欢迎光临
我们一直在努力

手机安全自检工具

人机协作,AI模型:Deepseek

仅供参考

工具介绍

本工具涵盖8大类恶意软件的症状检测:蠕虫、特洛伊木马、间谍软件、流氓软件、挖矿软件、后门软件、僵尸软件、勒索软件。检测内容包括页面重定向、可疑脚本、密码表单外发、敏感权限授权、虚假警告关键词、帧率降频、隐藏iframe、网络请求数量、加密货币地址、存储使用率等。所有检测均在浏览器本地完成,不上传任何数据。

限制说明

浏览器运行在沙盒环境中,存在以下限制:无法获取真实CPU温度、系统进程列表、注册表信息;发热检测基于帧率间接推断,不等于真实温度;流量检测仅识别网络类型,无法获取已用流量;存储检测为浏览器存储使用量,不是手机系统存储;无法检测其他应用的行为和权限。

注意事项

本工具不能替代专业安全软件,检测结果仅供参考。勒索软件症状出现时切勿支付赎金,立即断开网络。部分检测需要浏览器支持Permissions API、Storage API等现代Web标准,建议使用Chrome/Edge/Safari最新版本。如发现可疑症状,建议使用专业安全软件进行全盘扫描。

<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
<title>恶意软件症状检测工具</title>
<style>
* { box-sizing: border-box; }
body {
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);
margin: 0;
padding: 16px;
min-height: 100vh;
color: #eee;
}
.container { max-width: 600px; margin: 0 auto; }
h1 { font-size: 1.3rem; margin-bottom: 8px; color: #00d4ff; text-align: center; }
.subtitle { text-align: center; font-size: 0.7rem; color: #aaa; margin-bottom: 20px; }
.card {
background: rgba(255,255,255,0.1);
backdrop-filter: blur(10px);
border-radius: 16px;
padding: 16px;
margin-bottom: 16px;
border: 1px solid rgba(255,255,255,0.2);
}
.card-title { font-size: 1rem; font-weight: bold; margin-bottom: 8px; color: #ffd966; display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
.standard { font-size: 0.65rem; color: #aaa; background: rgba(0,0,0,0.4); padding: 6px; border-radius: 6px; margin: 5px 0; }
.result-item { font-size: 0.85rem; padding: 8px; border-radius: 8px; margin-top: 8px; }
.safe { background: rgba(46,125,50,0.3); border-left: 4px solid #4caf50; color: #a5d6a7; }
.suspicious { background: rgba(211,47,47,0.3); border-left: 4px solid #f44336; color: #ffcdd2; }
.info { background: rgba(33,150,243,0.3); border-left: 4px solid #2196f3; color: #bbdef5; }
.badge { display: inline-block; background: #f44336; color: white; font-size: 0.65rem; padding: 2px 6px; border-radius: 10px; margin-left: 8px; }
.summary { background: rgba(0,0,0,0.5); border-radius: 16px; padding: 16px; margin-top: 20px; }
.detail-item { background: rgba(0,0,0,0.3); border-radius: 12px; padding: 12px; margin-bottom: 12px; }
.detail-type { color: #ffd966; font-weight: bold; font-size: 0.9rem; }
.detail-reason { color: #ff9800; font-size: 0.75rem; margin: 6px 0; }
.detail-suggestion { color: #4caf50; font-size: 0.75rem; margin-top: 6px; padding-top: 6px; border-top: 1px solid rgba(255,255,255,0.1); }
.detail-location { color: #888; font-size: 0.65rem; margin-top: 4px; padding-top: 2px; border-top: 1px solid rgba(255,255,255,0.05); }
button {
background: #00d4ff; color: #1a1a2e; border: none; padding: 12px 24px;
border-radius: 30px; font-size: 1rem; font-weight: bold; width: 100%;
cursor: pointer; margin-top: 10px; transition: transform 0.2s;
}
button:active { transform: scale(0.98); }
button:disabled { opacity: 0.6; cursor: not-allowed; }
.footer { text-align: center; font-size: 0.65rem; color: #666; margin-top: 24px; }
.loading { display: inline-block; width: 20px; height: 20px; border: 2px solid #fff; border-radius: 50%; border-top-color: transparent; animation: spin 1s linear infinite; }
@keyframes spin { to { transform: rotate(360deg); } }
.hidden { display: none; }
.check-item { margin-bottom: 12px; padding: 10px; background: rgba(0,0,0,0.2); border-radius: 8px; }
.check-title { font-weight: bold; margin-bottom: 5px; font-size: 0.85rem; }
.check-status { font-size: 0.75rem; margin-top: 5px; word-break: break-all; }
.progress-text { text-align: center; color: #00d4ff; margin: 16px 0; font-size: 0.85rem; }
.type-tag { display: inline-block; background: rgba(0,0,0,0.5); padding: 2px 8px; border-radius: 12px; font-size: 0.6rem; margin-left: 8px; }
.intro { font-size: 0.85rem; line-height: 1.6; color: #ddd; }
</style>
</head>
<body>
<div class="container">
<h1>🛡️ 恶意软件症状检测工具</h1>
<div class="subtitle">蠕虫 | 木马 | 间谍 | 流氓 | 挖矿 | 后门 | 僵尸 | 勒索</div>

