本文目录导读：
我来为你介绍如何用PHP实现病毒扫描功能,这里提供几种实用方案：
基础文件扫描器
<?php
class VirusScanner {
private $signatures = [];
private $scannedFiles = 0;
private $infectedFiles = [];
public function __construct() {
// 加载恶意代码特征库
$this->loadSignatures();
}
// 加载特征库
private function loadSignatures() {
$this->signatures = [
'php_webshell' => [
'pattern' => '/eval\s*\(\s*\$_/i',
'severity' => 'critical'
],
'cmd_execution' => [
'pattern' => '/system\s*\(\s*\$_/i',
'severity' => 'high'
],
'file_upload_backdoor' => [
'pattern' => '/move_uploaded_file\s*\(.*?\$_/i',
'severity' => 'high'
],
// 添加更多特征
];
}
// 扫描目录
public function scanDirectory($dir) {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir)
);
foreach ($iterator as $file) {
if ($file->isFile() && $this->isPhpFile($file)) {
$this->scanFile($file->getPathname());
}
}
return [
'scanned' => $this->scannedFiles,
'infected' => $this->infectedFiles
];
}
// 扫描单个文件
public function scanFile($filePath) {
$content = file_get_contents($filePath);
$this->scannedFiles++;
foreach ($this->signatures as $name => $signature) {
if (preg_match($signature['pattern'], $content)) {
$this->infectedFiles[] = [
'file' => $filePath,
'type' => $name,
'severity' => $signature['severity']
];
}
}
}
private function isPhpFile($file) {
$ext = $file->getExtension();
return in_array(strtolower($ext), ['php', 'php3', 'php4', 'php5', 'phtml']);
}
}
高级检测版本
<?php
class AdvancedVirusScanner {
private $suspiciousPatterns = [
// 后门检测
'/\b(eval|assert|system|exec|passthru|shell_exec)\s*\(/i',
'/\b(base64_decode|gzinflate|str_rot13)\s*\(/i',
'/\$\_(GET|POST|REQUEST|COOKIE)\s*\[/i',
// 文件操作
'/\b(chmod|unlink|rename|copy)\s*\(/i',
'/\b(file_put_contents|fwrite|fputs)\s*\(/i',
// 数据库攻击
'/\b(mysql_query|mysqli_query)\s*\(.*\$_/i',
'/UNION\s+SELECT/i',
// 混淆代码
'/\bcreate_function\s*\(/i',
'/\bpreg_replace\s*\(.*\/e/i'
];
public function deepScan($filePath) {
$results = [];
$content = file_get_contents($filePath);
// 1. 检查代码注入
if ($this->checkInjection($content)) {
$results[] = [
'type' => 'injection',
'risk' => 'high',
'message' => '检测到代码注入风险'
];
}
// 2. 检查加密/混淆代码
if ($this->checkObfuscation($content)) {
$results[] = [
'type' => 'obfuscation',
'risk' => 'medium',
'message' => '检测到代码混淆'
];
}
// 3. 检查可疑操作
if ($this->checkSuspiciousOperations($content)) {
$results[] = [
'type' => 'suspicious_operation',
'risk' => 'medium',
'message' => '发现可疑系统操作'
];
}
return $results;
}
private function checkInjection($content) {
// 移除注释后检查
$content = preg_replace('/\/\*.*?\*\//s', '', $content);
$content = preg_replace('/(?<!:)\/\/.*$/m', '', $content);
foreach ($this->suspiciousPatterns as $pattern) {
if (preg_match($pattern, $content)) {
return true;
}
}
return false;
}
private function checkObfuscation($content) {
// 检测base64加密的PHP代码
if (preg_match('/base64_decode\s*\(\s*[\'"]([^\'"]+)/', $content, $matches)) {
$decoded = @base64_decode($matches[1]);
if ($decoded && strpos($decoded, '<?php') !== false) {
return true;
}
}
// 检测压缩混淆
if (preg_match('/gzinflate\s*\(\s*/', $content)) {
return true;
}
// 检测hex加密
if (preg_match('/(?:\\x[0-9a-f]{2}){10,}/i', $content)) {
return true;
}
return false;
}
private function checkSuspiciousOperations($content) {
$suspicious = [
'/\bexec\s*\(/i',
'/\bsystem\s*\(/i',
'/\bpassthru\s*\(/i',
'/\bshell_exec\s*\(/i',
'/\bpopen\s*\(/i',
'/\bproc_open\s*\(/i',
'/\bpcntl_exec\s*\(/i'
];
foreach ($suspicious as $pattern) {
if (preg_match($pattern, $content)) {
return true;
}
}
return false;
}
}
扫描器使用示例
<?php
require_once 'VirusScanner.php';
require_once 'AdvancedVirusScanner.php';
class SecurityScanner {
private $scanner;
private $advancedScanner;
public function __construct() {
$this->scanner = new VirusScanner();
$this->advancedScanner = new AdvancedVirusScanner();
}
public function scanWebsite($rootDir) {
$results = [
'basic_scan' => [],
