c# 可疑文件扫描代码(找到木马),需要的朋友可以参考下。
	

		 
	

		using System; 
	

		using System.IO; 
	

		using System.Text.RegularExpressions; 
	

		using System.Threading; 
	

		using System.Windows.Forms; 
	

		using System.Net; 
	

		namespace TrojanScanning 
	

		{ 
	

		public partial class Form1 : Form 
	

		{ 
	

		public Form1() 
	

		{ 
	

		InitializeComponent(); 
	

		} 
	

		delegate void SetTextCallback(string text); 
	

		delegate void SetTextCallback2(bool b); 
	

		delegate void SetTextCallback3(ListViewItem item); 
	

		private string fname, code; 
	

		private Thread thr; 
	

		private string[] sArray; 
	

		private void button1_Click(object sender, EventArgs e) 
	

		{ 
	

		if (folderBrowserDialog1.ShowDialog() == DialogResult.OK) 
	

		{ 
	

		scanpath.Text = folderBrowserDialog1.SelectedPath; 
	

		} 
	

		} 
	

		private void startbtn_Click(object sender, EventArgs e) 
	

		{ 
	

		list.Items.Clear(); 
	

		fname = scanpath.Text; 
	

		thr = new Thread(new ThreadStart(scan)); 
	

		thr.IsBackground = true; 
	

		thr.Start(); 
	

		} 
	

		private void scan(){ 
	

		FileSystemInfo s = GetFileSystemInfo(fname); 
	

		if (s != null) { scanbtn(false); ListFiles(s); scantext("扫描完成"); scanbtn(true); } else { MessageBox.Show("请先选择要扫描的目录"); } 
	

		} 
	

		public FileSystemInfo GetFileSystemInfo(string path){ 
	

		if (File.Exists(path)) 
	

		return new FileInfo(path); 
	

		else if (Directory.Exists(path)) 
	

		return new DirectoryInfo(path); 
	

		else 
	

		return null; 
	

		} 
	

		 
	

		private void ListFiles(FileSystemInfo info){ 
	

		if (info.Exists){ 
	

		DirectoryInfo dir = info as DirectoryInfo; 
	

		if (dir == null) return; 
	

		try{ 
	

		FileSystemInfo[] files = dir.GetFileSystemInfos(); 
	

		for (int i = 0; i < files.Length; i++){ 
	

		FileInfo file = files[i] as FileInfo; 
	

		if (file != null && (file.Extension.ToLower() == ".asp" || file.Extension.ToLower() == ".php" || file.Extension.ToLower() == ".aspx" || file.Extension.ToLower() == ".master")) 
	

		{ 
	

		scantext("扫描 " + file.FullName); 
	

		chkfile(file.FullName,file.Length); 
	

		}else{ 
	

		ListFiles(files[i]); 
	

		} 
	

		} 
	

		} 
	

		catch{} 
	

		} 
	

		} 
	

		private void chkfile(string filepath,long filesize) 
	

		{ 
	

		try{ 
	

		if (IsFileInUse(filepath)) { System.Threading.Thread.Sleep(2000); chkfile(filepath,filesize); } 
	

		StreamReader sr = new StreamReader(filepath); 
	

		string content = sr.ReadToEnd(); 
	

		sr.Close(); 
	

		string chkr=chkcontent(content); 
	

		if (chkr!=""){ 
	

		ListViewItem item = new ListViewItem("可疑"); 
	

		item.SubItems.Add(File.GetLastAccessTime(filepath).ToString()); 
	

		item.SubItems.Add(chkr); 
	

		item.SubItems.Add(filepath); 
	

		item.SubItems.Add((filesize/1024).ToString() + " kb"); 
	

		addtiem(item); 
	

		} 
	

		} 
	

		catch { } 
	

		} 
	

		private string downurl(string url) 
	

		{ 
	

		WebClient client = new WebClient(); 
	

		string result = client.DownloadString(url); 
	

		return result; 
	

		} 
	

		private void addtiem(ListViewItem item) 
	

		{ 
	

		if (this.list.InvokeRequired){ 
	

		SetTextCallback3 d = new SetTextCallback3(addtiem); 
	

		this.Invoke(d, new object[] { item }); 
	

		}else{ 
	

		this.list.Items.Add(item); 
	

		} 
	

		} 
	

		private void scantext(string text) 
	

		{ 
	

		if (this.scanstate.InvokeRequired) 
	

		{ 
	

		SetTextCallback d = new SetTextCallback(scantext); 
	

		this.Invoke(d, new object[] { text }); 
	

		}else{ 
	

		this.scanstate.Text=text; 
	

		} 
	

		} 
	

		private void scanbtn(bool b){ 
	

		if (this.startbtn.InvokeRequired){ 
	

		SetTextCallback2 d = new SetTextCallback2(scanbtn); 
	

		this.Invoke(d, new object[] { b }); 
	

		}else{ 
	

		this.startbtn.Enabled = b; 
	

		this.scanpath.Enabled = b; 
	

		this.button1.Enabled = b; 
	

		} 
	

		} 
	

		private string chkcontent(string content){ 
	

		string returnval = ""; 
	

		content = content.ToLower(); 
	

		foreach (string i in sArray) 
	

		{ 
	

		if (content.IndexOf(i)> -1){ returnval+=i+","; } 
	

		} 
	

		if (returnval != "") { returnval=returnval.Substring(0, returnval.Length - 1); } 
	

		return returnval; 
	

		} 
	

		bool IsFileInUse(string fileName) 
	

		{ 
	

		bool inUse = true; 
	

		if (File.Exists(fileName)) 
	

		{ 
	

		FileStream fs = null; 
	

		try { fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.None); inUse = false; } 
	

		catch { } 
	

		finally { if (fs != null)fs.Close(); } 
	

		return inUse; 
	

		} 
	

		else { return false; } 
	

		} 
	

		private void Form1_Load(object sender, EventArgs e) 
	

		{ 
	

		try{ 
	

		code = downurl("http://www.cqeh.com/txt/trojan.txt"); 
	

		sArray = code.ToLower().Split('|'); 
	

		} 
	

		catch (Exception ex) 
	

		{ 
	

		MessageBox.Show("错误：" + ex.Message, "无法启动程序!", MessageBoxButtons.OK); Application.Exit(); 
	

		} 
	

		} 
	

		private void list_DoubleClick(object sender, EventArgs e) 
	

		{ 
	

		System.Diagnostics.Process.Start("NOTEPAD.EXE", list.SelectedItems[0].SubItems[3].Text); 
	

		} 
	

		} 
	

		}