#include <WINDOWS.H>
#include <STDIO.H>
#include <STRING.h>
//////////////////////////////////////////
//要删除的目录
#define FILE_PATH "C:\\Temp"
//要删除的文件类型
#define TYPE ".txt"
//////////////////////////////////////////
#define FILE_NAME_TYPE "*.*"
#define FLAG_VIEW_FILE 0
#define FLAG_DELETE 1
//函数返回值：
#define RTN_OK (0)
#define RTN_ERR (1)
//全局的文件计数与文件清理计数
long g_lCheckFileNumber = 0;
long g_lClearFileNumber = 0;
int g_flagDeleteFile = 0;
LPSYSTEMTIME pTime = NULL;
/* Modify by zengwenwu @ 2012-3-19 :增加一标志，提供不同打印要求 */
//1:打印长时间
//0：短时间
//-1:不打印，相当于只对pTime做赋值
void PrintLocalTime(void* flag)
{
if ( NULL == pTime )
{
pTime = (LPSYSTEMTIME)malloc( sizeof(SYSTEMTIME) );
if ( NULL == pTime )
{
printf( "SYSTEMTIME malloc is err\n" );
}
else
{
GetLocalTime( pTime );
}
}
if (1 == *((int*)flag))
{
printf("=========================%04d-%02d-%02d %02d:%02d:%02d.%04d=========================\n",
pTime->wYear,
pTime->wMonth,
pTime->wDay,
pTime->wHour,
pTime->wMinute,
pTime->wSecond,
pTime->wMilliseconds);
}
else if(0 == *((int*)flag))
{
printf("\r<%02d:%02d:%02d>",
// pTime->wYear,
// pTime->wMonth,
// pTime->wDay,
pTime->wHour,
pTime->wMinute,
pTime->wSecond
// pTime->wMilliseconds
);
}
else if (-1 == *((int*)flag))
{
}
else
{
sprintf((char*)flag,"%04d-%02d-%02d %02d:%02d:%02d",
pTime->wYear,
pTime->wMonth,
pTime->wDay,
pTime->wHour,
pTime->wMinute,
pTime->wSecond
// pTime->wMilliseconds
);
}
}
void FreePTime(PSYSTEMTIME pTime)
{
/* 一定要进行下面判断，否则会造成重复释放NULL地址而崩溃 */
if (NULL == pTime)
{
free(pTime);
pTime = NULL;
}
}
//
//Function:
//Check if exe file binded by WHBoy virus
//
//Parameter:
// FILE *fp -- file stream to read
//
//Return:
// true -- bind by viruse
// false-- not bind by viruse
//
//Remark:
// Don't close fp, will be closed by main
bool CheckWHVirus(FILE *fp)
{
//Get position
fpos_t pos = 0x12605;
if( fsetpos( fp, &pos ) != 0 )
{
printf( "Trouble opening file\n" );
//fclose(fp);
return false;
}
//Read 2byte from fpost
char buffer[50];
fread(buffer, sizeof( char ), 2, fp);
if (buffer[0] == 'M'
&& buffer[1] == 'Z')
{
//Read reverse
long repos = -1;
fseek(fp, repos, SEEK_END);
fread(buffer, sizeof( char ), 1, fp);
if (buffer[0] == 0x01)
{
return true;
}
}
return false;
}
//
//Function:
// Clear virus
//
//Parameter:
// File *fp -- virus exe file
// char * -- Origin file name
//
//Return:
// void
void ClearVirus(FILE *fp, char * strOriginFileName)
{
long repos = -1;
long lFileLen = 0;
long lExp = 1;
char buffer[50];
//To 0x02
while (1)
{
repos--;
fseek(fp, repos, SEEK_END);
fread(buffer, sizeof( char ), 1, fp);
if (buffer[0] == 0x02)
{
break;
}
//0x02 38 37
lFileLen = (buffer[0]-'0') * lExp + lFileLen;
lExp *= 10;
}
printf("\r\nLen is %d ", lFileLen);
//new len char
char *strOriginFile = new char[lFileLen];
fpos_t pos = 0x12605;
fsetpos(fp, &pos);
fread(strOriginFile, sizeof( char ), lFileLen, fp);
