均在命令行下使用
AntiIframe.vbs
#该脚本是批量挂马程序的逆向，用于批量清除被添加到文件中的恶意代码。记事本打开文件可以修改Pattern参数指定要处理的文件名，文件名之间用|隔开（也支持vbs正则表达式）。由于要修改文件，请谨慎的使用（最好先备份文件）
#用法: CScript AntiIframe.vbs [处理的路径] [包含清除内容的文件]
#例子: CScript AntiIframe.vbs d:Web d:lake2.txt
----------------------------
Scan.vbs
#该脚本用于本地扫描ASP木马，速度比ASP版快很多。可能存在误报、漏报的情况，视具体情况处理
#用法: CScript Scan.vbs [扫描路径] [结果HTM文件路径]
#例子: CScript Scan.vbs d:Web f:myreport.html
Scan.vbs
'-----------------------
'Scan ASP WebShell in vbs
'Author: lake2 (http://lake2.0x54.org)
'Date: 2007-7-29
'Version: 1.1
'-----------------------
DimFileExt = "asp,cer,asa,cdx"
Dim Report, Report2, Sun, SumFiles, SumFolders
Call ShowInfo()
If WScript.Arguments.Count = 2 Then
Sun = 0
SumFiles = 0
SumFolders = 1
If Right(WScript.Arguments.Item(0),1) = "" Then
thePath = Mid(WScript.Arguments.Item(0),1,Len(WScript.Arguments.Item(0))-1)
Else
thePath = WScript.Arguments.Item(0)
End If
Call CheckArg(thePath)
WScript.Echo "开始扫描，请稍候……"
WScript.Sleep(1000)
StartTime = now()
Call ShowAllFile(thePath)
EndTime = now()
WScript.Echo vbcrlf & "扫描完成！" & vbcrlf
report2 = report2 & "<html><head><title>雷客图 ASP 站长安全助手vbs版扫描报告</title>"
report2 = report2 & "<meta http-equiv=""Content-Type"" content=""text/html; charset=gb2312""></head>"
report2 = report2 & "<body><b><font size=4>雷客图 ASP 站长安全助手vbs版扫描报告</font></b><br><br>"
report2 = report2 & "<font size=2>开始时间："&StartTime&"</font><br>"
report2 = report2 & "<font size=2>结束时间："&EndTime&"</font><br>"
report2 = report2 & "<font size=2>扫描完毕！一共检查文件夹<font color=""#FF0000"">"&SumFolders&"</font>个，文件<font color=""#FF0000"">"&SumFiles&"</font>个，发现可疑点<font color=""#FF0000"">"&Sun&"</font>个（<font color=""#FF0000"">红字</font>显示的为严重可疑）</font><br/>"
report2 = report2 & "<table width=""100%"" border=""1"" bordercolor=""blue"" style=""padding:5px;line-height:170%;clear:both;font-size:12px;word-break:break-all"">"
report2 = report2 & "<tr>"
report2 = report2 & "<td width=""20%"">文件路径</td>"
report2 = report2 & "<td width=""20%"">特征码</td>"
report2 = report2 & "<td width=""40%"">描述</td>"
report2 = report2 & "<td width=""20%"">创建/修改时间</td>"
report2 = report2 & "</tr>"
report2 = report2 & "<p>"
report2 = report2 & report
report2 = report2 & "</p>"
report2 = report2 & "</table><hr><script src=http://www.0x54.org/announce.js></script>"
report2 = report2 & "<div align=center>powered by <a href=""http://www.0x54.org"" target=_blank>0x54.org</a></div>"
report2 = report2 & "</body></html>"
Call WriteToFile()
Else
Call ShowHelp()
End If
