本文目录导读：
我来为你介绍如何用PHP实现病毒扫描功能,这里提供几种实用方案：
基础文件扫描器
<?php
class VirusScanner {
private $signatures = [];
private $scannedFiles = 0;
private $infectedFiles = [];
public function __construct() {
// 加载恶意代码特征库
$this->loadSignatures();
}
// 加载特征库
private function loadSignatures() {
$this->signatures = [
'php_webshell' => [
'pattern' => '/eval\s*\(\s*\$_/i',
'severity' => 'critical'
],
'cmd_execution' => [
'pattern' => '/system\s*\(\s*\$_/i',
'severity' => 'high'
],
'file_upload_backdoor' => [
'pattern' => '/move_uploaded_file\s*\(.*?\$_/i',
'severity' => 'high'
],
// 添加更多特征
];
}
// 扫描目录
public function scanDirectory($dir) {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir)
);
foreach ($iterator as $file) {
if ($file->isFile() && $this->isPhpFile($file)) {
$this->scanFile($file->getPathname());
}
}
return [
'scanned' => $this->scannedFiles,
'infected' => $this->infectedFiles
];
}
// 扫描单个文件
public function scanFile($filePath) {
$content = file_get_contents($filePath);
$this->scannedFiles++;
foreach ($this->signatures as $name => $signature) {
if (preg_match($signature['pattern'], $content)) {
$this->infectedFiles[] = [
'file' => $filePath,
'type' => $name,
'severity' => $signature['severity']
];
}
}
}
private function isPhpFile($file) {
$ext = $file->getExtension();
return in_array(strtolower($ext), ['php', 'php3', 'php4', 'php5', 'phtml']);
}
}
高级检测版本
<?php
class AdvancedVirusScanner {
private $suspiciousPatterns = [
// 后门检测
'/\b(eval|assert|system|exec|passthru|shell_exec)\s*\(/i',
'/\b(base64_decode|gzinflate|str_rot13)\s*\(/i',
'/\$\_(GET|POST|REQUEST|COOKIE)\s*\[/i',
// 文件操作
'/\b(chmod|unlink|rename|copy)\s*\(/i',
'/\b(file_put_contents|fwrite|fputs)\s*\(/i',
// 数据库攻击
'/\b(mysql_query|mysqli_query)\s*\(.*\$_/i',
'/UNION\s+SELECT/i',
// 混淆代码
'/\bcreate_function\s*\(/i',
'/\bpreg_replace\s*\(.*\/e/i'
];
public function deepScan($filePath) {
$results = [];
$content = file_get_contents($filePath);
// 1. 检查代码注入
if ($this->checkInjection($content)) {
$results[] = [
'type' => 'injection',
'risk' => 'high',
'message' => '检测到代码注入风险'
];
}
// 2. 检查加密/混淆代码
if ($this->checkObfuscation($content)) {
$results[] = [
'type' => 'obfuscation',
'risk' => 'medium',
'message' => '检测到代码混淆'
];
}
// 3. 检查可疑操作
if ($this->checkSuspiciousOperations($content)) {
$results[] = [
'type' => 'suspicious_operation',
'risk' => 'medium',
'message' => '发现可疑系统操作'
];
}
return $results;
}
private function checkInjection($content) {
// 移除注释后检查
$content = preg_replace('/\/\*.*?\*\//s', '', $content);
$content = preg_replace('/(?<!:)\/\/.*$/m', '', $content);
foreach ($this->suspiciousPatterns as $pattern) {
if (preg_match($pattern, $content)) {
return true;
}
}
return false;
}
private function checkObfuscation($content) {
// 检测base64加密的PHP代码
if (preg_match('/base64_decode\s*\(\s*[\'"]([^\'"]+)/', $content, $matches)) {
$decoded = @base64_decode($matches[1]);
if ($decoded && strpos($decoded, '<?php') !== false) {
return true;
}
}
// 检测压缩混淆
if (preg_match('/gzinflate\s*\(\s*/', $content)) {
return true;
}
// 检测hex加密
if (preg_match('/(?:\\x[0-9a-f]{2}){10,}/i', $content)) {
return true;
}
return false;
}
private function checkSuspiciousOperations($content) {
$suspicious = [
'/\bexec\s*\(/i',
'/\bsystem\s*\(/i',
'/\bpassthru\s*\(/i',
'/\bshell_exec\s*\(/i',
'/\bpopen\s*\(/i',
'/\bproc_open\s*\(/i',
'/\bpcntl_exec\s*\(/i'
];
foreach ($suspicious as $pattern) {
if (preg_match($pattern, $content)) {
return true;
}
}
return false;
}
}
扫描器使用示例
<?php
require_once 'VirusScanner.php';
require_once 'AdvancedVirusScanner.php';
class SecurityScanner {
private $scanner;
private $advancedScanner;
public function __construct() {
$this->scanner = new VirusScanner();