<div class="card" style="margin-bottom: 20px;">
<div class="card-title">📖 工具介绍</div>
<div class="intro">
<p><strong>🔍 功能点</strong><br>本工具涵盖8大类恶意软件的症状检测:蠕虫、特洛伊木马、间谍软件、流氓软件、挖矿软件、后门软件、僵尸软件、勒索软件。所有检测均在浏览器本地完成,不上传任何数据。</p>
<p><strong>⚠️ 限制说明</strong><br>浏览器运行在沙盒环境中:无法获取真实CPU温度、系统进程列表、注册表信息;发热检测基于帧率间接推断;流量检测仅识别网络类型;存储检测为浏览器存储使用量。</p>
<p><strong>📌 注意事项</strong><br>本工具不能替代专业安全软件,检测结果仅供参考。勒索软件症状出现时切勿支付赎金,立即断开网络。</p>
</div>
</div>

<button id="scanBtn">🔍 开始检测</button>

<div id="progressArea" style="display:none;">
<div class="card">
<div class="card-title">🔄 检测中</div>
<div id="progressText" class="progress-text">正在初始化…</div>
<div style="text-align:center;"><span class="loading"></span></div>
</div>
</div>

<div id="results"></div>

<div class="footer">检测结果仅供参考,建议结合专业安全软件使用。</div>
</div>

<script>
var scanBtn = document.getElementById('scanBtn');
var progressArea = document.getElementById('progressArea');
var progressText = document.getElementById('progressText');
var resultsDiv = document.getElementById('results');

var allResults = [];
var suspiciousItems = [];
var scanInProgress = false;

function showProgress() { progressArea.style.display = 'block'; resultsDiv.innerHTML = ''; }
function hideProgress() { progressArea.style.display = 'none'; }
function updateProgress(msg) { if (progressText) progressText.innerText = msg; }

function addResult(checkName, malwareType, status, reason, detail, suggestion, standard, location) {
allResults.push({ name: checkName, type: malwareType, status: status, reason: reason, detail: detail, suggestion: suggestion, standard: standard, location: location });
if (status === 'suspicious') {
suspiciousItems.push({ name: checkName, type: malwareType, reason: reason, detail: detail, suggestion: suggestion, standard: standard, location: location });
}
}

function getDevicePerformance() {
var cores = navigator.hardwareConcurrency || 2;
if (cores >= 8) return 'high';
if (cores >= 4) return 'medium';
return 'low';
}

function extractFilePath(url) {
if (!url) return "";
try {
var urlObj = new URL(url, window.location.href);
return urlObj.pathname + (urlObj.search || "") + (urlObj.hash || "");
} catch(e) {
return "";
}
}

// 修正检测时间为本地时间(解决UTC+8时区问题)
function getCurrentTimestamp() {
var now = new Date();
var year = now.getFullYear();
var month = String(now.getMonth() + 1).padStart(2, '0');
var day = String(now.getDate()).padStart(2, '0');
var hours = String(now.getHours()).padStart(2, '0');
var minutes = String(now.getMinutes()).padStart(2, '0');
var seconds = String(now.getSeconds()).padStart(2, '0');
return year + '-' + month + '-' + day + ' ' + hours + ':' + minutes + ':' + seconds;
}

