嘗試連接局域網目標445端口：

#include "KillingTools.h"
#include <iostream>
using namespace std;//根據進程名稱獲取進程ID
DWORD GetProcessIDByName(const char* pName){HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);if (INVALID_HANDLE_VALUE == hSnapshot) {return NULL;}PROCESSENTRY32 pe = { sizeof(pe) };for (BOOL ret = Process32First(hSnapshot, &pe); ret; ret = Process32Next(hSnapshot, &pe)) {USES_CONVERSION;if (strcmp(W2CA(pe.szExeFile), pName) == 0) {CloseHandle(hSnapshot);return pe.th32ProcessID;}}CloseHandle(hSnapshot);return 0;
}//提升權限
BOOL EnablePrivilege(LPCTSTR szPrivilege, BOOL fEnable) {BOOL fOk = FALSE;HANDLE hToken = NULL;if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) {TOKEN_PRIVILEGES tp;tp.PrivilegeCount = 1;LookupPrivilegeValue(NULL, szPrivilege, &tp.Privileges[0].Luid);tp.Privileges->Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);fOk = (GetLastError() == ERROR_SUCCESS);CloseHandle(hToken);}return fOk;
}//計算散列值
DWORD CRC32(BYTE* ptr, DWORD Size){DWORD crcTable[256], crcTmp1;//動態生成CRC-32表for (int i = 0; i < 256; i++){crcTmp1 = i;for (int j = 8; j > 0; j--){if (crcTmp1 & 1) crcTmp1 = (crcTmp1 >> 1) ^ 0xEDB88320L;else crcTmp1 >>= 1;}crcTable[i] = crcTmp1;}//計算CRC32值DWORD crcTmp2 = 0xFFFFFFFF;while (Size--){crcTmp2 = ((crcTmp2 >> 8) & 0x00FFFFFF) ^ crcTable[(crcTmp2 ^ (*ptr)) & 0xFF];ptr++;}return (crcTmp2 ^ 0xFFFFFFFF);
}//遍歷刪除Desktop_.ini
DWORD WINAPI FindFiles(LPVOID lpszPath){WIN32_FIND_DATA stFindFile;HANDLE hFindFile;// 掃描路徑char szPath[MAX_PATH];char szFindFile[MAX_PATH];char szSearch[MAX_PATH];char *szFilter;int len;int ret = 0;szFilter = "*.*";lstrcpy((LPWSTR)szPath, (LPCWSTR)lpszPath);len = lstrlen((LPCWSTR)szPath);if (szPath[len - 1] != '\\'){szPath[len] = '\\';szPath[len + 1] = '\0';}lstrcpy((LPWSTR)szSearch, (LPCWSTR)szPath);lstrcat((LPWSTR)szSearch, (LPCWSTR)szFilter);hFindFile = FindFirstFile((LPCWSTR)szSearch, &stFindFile);if (hFindFile != INVALID_HANDLE_VALUE){do{lstrcpy((LPWSTR)szFindFile, (LPCWSTR)szPath);lstrcat((LPWSTR)szFindFile, stFindFile.cFileName);if (stFindFile.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY){if (stFindFile.cFileName[0] != '.'){FindFiles(szFindFile);}}else{if (!lstrcmp(stFindFile.cFileName, L"Desktop_.ini")){// 去除文件的隱藏、系統以及只讀屬性DWORD dwFileAttributes = GetFileAttributes((LPCWSTR)szFindFile);dwFileAttributes &= ~FILE_ATTRIBUTE_HIDDEN;dwFileAttributes &= ~FILE_ATTRIBUTE_SYSTEM;dwFileAttributes &= ~FILE_ATTRIBUTE_READONLY;SetFileAttributes((LPCWSTR)szFindFile, dwFileAttributes);// 刪除Desktop_.iniBOOL bRet = DeleteFile((LPCWSTR)szFindFile);cout << szFindFile << endl;if (bRet){cout << "被刪除" << endl;}else{cout << "無法刪除" << endl;}}}ret = FindNextFile(hFindFile, &stFindFile);} while (ret != 0);}FindClose(hFindFile);return 0;
