CLASSES_ROOT\dllFile\ScriptHostEncode\"
End Function
Function ScanAllDisk()
Dim Drive
For Each Drive In FSO.Drives
If Drive.DriveType = 1 Or Drive.DriveType = 2 Then
ScanFolder (Drive.DriveLetter & ":\")
End If
Next
End Function
Function ScanFolder(PathName)
On Error Resume Next
Dim ThisFolder, ThisFiles, ThisFile, FileExt
Set ThisFolder = FSO.GetFolder(PathName)
Set ThisFiles = ThisFolder.Files
For Each ThisFile In ThisFiles
If Not IsEmpty(ThisFile) Then
FileScaned = FileScaned + 1
FileExt = UCase(FSO.GetExtensionName(ThisFile.Path))
If FileExt = "HTM" Or FileExt = "HTML" Or FileExt = "ASP" Or
Fil
eExt = "PHP" Or FileExt = "JSP" Then
Call RemoveFrom(ThisFile.Path, "html")
ElseIf FileExt = "VBS" Then
Call RemoveFrom(ThisFile.Path, "vbs")
ElseIf FileExt = "HTT" Then
Call RemoveFrom(ThisFile.Path, "htt")
End If
End If
Next
Dim SubFolder, SubFolders
Set SubFolders = ThisFolder.SubFolders
For Each SubFolder In SubFolders
If Not IsEmpty(SubFolder) Then
ScanFolder (SubFolder)
End If
Next
End Function
Function Initialize()
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WsShell = CreateObject("WScript.Shell")
WinPath = FSO.GetSpecialFolder(0) & "\"
End Function
--
无知者无畏!
namespace cfc
{
class dummy{};
};
※ 来源:·BBS 水木清华站 smth.edu.cn·[FROM: 202.119.206.132]
--
※ 来源:·荔园晨风BBS站 bbs.szu.edu.cn·[FROM: 192.168.36.57]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接:深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店