Пример #1
0
 def scanFile(self, fileName):
     ''' 扫描单个文件 '''
     result = {}
     os.chdir("C:/Program Files/Microsoft Security Client/Antimalware")
     cmd = "MpCmdRun -scan -scantype 3 -SignatureUpdate -UNC -trace -Grouping 0x1 -file %s"%fileName
     datetime = time.strftime('%Y-%m-%d %H:%M:%S')
     begin = time.strftime('%m/%d/%y,%I:%M:%S%p')
     fileSize = os.path.getsize(fileName)
     baseName = os.path.basename(fileName)
     (cmdResult, filemsg) = Commandutils.getstatusoutput(cmd)
     lines = filemsg.split('\n')
     flag = lines[2].split()[-2]
     if flag == 'no':
         return result
     print flag
     #开始获得waring event
     end = time.strftime('%m/%d/%y,%I:%M:%S%p')
     sr = self.scanResult(begin, end, baseName)
     loopStep = 5
     sr = self.loopScan(sr, begin, loopStep, baseName)
     if sr:
         endTime = time.strftime('%Y-%m-%d %H:%M:%S')
         result['filename'] = fileName
         result['baseName'] = baseName
         result['fileSize'] = fileSize
         result['begintime'] = datetime
         result['endtime'] = endTime
         result['usetime'] = int(time.mktime(time.strptime(endTime,'%Y-%m-%d %H:%M:%S')) 
                                 - time.mktime(time.strptime(datetime,'%Y-%m-%d %H:%M:%S')))
         result['virusdata'] = sr
     return result
Пример #2
0
 def scanResult(self, begin, end, baseName):
     '''02/24/12,03:51:00PM'''
     cmd = "eventquery /fi \"Datetime ge %s\" /fi \"Datetime lt %s\" /l system /fi \"Type eq Warning\" /v"%(begin, end)
     print cmd
     (cmdResult, filemsg) = Commandutils.getstatusoutput(cmd)
     msgs = filemsg.split('\n')
     count = len(msgs)
     result = []
     if count > 5:
         for msg in msgs[6:]:
             print msg
             attrs = msg.split('\t')
             if len(attrs) != 13:
                 continue
             name = attrs[1].split('  ')[1]
             level = attrs[3].split('  ')[1]
             type = attrs[4].split('  ')[1]
             path = attrs[5].split('  ')[1]
             if path.find(baseName) == -1:
                 continue
             resultDct = {'name':name, 'level':level, 'type':type, 'path':path}
             result.append(resultDct)
     return result