// ==================== 1. 蠕虫检测 ====================
function checkWormFeatures(callback) {
updateProgress("正在检测蠕虫特征…");
var standard = "检测标准: 页面重定向>3次、可疑恶意域名跳转、短时meta刷新(<5秒)";

var redirectCount = 0;
var currentUrl = window.location.href;
var currentHost = window.location.hostname;
var currentPath = window.location.pathname;
var metaRefresh = document.querySelector('meta[http-equiv="refresh"]');
var isSuspiciousRefresh = false;
var refreshContent = "";
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();

if (metaRefresh) {
refreshContent = metaRefresh.getAttribute('content') || '';
var delayMatch = refreshContent.match(/^(\\d+)/);
var delay = delayMatch ? parseInt(delayMatch[1]) : 0;
if (delay < 5) {
isSuspiciousRefresh = true;
abnormalInfo.push("meta刷新标签: " + refreshContent);
abnormalInfo.push("刷新延迟: " + delay + "秒");
abnormalInfo.push("刷新目标: " + (refreshContent.match(/url=(.+)/i) ? refreshContent.match(/url=(.+)/i)[1] : "当前页面"));
}
}

if (performance && performance.getEntriesByType) {
var navEntries = performance.getEntriesByType('navigation');
if (navEntries.length > 0 && navEntries[0].redirectCount) {
redirectCount = navEntries[0].redirectCount;
if (redirectCount > 0) {
abnormalInfo.push("重定向次数: " + redirectCount);
if (navEntries[0].redirectStart && navEntries[0].redirectEnd) {
abnormalInfo.push("重定向耗时: " + Math.round(navEntries[0].redirectEnd – navEntries[0].redirectStart) + "ms");
}
}
}
}

var suspiciousDomains = ['hijack', 'redirect', 'exploit', 'malware', 'trojan', 'ransom', 'phish'];
var isSuspiciousDomain = false;
var matchedKeyword = "";
for (var i = 0; i < suspiciousDomains.length; i++) {
if (currentUrl.toLowerCase().indexOf(suspiciousDomains[i]) !== -1) {
isSuspiciousDomain = true;
matchedKeyword = suspiciousDomains[i];
break;
}
}

if (isSuspiciousDomain) {
abnormalInfo.push("URL包含可疑关键词: " + matchedKeyword);
abnormalInfo.push("完整URL: " + currentUrl);
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + currentHost + currentPath + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (redirectCount > 3 || isSuspiciousDomain || isSuspiciousRefresh) {
addResult("蠕虫特征检测", "蠕虫", "suspicious",
"检测到多次重定向或可疑刷新,蠕虫常通过漏洞利用传播",
"重定向次数:" + redirectCount + ", 可疑刷新:" + isSuspiciousRefresh,
"1.检查浏览器是否被劫持\\n2.清除缓存和Cookie\\n3.运行安全软件扫描",
standard, locationStr);
} else {
addResult("蠕虫特征检测", "蠕虫", "safe", "未发现蠕虫特征", "重定向:" + redirectCount, "无需处理", standard, "无异常");
}
callback();
}

// ==================== 2. 特洛伊木马检测 ====================
function checkTrojanFeatures(callback) {
updateProgress("正在检测特洛伊木马特征…");
var standard = "检测标准: 已知挖矿脚本、密码表单提交至外部域名(非本域)";

var scripts = document.getElementsByTagName('script');
var suspiciousScripts = [];
var maliciousPatterns = ['coinhive', 'cryptoloot', 'webminer', 'cryptonight', 'jsminer', 'coinimp'];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();
var currentHost = window.location.hostname;

for (var i = 0; i < scripts.length; i++) {
if (scripts[i].src) {
for (var j = 0; j < maliciousPatterns.length; j++) {
if (scripts[i].src.toLowerCase().indexOf(maliciousPatterns[j]) !== -1) {
suspiciousScripts.push(scripts[i].src);
abnormalInfo.push("恶意脚本URL: " + scripts[i].src);
abnormalInfo.push("脚本域名: " + (scripts[i].src.split('/')[2] || "未知"));
abnormalInfo.push("脚本路径: " + extractFilePath(scripts[i].src));
abnormalInfo.push("匹配模式: " + maliciousPatterns[j]);
break;
}
}
}
if (scripts[i].innerHTML && scripts[i].innerHTML.toLowerCase().indexOf('cryptonight') !== -1) {
abnormalInfo.push("内联脚本包含挖矿代码(cryptonight)");
abnormalInfo.push("脚本长度: " + scripts[i].innerHTML.length + "字符");
}
}