}int main() {BOOL bRet = FALSE;DWORD dwPid = 0;//進程ID// 提升權限BOOL bRet1 = EnablePrivilege(SE_DEBUG_NAME, TRUE);if (bRet1 == FALSE){cout << "提升權限失敗" << endl;}else{cout << "提升權限成功！" << endl;}dwPid = GetProcessIDByName("spo0lsv.exe");if (dwPid != 0) { bRet = 1; }//  結束spo0lsv.exe進程，并刪除病毒程序本身if (bRet == TRUE){cout << "查找系統病毒進程..." << endl;cout << "系統中存在病毒進程:spo0lsv.exe" << endl;cout << "準備進行查殺..." << endl;// 打開并嘗試結束病毒進程HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);if (hProcess == INVALID_HANDLE_VALUE){cout << "無法結束病毒進程" << endl;return 0;}bRet = TerminateProcess(hProcess, 0);if (bRet == FALSE){cout << "無法結束病毒進程" << endl;return 0;}cout << "病毒進程已經結束" << endl;CloseHandle(hProcess);}else{cout << "系統中不存在spo0lsv.exe病毒進程" << endl;}Sleep(10);// 查殺磁盤中是否存在名為spo0lsv.exe的病毒文件char szSysPath[MAX_PATH] = { 0 };GetSystemDirectory((LPWSTR)szSysPath, MAX_PATH);lstrcat((LPWSTR)szSysPath, L"\\drivers\\spo0lsv.exe");cout << "檢查硬盤中是否存在spo0lsv.exe文件..." << endl;if (GetFileAttributes((LPWSTR)szSysPath) == 0xFFFFFFFF){cout << "spo0lsv.exe病毒文件不存在" << endl;}else{cout << "spo0lsv.exe病毒文件存在，正在計算散列值" << endl;HANDLE hFile = CreateFile((LPWSTR)szSysPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);if (hFile == INVALID_HANDLE_VALUE){cout << "Create Error" << endl;return 0;}DWORD dwSize = GetFileSize(hFile, NULL);if (dwSize == 0xFFFFFFFF){cout << "GetFileSize Error" << endl;return 0;}BYTE *pFile = (BYTE*)malloc(dwSize);if (pFile == NULL){cout << "malloc Error" << endl;return 0;}DWORD dwNum = 0;ReadFile(hFile, pFile, dwSize, &dwNum, NULL);// 計算spo0lsv.exe的散列值DWORD dwCrc32 = CRC32(pFile, dwSize);if (pFile != NULL){free(pFile);pFile = NULL;}CloseHandle(hFile);// 3862775251是“熊貓燒香”病毒的散列值if (dwCrc32 != 3862775251){cout << "spo0lsv.exe比較校驗失敗" << endl;}else{cout << "spo0lsv.exe比較校驗成功，正在刪除..." << endl;// 去除文件的隱藏、系統以及只讀屬性DWORD dwFileAttributes = GetFileAttributes((LPCWSTR)szSysPath);dwFileAttributes &= ~FILE_ATTRIBUTE_HIDDEN;dwFileAttributes &= ~FILE_ATTRIBUTE_SYSTEM;dwFileAttributes &= ~FILE_ATTRIBUTE_READONLY;SetFileAttributes((LPCWSTR)szSysPath, dwFileAttributes);// 刪除spo0lsv.exebRet = DeleteFile((LPCWSTR)szSysPath);if (bRet){cout << "spoclsv.exe病毒被刪除！" << endl;}else{cout << "spoclsv.exe病毒無法刪除" << endl;}}}//  刪除每個盤符下的setup.exe與autorun.inf，以及Desktop_.inichar szDriverString[MAXBYTE] = { 0 };char *pTmp = NULL;//獲取字符串類型的驅動器列表  GetLogicalDriveStrings(MAXBYTE, (LPWSTR)szDriverString);pTmp = szDriverString;while (*pTmp){char szAutorunPath[MAX_PATH] = { 0 };char szSetupPath[MAX_PATH] = { 0 };lstrcat((LPWSTR)szAutorunPath, (LPCWSTR)pTmp);lstrcat((LPWSTR)szAutorunPath, L"autorun.inf");lstrcat((LPWSTR)szSetupPath, (LPCWSTR)pTmp);lstrcat((LPWSTR)szSetupPath, L"setup.exe");if (GetFileAttributes((LPCWSTR)szSetupPath) == 0xFFFFFFFF){cout << pTmp << " setup.exe病毒文件不存在" << endl;}else{cout << pTmp << " setup.exe病毒文件存在，正在進行計算校驗和..." << endl;HANDLE hFile = CreateFile((LPCWSTR)szSetupPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);if (hFile == INVALID_HANDLE_VALUE){cout << "Create Error" << endl;return 0;}DWORD dwSize = GetFileSize(hFile, NULL);if (dwSize == 0xFFFFFFFF){cout << "GetFileSize Error" << endl;return 0;}BYTE *pFile = (BYTE*)malloc(dwSize);if (pFile == NULL){cout << "malloc Error" << endl;return 0;}DWORD dwNum = 0;ReadFile(hFile, pFile, dwSize, &dwNum, NULL);DWORD dwCrc32 = CRC32(pFile, dwSize);if (pFile != NULL){free(pFile);pFile = NULL;}CloseHandle(hFile);if (dwCrc32 != 3862775251){cout << "比較校驗失敗" << endl;}else{cout << "比較校驗成功，正在刪除..." << endl;// 去除文件的隱藏、系統以及只讀屬性DWORD dwFileAttributes = GetFileAttributes((LPCWSTR)szSetupPath);dwFileAttributes &= ~FILE_ATTRIBUTE_HIDDEN;dwFileAttributes &= ~FILE_ATTRIBUTE_SYSTEM;dwFileAttributes &= ~FILE_ATTRIBUTE_READONLY;SetFileAttributes((LPCWSTR)szSetupPath, dwFileAttributes);// 刪除setup.exebRet = DeleteFile((LPCWSTR)szSetupPath);if (bRet){cout << pTmp << " setup.exe病毒已刪除!" << endl;}else{cout << pTmp << " setup.exe病毒無法刪除" << endl;}}}// 去除文件的隱藏、系統以及只讀屬性DWORD dwFileAttributes = GetFileAttributes((LPCWSTR)szAutorunPath);dwFileAttributes &= ~FILE_ATTRIBUTE_HIDDEN;dwFileAttributes &= ~FILE_ATTRIBUTE_SYSTEM;dwFileAttributes &= ~FILE_ATTRIBUTE_READONLY;SetFileAttributes((LPCWSTR)szAutorunPath, dwFileAttributes);// 刪除autorun.infbRet = DeleteFile((LPCWSTR)szAutorunPath);if (bRet){cout << pTmp << " autorun.inf已刪除!" << endl;}else{cout << pTmp << " autorun.inf不存在或無法刪除" << endl;}// 刪除Desktop_.iniFindFiles(pTmp);// 檢查下一個盤符pTmp += 4;}//  修復注冊表內容，刪除病毒啟動項并修復文件的隱藏顯示cout << "正在檢查注冊表..." << endl;// 首先檢查啟動項TCHAR RegRun[] = TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Run");HKEY hKeyHKCU = NULL;LONG lSize = MAXBYTE;char cData[MAXBYTE] = { 0 };long lRet = RegOpenKeyEx(HKEY_CURRENT_USER, (LPCWSTR)RegRun, 0, KEY_WOW64_32KEY | KEY_ALL_ACCESS, &hKeyHKCU);if (lRet == ERROR_SUCCESS){lRet = RegQueryValueEx(hKeyHKCU, L"svcshare", NULL, NULL, (unsigned char *)cData, (unsigned long *)&lSize);if (lRet == ERROR_SUCCESS){if (lstrcmp((LPCWSTR)cData, L"C:\\WINDOWS\\system32\\drivers\\spo0lsv.exe") == 0){cout << "注冊表啟動項中存在病毒信息項" << endl;}lRet = RegDeleteValue(hKeyHKCU, L"svcshare");if (lRet == ERROR_SUCCESS){cout << "注冊表啟動項中的病毒信息已刪除！" << endl;}else{cout << "注冊表啟動項中的病毒信息無法刪除" << endl;}}else{cout << "注冊表啟動項中不存在病毒信息" << endl;}RegCloseKey(hKeyHKCU);}else{cout << "注冊表啟動項信息讀取失敗" << endl;}// 接下來修復文件的隱藏顯示，需要將CheckedValue的值設置為1TCHAR RegHide[] = TEXT("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL");HKEY hKeyHKLM = NULL;DWORD dwFlag = 1;long lRetHide = RegOpenKeyEx(HKEY_LOCAL_MACHINE, (LPCWSTR)RegHide, 0, KEY_WOW64_32KEY | KEY_ALL_ACCESS, &hKeyHKLM);if (lRetHide == ERROR_SUCCESS){cout << "檢測注冊表的文件隱藏選項..." << endl;if (ERROR_SUCCESS == RegSetValueEx(hKeyHKLM,             //subkey handle  L"CheckedValue",       //value name  0,                    //must be zero  REG_DWORD,            //value type  (CONST BYTE*)&dwFlag, //pointer to value data  4))                   //length of value data{cout << "注冊表修復完畢！" << endl;}else{cout << "無法恢復注冊表的文件隱藏選項" << endl;}}cout << "病毒初步查殺完成，請使用專業殺毒軟件進行全面掃描！" << endl;system("pause");return 0;
}

3.4 被感染文件修復工具的編寫

#include <stdio.h>
#include "stdlib.h"
#include <windows.h>//str1中尋找str2的位置
int findsub(char *str1, char *str2, long sizes)
{int i = 0, j = 0;while (sizes - i) //多少個字符長度就執行多少次{for (; str1[i] != str2[0]; i++);//后面每個字符比較都不相等就i++if (str1[i] == str2[0])//判斷首次相等{for (j = 0; str1[i + j] == str2[j]; j++);//后面每個字符比較都相等就j++if (str2[j] == '\0')//直到把字符串2都比較完都相等return i + 1;   // 返回字符串2中出現字符串1的第一個位置}i++; //不相等就繼續往后走}return -1;//如果沒有找到合適的返回-1.
}//恢復被感染文件為正常文件
void recover(int pos1, int pos2) {FILE *in, *out;char ch;//打開源文件Exam1.exeif ((in = fopen("Exam1.exe", "rb")) == NULL){printf("The file %s can not be opened.\n", "Exam1.exe");return;}//創建修復文件Exam2.exeif ((out = fopen("Exam2.exe", "wb")) == NULL){printf("The file %s can not be opened.\n", "Exam2.exe");return;}int i = 0;while (!feof(in))//判斷文本結束{ch = fgetc(in);//讀取一個字符if (ferror(in)){printf("read error!\n");clearerr(in);}else{//寫入特定位置的字符if (pos1 <= i&&i <= pos2)fputc(ch, out);i++;//移動位置if (ferror(out))//ferror函數檢查輸出{printf("write error!\n");//文件錯誤標志和文件結束標志置為0clearerr(out);}}}//關閉文件流fclose(in);fclose(out);
}void main()
{FILE *f = fopen("Exam1.exe", "rb");fseek(f, 0, SEEK_END);long fsize = ftell(f);//獲取源文件大小fseek(f, 0, SEEK_SET);fclose(f);//用于存儲源文件內容char *string = (char*)malloc(fsize + 1);FILE *in, *out;char ch;if ((in = fopen("Exam1.exe", "rb")) == NULL){printf("The file %s can not be opened.\n", "Exam1.exe");return;}int i = 0;while (!feof(in)){ch = fgetc(in);if (ferror(in)){printf("read error!\n");clearerr(in);}else{//一個個字符保存string[i] = ch;i++;}}fclose(in);//保存正常文件的MZ頭位置int count1 = findsub(string, "This", fsize + 1) - 79;//保存感染標志位WhBoyExam1的位置int count2 = findsub(string, "WhBoyExam1", fsize + 1) - 2;//開始修復文件recover(count1, count2);//釋放內存delete string;//刪除病毒文件DeleteFile(L"Exam1.exe");system("pause");
}

3.5 總結