'advanced_scan' => [],
'summary' => []
];
try {
// 基础扫描
$results['basic_scan'] = $this->scanner->scanDirectory($rootDir);
// 高级扫描
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($rootDir)
);
foreach ($iterator as $file) {
if ($file->isFile() && $this->isPhpFile($file)) {
$advanced = $this->advancedScanner->deepScan($file->getPathname());
if (!empty($advanced)) {
$results['advanced_scan'][] = [
'file' => $file->getPathname(),
'findings' => $advanced
];
}
}
}
// 生成摘要
$results['summary'] = $this->generateSummary($results);
} catch (Exception $e) {
error_log("扫描异常: " . $e->getMessage());
}
return $results;
}
private function generateSummary($results) {
$summary = [
'total_files' => $results['basic_scan']['scanned'] ?? 0,
'infected_files' => count($results['basic_scan']['infected'] ?? []),
'high_risks' => 0,
'medium_risks' => 0,
'status' => 'clean'
];
foreach ($results['advanced_scan'] as $scan) {
foreach ($scan['findings'] as $finding) {
if ($finding['risk'] === 'high') {
$summary['high_risks']++;
} elseif ($finding['risk'] === 'medium') {
$summary['medium_risks']++;
}
}
}
if ($summary['infected_files'] > 0 || $summary['high_risks'] > 0) {
$summary['status'] = 'infected';
} elseif ($summary['medium_risks'] > 0) {
$summary['status'] = 'suspicious';
}
return $summary;
}
private function isPhpFile($file) {
$ext = pathinfo($file, PATHINFO_EXTENSION);
return in_array(strtolower($ext), ['php', 'php3', 'php4', 'php5', 'phtml']);
}
}
// 使用示例
try {
$scanner = new SecurityScanner();
$results = $scanner->scanWebsite('/path/to/your/website');
echo "扫描完成！\n";
echo "状态: {$results['summary']['status']}\n";
echo "文件总数: {$results['summary']['total_files']}\n";
echo "感染文件: {$results['summary']['infected_files']}\n";
if (!empty($results['advanced_scan'])) {
echo "\n高风险发现:\n";
foreach ($results['advanced_scan'] as $scan) {
echo " - {$scan['file']}\n";
}
}
} catch (Exception $e) {
echo "扫描失败: " . $e->getMessage();
}
实时监控版本
<?php
class RealTimeMonitor {
private $watchPaths = [];
private $alertCallback;
public function watch($path, $callback) {
$this->watchPaths[$path] = $callback;
$this->monitor();
}
private function monitor() {
$files = [];
while (true) {
foreach ($this->watchPaths as $path => $callback) {
$currentFiles = $this->getFilesRecursively($path);
// 检测新文件或修改
foreach ($currentFiles as $file) {
$hash = md5_file($file);
if (!isset($files[$file]) || $files[$file] != $hash) {
// 文件被修改或新增
$files[$file] = $hash;
$this->triggerAlert($callback, $file);
}
}
// 检测删除的文件
foreach ($files as $file => $hash) {
if (!file_exists($file)) {
unset($files[$file]);
$this->triggerAlert($callback, $file, 'deleted');
}
}
}
sleep(5); // 5秒检查一次
}
}
private function triggerAlert($callback, $file, $action = 'modified') {
if (is_callable($callback)) {
call_user_func($callback, $file, $action);
}
}
private function getFilesRecursively($dir) {
$files = [];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir)
);
foreach ($iterator as $file) {
if ($file->isFile()) {
$files[] = $file->getPathname();
}
}
return $files;
}
}
实用建议
特征库更新
// 定期更新特征库
public function updateSignatures($url) {
$signatures = file_get_contents($url);
file_put_contents('signatures.json', $signatures);
}
性能优化
// 分批处理大目录
public function scanLargeDirectory($dir, $batchSize = 100) {
$files = glob($dir . '/*');
$batches = array_chunk($files, $batchSize);
foreach ($batches as $batch) {
// 每批处理，避免内存溢出
foreach ($batch as $file) {
$this->scanFile($file);
}
gc_collect_cycles(); // 释放内存
}
}
注意事项：
- 定期更新病毒特征库
- 结合人工审核不能完全依赖自动化
- 备份重要文件
- 使用白名单机制减少误报
这些代码可以构建一个基础的病毒扫描系统,实际部署时建议加入更多检测规则和AI分析功能。
版权声明：NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
NBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
CBA直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
足球直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
英超直播