var forms = document.getElementsByTagName('form');
var passwordFields = document.querySelectorAll('input[type="password"]').length;
var externalActions = [];

for (var i = 0; i < forms.length; i++) {
var action = forms[i].action;
if (action && action !== '' && action.indexOf('javascript:') === -1 && action.indexOf('#') === -1) {
if (action.indexOf(currentHost) === -1 && action.indexOf('://') !== -1) {
externalActions.push(action);
abnormalInfo.push("表单提交目标: " + action);
abnormalInfo.push("提交目标域名: " + (action.split('/')[2] || "未知"));
abnormalInfo.push("包含密码框数量: " + passwordFields);
}
}
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (suspiciousScripts.length > 0) {
addResult("木马特征检测", "特洛伊木马", "suspicious",
"发现已知挖矿脚本,木马常通过恶意脚本窃取数据",
"可疑脚本:" + suspiciousScripts[0].substring(0, 80),
"1.关闭当前页面\\n2.安装广告拦截插件\\n3.避免在可疑页面输入密码",
standard, locationStr);
} else if (externalActions.length > 0 && passwordFields > 0) {
addResult("木马特征检测", "特洛伊木马", "suspicious",
"密码表单提交至外部域名,存在凭据窃取风险",
"外部目标:" + externalActions[0].substring(0, 60),
"1.确认网站域名是否正确\\n2.检查SSL证书\\n3.不要输入真实密码",
standard, locationStr);
} else {
addResult("木马特征检测", "特洛伊木马", "safe", "未发现木马特征", "密码框:" + passwordFields, "无需处理", standard, "无异常");
}
callback();
}

// ==================== 3. 间谍软件检测 ====================
function checkSpywareFeatures(callback) {
updateProgress("正在检测间谍软件特征…");
var standard = "检测标准: 敏感权限(位置/相机/麦克风)授权数量≥2";

var granted = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();

function checkPerm(name, label, cb) {
try {
navigator.permissions.query({ name: name }).then(function(s) {
if (s.state === 'granted') {
granted.push(label);
abnormalInfo.push("已授权权限: " + label);
abnormalInfo.push("权限状态: " + s.state);
}
cb();
}).catch(function() { cb(); });
} catch(e) { cb(); }
}

var pending = 3;
checkPerm('geolocation', '位置', function() { pending–; if(pending===0) done(); });
checkPerm('camera', '相机', function() { pending–; if(pending===0) done(); });
checkPerm('microphone', '麦克风', function() { pending–; if(pending===0) done(); });

function done() {
var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "无敏感权限授权");

if (granted.length >= 2) {
addResult("间谍软件检测", "间谍软件", "suspicious",
"已授予多个敏感权限,间谍软件可监控用户",
"已授权:" + granted.join(','),
"1.检查网站权限\\n2.撤销非必要权限\\n3.清除网站数据",
standard, locationStr);
} else {
addResult("间谍软件检测", "间谍软件", "safe", "未发现间谍特征", "权限:" + (granted.length||'无'), "无需处理", standard, "无异常");
}
callback();
}
}

// ==================== 4. 流氓软件检测 ====================
function checkRogueSoftware(callback) {
updateProgress("正在检测流氓软件特征…");
var standard = "检测标准: 虚假警告关键词>2个、浏览器劫持域名";

var fakeKeywords = ['病毒','木马','感染','危险','警告','立即清理','系统损坏',
'virus','infected','danger','warning','security alert',
'xp antivirus','winfixer','protection required','spyware detected',
'malware found','registry error','driver outdated'];
var pageText = document.body.innerText.toLowerCase();
var found = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();
var currentUrl = window.location.href;
var currentHost = window.location.hostname;

for (var i = 0; i < fakeKeywords.length; i++) {
if (pageText.indexOf(fakeKeywords[i].toLowerCase()) !== -1) {
found.push(fakeKeywords[i]);
abnormalInfo.push("虚假警告关键词: " + fakeKeywords[i]);
}
}

