ntiIframe.vbs用于批量清除被添加到文件中的惡意代碼
AntiIframe.vbs
#該腳本是批量掛馬程序的逆向,用于批量清除被添加到文件中的惡意代碼。記事本打開文件可以修改Pattern參數(shù)指定要處理的文件名,文件名之間用|隔開(也支持vbs正則表達(dá)式)。由于要修改文件,請謹(jǐn)慎的使用(最好先備份文件)
#用法: CScript AntiIframe.vbs [處理的路徑] [包含清除內(nèi)容的文件]
#例子: CScript AntiIframe.vbs d:\Web d:\lake2.txt
'-----------------------
'Anti-Iframe in vbs
'Author: lake2 (http://lake2.0x54.org)
'Date: 2007-2-27
'Version: 1.1
'-----------------------
'-------- Config Start --------------
'配置要處理的文件名,可使用vbs正則表達(dá)式;也可以使用“(index.asp|index.htm|index.html)”枚舉格式
Pattern = "^.+\.(htm|html|asp|aspx|php)$"
'-------- Config End --------------
Call ShowInfo()
If WScript.Arguments.Count = 2 Then
If Right(WScript.Arguments.Item(0),1) = "\" Then
if len(WScript.Arguments.Item(0))>3 then
thePath = Mid(WScript.Arguments.Item(0),1,Len(WScript.Arguments.Item(0))-1)
else
thePath = WScript.Arguments.Item(0)
end if
Else
thePath = WScript.Arguments.Item(0)
End If
Call CheckArg(thePath)
WScript.Echo "開始清理,請稍候……"
Call ShowAllFile(thePath)
WScript.Echo vbcrlf & "清理完成!" & vbcrlf
Else
Call ShowHelp()
End If
Sub ShowInfo()
HelpStr = HelpStr & "==============================" & vbcrlf
HelpStr = HelpStr & "===== 歡迎使用雷客圖 ASP 站長安全助手vbs版 =====" & vbcrlf
HelpStr = HelpStr & "===== 之 Anti-批量掛馬 =====" & vbcrlf
HelpStr = HelpStr & "===== Author: lake2 =====" & vbcrlf
HelpStr = HelpStr & "===== Email:lake2@mail.csdn.net =====" & vbcrlf
HelpStr = HelpStr & "===== 歡迎訪問 www.0x54.org 得到更多信息 =====" & vbcrlf
HelpStr = HelpStr & "==============================" & vbcrlf
HelpStr = HelpStr & vbcrlf
WScript.Echo HelpStr
End Sub
Sub ShowHelp()
HelpStr = HelpStr & "#用法: CScript AntiIframe.vbs [處理的路徑] [包含清除內(nèi)容的文件]" & vbcrlf
HelpStr = HelpStr & "#例子: CScript AntiIframe.vbs d:\Web d:\lake2.txt" & vbcrlf
HelpStr = HelpStr & vbcrlf
WScript.Echo HelpStr
End Sub
Sub CheckArg(arg)
tmpPath = arg
Set objFSO = WScript.CreateObject ("Scripting.FileSystemObject")
If Not objFSO.FileExists(WScript.Arguments.Item(1)) Then
WScript.Echo "Error:未找到配置文件“" & WScript.Arguments.Item(1) & "”!"
WScript.Quit
ElseIf Not objFSO.FolderExists(tmpPath) Then
WScript.Echo "Error:錯誤的路徑“" & tmpPath & "”!"
WScript.Quit
End If
Set objFSO = Nothing
End Sub
'遍歷處理path及其子目錄所有文件
Sub ShowAllFile(Path)
Set FSO = CreateObject("Scripting.FileSystemObject")
Set g = FSO.GetFile(WScript.Arguments.Item(1))
If g.Size > 0 Then
Set ts2 = g.OpenAsTextStream(1, -2)
filecon = ts2.ReadAll
ts2.Close
Set ts2 = Nothing
Else
WScript.Echo "Error:配置文件" & WScript.Arguments.Item(1) & "大小為0!"