//rename virus to exe.exe
fclose(fp);
char strBackupFile[MAX_PATH];
strcpy(strBackupFile, strOriginFileName);
strBackupFile[strlen(strBackupFile)-1] = '1'; //ex1
MoveFile(strOriginFileName, strBackupFile);
//cout to file
FILE *outfp;
outfp = fopen(strOriginFileName, "wb");
//ouput to exe
fwrite(strOriginFile, sizeof(char), lFileLen, outfp);
fclose(outfp);
delete []strOriginFile;
}
//Function:
// Visit all folders and files
//
//Paremeter:
// char *lpPath -- path of file
//
//Return:
// void
//
void VisitAllFiles(char * lpPath)
{
char szFind[MAX_PATH];
WIN32_FIND_DATA FindFileData;
strcpy(szFind,lpPath);
strcat(szFind,"\\*.*");
HANDLE hFind=::FindFirstFile(szFind,&FindFileData);
if(INVALID_HANDLE_VALUE == hFind)
{
printf("No %d file found\n",TYPE);
return;
}
while(TRUE)
{
//If director, visit all sub-folders
if(FindFileData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
{
if(FindFileData.cFileName[0]!='.')
{
/*printf("+%s\n",FindFileData.cFileName);*/
char szFile[MAX_PATH];
strcpy(szFile,lpPath);
strcat(szFile,"\\");
strcat(szFile,FindFileData.cFileName);
VisitAllFiles(szFile);
}
}
else
{
//Judge if exe file
/*printf(" -%s\n",FindFileData.cFileName);*/
int len = strlen(FindFileData.cFileName);
const char *p = (char *)&FindFileData.cFileName[len-4];
if ((_stricmp(p, TYPE) == 0) //case insentive!
)
{
g_lCheckFileNumber++;
//if exe file, check it
char strFileName[MAX_PATH];
strcpy(strFileName,lpPath);
strcat(strFileName,"\\");
strcat(strFileName,FindFileData.cFileName);
printf("T:%ld,Clear:%ld,check %s\n\r",
g_lCheckFileNumber, g_lClearFileNumber, strFileName);
/* 对全局时间pTime变量赋值 */
char strCurTime[30];
PrintLocalTime(strCurTime);
FILE *fp;
char strTemFileName[80];
strcpy(strTemFileName,"Log.txt");
if ((fp = fopen(strTemFileName, "a")) == NULL)
{
printf("Can't open %s \n", strTemFileName);
}
else
{
fprintf(fp,"<%s>---T:%ld,Clear:%ld,check %s\n\r",
strCurTime,
g_lCheckFileNumber,
g_lClearFileNumber,
strFileName);
/* 置删除标志时，删除文件 */
/*if (CheckWHVirus(fp))*/
if (g_flagDeleteFile == FLAG_DELETE)
{
g_lClearFileNumber++;
PrintLocalTime(strCurTime);
/*ClearVirus(fp, strFileName);*/ //fp closed in the function
/*printf("Virus Found! %s and cleared\r\n", strFileName);*/
/*DeleteFile(strFileName);*/
printf("Delete file: %s successfully!\n", strFileName);
fprintf(fp,"<%s>---Delete file: %s successfully!\n", strCurTime,strFileName);
}
else
{
// PrintLocalTime(strCurTime);
// fprintf(fp,"END-------------------------------------------------%s\n",strCurTime);
fclose(fp);
}
}
FreePTime(pTime);
}
}
//Find next file
if(!FindNextFile(hFind,&FindFileData))
break;
}
FindClose(hFind);
}
int main()
{
g_flagDeleteFile = FLAG_DELETE;
/*(void)DeleteDirFile(FILE_PATH, FILE_NAME_TYPE,FLAG_VIEW_FILE);*/
/*(void)FindFileInDirWithType(FILE_PATH, FILE_NAME_TYPE,FLAG_VIEW_FILE);*/
VisitAllFiles(FILE_PATH);
return 0;
}
