My Open Source Projects
O.S.S.
My Free Software
Free Soft
Articles and Documentation (in Russian)
Articles
My photoalbum and photographer notes
Photo
Windows Logos (Cool replacements for Windows 95/98 startup, shutdown and switchoff screens)
WinLogos
Site Archive (Site design gallery, dead sites gallery, old guestbooks...)
Archive
Contact information (quick email, email, ICQ etc)
Contacts
       

Блог - заметки

Мой дневник - заметки обо всем.

Post details: Infected Linux hosting

Infected Linux hosting

All pages on one of our websites got infected by some browser exploit. Linux hosting!! I spent few minutes to write a micro antivirus, because the backup copy of the site was not at hand. The infection is a solid block of text after normal page contents so the task is easy: detect it via signature then truncate the file.

·· [Continuing · Продолжение] ··

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

void Check( const char *fn )
{
  printf("%s: ", fn);
  FILE *fp = fopen(fn, "r+");
  if( fp==NULL ){
    printf("File not found.\n");
    return;
  }
  fseek( fp, 0, SEEK_END );
  long sz = ftell(fp);
  fseek( fp, 0, SEEK_SET );
  char *buf = (char*)malloc( sz );
  if( !buf ){
    printf("Memory allocation error!\n");
    exit(-1);
  }
  fread( buf, sz, 1, fp );
  fclose(fp);
  char *ptr=strstr(buf, "<div id='x0");
  if( ptr==NULL ){
    printf("CLEAN\n");
  }else{
    printf("VIRUS FOUND!\n");
    if( ptr>buf )
      ptr--;
    while( (ptr-buf)>0 && int(*ptr)<=32 )
      ptr--;
    truncate( fn, ptr-buf+1 );
  }
  free( buf );
}

int main( int argc, char *argv[] )
{
  if( argc<2 ){
    printf("Usage: %s <filenames>\n", argv[0]);
    return 0;
  }
  for( int f=1; f<argc; f++ )
    Check( argv[f] );
  return 0;
}

Comments:

No Comments for this post yet...

Leave a comment:

Your email address will not be displayed on this site.
Your URL will not be displayed on this site.
Confirmation Code:
Confirmation Code

                                                                                                                                                                                                                                                                   
June 2009
Mon Tue Wed Thu Fri Sat Sun
<<  <   >  >>
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30          

Blogs :

Search :

Archives :

Misc

Powered by


© Sergey A. Galin, 1998-2004 http://sageshome.net/b2e/blogs/