VB MD5扫描仪问题..... [英] VB MD5 Scanner Problem.....

问题描述

再次向所有Code Project成员问好，我正在寻找一种使用MD5或CRC32或任何其他类型的签名的方法，以更好地指出计算机上受感染的文件.我现在有一个代码，该代码允许用户使用对话框窗口一次选择一个文件，但希望它在扫描时会检查哈希文件以查找名称，以使好的文件的名称不会被误认为是病毒.到目前为止，我对单个文件的代码是:

Hello once again to all Code Project members I am looking for a way to use MD5 or CRC32 or anyother type of signature to better point out infected files on my computer. I have a code now which allows the user to select one file at a time with a dialog window but wish it would check hash files as the scan is looking for names so that the names of good files are not mistaken for virusus. the code I have so far for individual files is:

Private Sub Button4_Click(ByVal sender As Object, ByVal e As EventArgs) Handles Button4.Click
        Using open As New OpenFileDialog() With {.CheckFileExists = True, .CheckPathExists = True}
            open.ShowDialog()
            Using MD5 As New MD5CryptoServiceProvider()
                Using File As New FileStream(open.FileName, FileMode.Open, FileAccess.Read, FileShare.Read, &H2000)
                    Label3.Text = (open.FileName)
                    MD5.ComputeHash(File)
                End Using
                Dim hash As Byte() = MD5.Hash
                Dim build As New StringBuilder()
                Dim num As Byte
                For Each num In hash
                    build.Append(String.Format("{0:X2}", num))
                Next
                ListView1.Text = build.ToString
            End Using
        End Using
    End Sub

    Private Sub Button5_Click(ByVal sender As Object, ByVal e As EventArgs) Handles Button5.Click
        If ListView1.Text.Contains(TextBox2.Text) Then
            MsgBox("This File Has A Virus Type Hash Signature Please Delete The Selected Virus", MsgBoxStyle.Information)
            ListView1.Items.Add(TextBox2.Text)
        Else
            MsgBox("The File In Question Has No Indication Of Being A Virus", MsgBoxStyle.Information)
        End If
    End Sub

正确方向的任何信息都将被很好地接受.希望大家圣诞快乐，期待您的回复！！ :)

Any info in the right direction would be very well accepted. Hope you all have a merry christmas, look foward to your replies!! :)

推荐答案

戴尔，您确实意识到这行不通，不是吗?

示例:获取一个文本文件.计算它的MD5值:

Dale, you do realise that this isn''t going to work, don''t you?

Example: Take a text file. Calculate it''s MD5 value:

6E 4D 28 C1 E9 C8 0A 3F ED 46 61 9E CA CC E5 5C 

使用编辑器，将一位更改(将"2"更改为"3").
现在再次计算它的MD5:

Use an editor, change one bit (change a "2" to a "3").
Now calculate it''s MD5 again:

7B 0A 2E BA A8 EA 00 A5 53 C9 4E 86 F7 2F 15 9C 

没有MD5可以保证签名匹配-这不是MD5的全部内容.

好吧，我已经读完了这篇文章，看到了CRC或静态哈希的名称?您能提供一些有关它们的信息以及其他防病毒如何使用它们来查找病毒文件吗?"


一些(较旧的，更容易被骗的)扫描程序使用它们的方式是维护一个具有CRC或MD5或SHA哈希值的文件列表，然后将文件哈希的当前值与该值进行比较.如果已更改，则可能是病毒感染了它.当然，用户也有可能保存了自己的文件，正在开发程序或在数据库中输入了一些内容.傻瓜也很容易:病毒只是将新值写入列表，因此扫描程序不是更明智的选择.

No MD5 will guarantee a signature match - that is not what MD5 is all about.

"Ok so I have done some reading into this and saw the name CRC or Static hash? can you give some info about them and how other antiviruses are using them to find virus files?"


The way they are used by some (older, more easily fooled) scanners is to maintain a list of files with the CRC or MD5 or SHA hash value, and then to compare the current value of the file hash with that. If it has changed, then it is possible that a virus has done it. Of course, it is also possible that the user saved his file, is developing a program, or entered something in a database. It is also pretty easy to fool: the virus just writes the new value to the list so the scanner is none the wiser...

这篇关于VB MD5扫描仪问题.....的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！