var hijackDomains = ['search.conduit', 'delta-homes', 'mysearch', 'trovi', 'babylon', 'websearch'];
var isHijacked = false;
var hijackedDomain = "";
for (var i = 0; i < hijackDomains.length; i++) {
if (currentUrl.indexOf(hijackDomains[i]) !== -1) {
isHijacked = true;
hijackedDomain = hijackDomains[i];
abnormalInfo.push("被劫持域名: " + hijackedDomain);
abnormalInfo.push("完整劫持URL: " + currentUrl);
break;
}
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + currentHost + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (found.length > 2) {
addResult("流氓软件检测", "流氓软件", "suspicious",
"页面包含虚假警告关键词,诱导用户付款",
"匹配:" + found.slice(0,3).join(','),
"1.不要点击弹窗\\n2.不要下载软件\\n3.关闭页面",
standard, locationStr);
} else if (isHijacked) {
addResult("流氓软件检测", "流氓软件", "suspicious",
"浏览器可能被劫持", "域名异常: " + currentUrl.substring(0, 80),
"1.检查主页设置\\n2.清除缓存\\n3.重置浏览器",
standard, locationStr);
} else {
addResult("流氓软件检测", "流氓软件", "safe", "未发现流氓特征", "无虚假关键词", "无需处理", standard, "无异常");
}
callback();
}

// ==================== 5. 挖矿软件检测 ====================
function checkMinerFeatures(callback) {
updateProgress("正在检测挖矿软件特征…");
var perf = getDevicePerformance();
var fpsThreshold = perf === 'high' ? 30 : (perf === 'medium' ? 25 : 20);
var standard = "检测标准: 帧率持续低于" + fpsThreshold + "fps且无用户交互、已知挖矿脚本";

var cores = navigator.hardwareConcurrency || 2;
var frameCount = 0;
var startTime = performance.now();
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();

var scripts = document.getElementsByTagName('script');
var hasMiner = false;
var minerDomains = ['coinhive', 'cryptoloot', 'webminer', 'cryptonight', 'coinimp', 'jsminer'];

for (var i = 0; i < scripts.length; i++) {
if (scripts[i].src) {
for (var j = 0; j < minerDomains.length; j++) {
if (scripts[i].src.toLowerCase().indexOf(minerDomains[j]) !== -1) {
hasMiner = true;
abnormalInfo.push("挖矿脚本URL: " + scripts[i].src);
abnormalInfo.push("脚本域名: " + (scripts[i].src.split('/')[2] || "未知"));
abnormalInfo.push("匹配模式: " + minerDomains[j]);
break;
}
}
}
if (scripts[i].innerHTML && scripts[i].innerHTML.toLowerCase().indexOf('cryptonight') !== -1) {
hasMiner = true;
abnormalInfo.push("内联脚本包含挖矿代码: cryptonight");
}
}

var lastInteraction = Date.now();
var interactionHandler = function() { lastInteraction = Date.now(); };
document.addEventListener('mousemove', interactionHandler);
document.addEventListener('scroll', interactionHandler);
document.addEventListener('click', interactionHandler);

function measure() {
frameCount++;
var now = performance.now();
var elapsed = now – startTime;
if (elapsed < 3000) {
requestAnimationFrame(measure);
} else {
document.removeEventListener('mousemove', interactionHandler);
document.removeEventListener('scroll', interactionHandler);
document.removeEventListener('click', interactionHandler);
var fps = Math.round(frameCount / (elapsed / 1000));
var timeSinceInteraction = (Date.now() – lastInteraction) / 1000;
var isInteracting = timeSinceInteraction < 2;
var isThrottled = fps < fpsThreshold;

if (isThrottled && !isInteracting && cores >= 4) {
abnormalInfo.push("当前帧率: " + fps + "fps");
abnormalInfo.push("帧率阈值: " + fpsThreshold + "fps");
abnormalInfo.push("CPU核心数: " + cores);
abnormalInfo.push("设备性能等级: " + perf);
abnormalInfo.push("用户交互状态: " + (isInteracting ? "有交互" : "无交互"));
abnormalInfo.push("采样时长: " + (elapsed/1000) + "秒");
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (hasMiner) {
addResult("挖矿软件检测", "挖矿软件", "suspicious",
"发现已知挖矿脚本,会占用CPU资源进行未授权挖矿",
"检测到挖矿脚本",
"1.关闭当前页面\\n2.安装NoCoin等拦截插件\\n3.避免访问可疑网站",
standard, locationStr);
} else if (isThrottled && !isInteracting && cores >= 4) {
addResult("挖矿软件检测", "挖矿软件", "suspicious",
"帧率持续偏低且无用户交互,可能因挖矿导致CPU高负载",
"帧率:" + fps + "fps, 阈值:" + fpsThreshold + ", CPU:" + cores + "核",
"1.检查设备是否发热\\n2.关闭未使用标签页\\n3.运行安全扫描",
standard, locationStr);
} else {
addResult("挖矿软件检测", "挖矿软件", "safe", "未发现挖矿特征", "帧率:" + fps + "fps", "无需处理", standard, "无异常");
}
callback();
}
}