WScript.Quit
End If
Set g = Nothing
Set f = FSO.GetFolder(Path)
Set fc2 = f.files
On Error Resume Next
For Each myfile in fc2
If Err Then WScript.Echo "權(quán)限不足,不能檢查目錄"&thePath:exit sub
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = Pattern
If regEx.Test(myfile.name) Then
CheckFile path&"\"&myfile.name, filecon
End If
Set regEx = Nothing
Next
Set fc = f.SubFolders
For Each f1 in fc
ShowAllFile path&"\"&f1.name
Next
Set FSO = Nothing
End Sub
Sub CheckFile(filepath, filecon2)
xSet = GetCharSet(filepath)
Set tStream = CreateObject("ADODB.Stream")
tStream.type = 1
tStream.mode = 3
tStream.open
tStream.Position=0
tStream.LoadFromFile FilePath
If err Then Exit Sub end if
tStream.type = 2
tStream.charset = xSet
Do Until tStream.EOS
filecon = filecon & LCase(tStream.ReadText(102400))
Loop
tStream.close()
Set tStream = Nothing
If InStr(filecon, filecon2) > 0 Then
filecon = Replace(filecon, filecon2, "")
Set tStream = CreateObject("ADODB.Stream")
tStream.type = 2
tStream.mode = 3
tStream.charset = xSet
tStream.open
tStream.Position=0
tStream.WriteText filecon
tStream.SaveToFile filepath, 2
tStream.close()
Set tStream = Nothing
WScript.Echo "已經(jīng)修復(fù)文件: "&filepath&" ..."
End If
End Sub
Function GetCharSet(xPath)
Set tStream = CreateObject("ADODB.Stream")
tStream.type = 1
tStream.mode = 3
tStream.open
tStream.Position = 0
tStream.LoadFromFile xPath
byte1 = ascB(tStream.Read(1))
byte2 = ascB(tStream.Read(1))
byte3 = ascB(tStream.Read(1))
tStream.close()
Set tStream = Nothing
If byte1=239 and byte2=187 and byte3=191 Then
GetCharSet = "UTF-8"
Else
GetCharSet = "GB2312"
End If
End Function
您可能感興趣的文章
- 01-10VBS教程:運(yùn)算符-運(yùn)算符概述
- 01-10VBS教程:運(yùn)算符-比較運(yùn)算符
- 01-10批量替換快捷方式目的路徑的VBS腳本
- 01-10利用vbscript腳本修改文件內(nèi)容,此適用于自動化的操作中
- 01-10用VBS實(shí)現(xiàn)的批量gb2312轉(zhuǎn)utf-8,支持拖動
- 01-10不錯的主要用于加密的vbs(asp)位移運(yùn)算類
- 01-10批量文件查找替換功能的vbs腳本
- 01-10兩個批量掛馬vbs腳本代碼
- 01-10vbs下用一個小方法實(shí)現(xiàn)批量添加域用戶
- 01-10用于提取網(wǎng)易文件的hta代碼


閱讀排行
本欄相關(guān)
- 01-10下載文件到本地運(yùn)行的vbs
- 01-10飄葉千夫指源代碼,又稱qq刷屏器
- 01-10SendKeys參考文檔
- 01-10什么是一個高效的軟件
- 01-10VBS中的正則表達(dá)式的用法大全 &l
- 01-10exe2swf 工具(Adodb.Stream版)
- 01-10VBS中SendKeys的基本應(yīng)用
- 01-10用VBSCRIPT控制ONSUBMIT事件
- 01-10VBScript教程 第十一課深入VBScript
- 01-10VBScript語法速查及實(shí)例說明
隨機(jī)閱讀
- 08-05織夢dedecms什么時候用欄目交叉功能?
- 01-10SublimeText編譯C開發(fā)環(huán)境設(shè)置
- 01-10delphi制作wav文件的方法
- 01-10使用C語言求解撲克牌的順子及n個骰子
- 08-05dedecms(織夢)副欄目數(shù)量限制代碼修改
- 01-11ajax實(shí)現(xiàn)頁面的局部加載
- 01-10C#中split用法實(shí)例總結(jié)
- 08-05DEDE織夢data目錄下的sessions文件夾有什
- 01-11Mac OSX 打開原生自帶讀寫NTFS功能(圖文
- 04-02jquery與jsp,用jquery