$this->advancedScanner = new AdvancedVirusScanner();
}
public function scanWebsite($rootDir) {
$results = [
'basic_scan' => [],
'advanced_scan' => [],
'summary' => []
];
try {
// 基础扫描
$results['basic_scan'] = $this->scanner->scanDirectory($rootDir);
// 高级扫描
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($rootDir)
);
foreach ($iterator as $file) {
if ($file->isFile() && $this->isPhpFile($file)) {
$advanced = $this->advancedScanner->deepScan($file->getPathname());
if (!empty($advanced)) {
$results['advanced_scan'][] = [
'file' => $file->getPathname(),
'findings' => $advanced
];
}
}
}
// 生成摘要
$results['summary'] = $this->generateSummary($results);
} catch (Exception $e) {
error_log("扫描异常: " . $e->getMessage());
}
return $results;
}
private function generateSummary($results) {
$summary = [
'total_files' => $results['basic_scan']['scanned'] ?? 0,
'infected_files' => count($results['basic_scan']['infected'] ?? []),
'high_risks' => 0,
'medium_risks' => 0,
'status' => 'clean'
];
foreach ($results['advanced_scan'] as $scan) {
foreach ($scan['findings'] as $finding) {
if ($finding['risk'] === 'high') {
$summary['high_risks']++;
} elseif ($finding['risk'] === 'medium') {
$summary['medium_risks']++;
}
}
}
if ($summary['infected_files'] > 0 || $summary['high_risks'] > 0) {
$summary['status'] = 'infected';
} elseif ($summary['medium_risks'] > 0) {
$summary['status'] = 'suspicious';
}
return $summary;
}
private function isPhpFile($file) {
$ext = pathinfo($file, PATHINFO_EXTENSION);
return in_array(strtolower($ext), ['php', 'php3', 'php4', 'php5', 'phtml']);
}
}
// 使用示例
try {
$scanner = new SecurityScanner();
$results = $scanner->scanWebsite('/path/to/your/website');
echo "扫描完成！\n";
echo "状态: {$results['summary']['status']}\n";
echo "文件总数: {$results['summary']['total_files']}\n";
echo "感染文件: {$results['summary']['infected_files']}\n";
if (!empty($results['advanced_scan'])) {
echo "\n高风险发现:\n";
foreach ($results['advanced_scan'] as $scan) {
echo " - {$scan['file']}\n";
}
}
} catch (Exception $e) {
echo "扫描失败: " . $e->getMessage();
}
实时监控版本
<?php
class RealTimeMonitor {
private $watchPaths = [];
private $alertCallback;
public function watch($path, $callback) {
$this->watchPaths[$path] = $callback;
$this->monitor();
}
private function monitor() {
$files = [];
while (true) {
foreach ($this->watchPaths as $path => $callback) {
$currentFiles = $this->getFilesRecursively($path);
// 检测新文件或修改
foreach ($currentFiles as $file) {
$hash = md5_file($file);
if (!isset($files[$file]) || $files[$file] != $hash) {
// 文件被修改或新增
$files[$file] = $hash;
$this->triggerAlert($callback, $file);
}
}
// 检测删除的文件
foreach ($files as $file => $hash) {
if (!file_exists($file)) {
unset($files[$file]);
$this->triggerAlert($callback, $file, 'deleted');
}
}
}
sleep(5); // 5秒检查一次
}
}
private function triggerAlert($callback, $file, $action = 'modified') {
if (is_callable($callback)) {
call_user_func($callback, $file, $action);
}
}
private function getFilesRecursively($dir) {
$files = [];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir)
);
foreach ($iterator as $file) {
if ($file->isFile()) {
$files[] = $file->getPathname();
}
}
return $files;
}
}
实用建议
特征库更新
// 定期更新特征库
public function updateSignatures($url) {
$signatures = file_get_contents($url);
file_put_contents('signatures.json', $signatures);
}
性能优化
// 分批处理大目录
public function scanLargeDirectory($dir, $batchSize = 100) {
$files = glob($dir . '/*');
$batches = array_chunk($files, $batchSize);
foreach ($batches as $batch) {
// 每批处理，避免内存溢出
foreach ($batch as $file) {
$this->scanFile($file);
}
gc_collect_cycles(); // 释放内存
}
}
注意事项：
- 定期更新病毒特征库
- 结合人工审核不能完全依赖自动化
- 备份重要文件
- 使用白名单机制减少误报
这些代码可以构建一个基础的病毒扫描系统,实际部署时建议加入更多检测规则和AI分析功能。