requestAnimationFrame(measure);
}

// ==================== 6. 后门软件检测 ====================
function checkBackdoorFeatures(callback) {
updateProgress("正在检测后门软件特征…");
var standard = "检测标准: 隐藏iframe、动态代码执行(eval/new Function)";

var iframes = document.getElementsByTagName('iframe');
var hidden = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();

for (var i = 0; i < iframes.length; i++) {
var f = iframes[i];
var style = window.getComputedStyle(f);
if (style.display === 'none' || style.visibility === 'hidden' || f.width === '0' || f.height === '0') {
hidden.push(f);
abnormalInfo.push("隐藏iframe URL: " + (f.src || "无src属性"));
if (f.src) {
abnormalInfo.push("iframe域名: " + (f.src.split('/')[2] || "未知"));
abnormalInfo.push("iframe路径: " + extractFilePath(f.src));
}
abnormalInfo.push("隐藏方式: display=" + style.display + ", visibility=" + style.visibility +
", width=" + f.width + ", height=" + f.height);
}
}

var pageContent = document.documentElement.innerHTML;
var hasEval = pageContent.indexOf('eval(') !== -1 || pageContent.indexOf('eval (') !== -1;
var hasFunction = pageContent.indexOf('new Function') !== -1;

if (hasEval || hasFunction) {
abnormalInfo.push("动态代码执行: eval=" + hasEval + ", new Function=" + hasFunction);
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (hidden.length > 0) {
addResult("后门软件检测", "后门软件", "suspicious",
"发现隐藏iframe,后门常与C2服务器通信",
"隐藏iframe数:" + hidden.length,
"1.检查iframe来源\\n2.使用开发者工具查看网络请求\\n3.运行安全扫描",
standard, locationStr);
} else if (hasEval || hasFunction) {
addResult("后门软件检测", "后门软件", "info",
"检测到动态代码执行,可能用于恶意代码注入",
"eval:" + hasEval + ", new Function:" + hasFunction,
"1.检查页面来源是否可信\\n2.使用XSS检测工具",
standard, locationStr);
} else {
addResult("后门软件检测", "后门软件", "safe", "未发现后门特征", "无隐藏iframe", "无需处理", standard, "无异常");
}
callback();
}

// ==================== 7. 僵尸软件检测 ====================
function checkBotnetFeatures(callback) {
updateProgress("正在检测僵尸软件特征…");
var standard = "检测标准: 页面请求>150个或单一域名高频请求(>30次)";

var resourceCount = 0;
var domainCounts = {};
var requestDetails = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();

if (performance && performance.getEntriesByType) {
var resources = performance.getEntriesByType('resource');
resourceCount = resources.length;
for (var i = 0; i < resources.length; i++) {
try {
var domain = resources[i].name.split('/')[2];
if (domain) {
domainCounts[domain] = (domainCounts[domain] || 0) + 1;
if (domainCounts[domain] <= 3) {
requestDetails.push(resources[i].name.substring(0, 80));
}
}
} catch(e) {}
}
}

var highFreq = [];
for (var d in domainCounts) {
if (domainCounts[d] > 30) {
highFreq.push(d);
abnormalInfo.push("高频请求域名: " + d + " (" + domainCounts[d] + "次)");
}
}

abnormalInfo.push("总请求数: " + resourceCount);
abnormalInfo.push("请求域名数: " + Object.keys(domainCounts).length);
if (requestDetails.length > 0) {
abnormalInfo.push("部分请求示例: " + requestDetails.slice(0, 3).join(", "));
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (resourceCount > 150) {
addResult("僵尸软件检测", "僵尸软件", "suspicious",
"页面发起大量请求,可能参与DDoS攻击",
"请求数:" + resourceCount,
"1.检查异常外连\\n2.使用网络监控工具\\n3.运行安全扫描",
standard, locationStr);
} else if (highFreq.length > 0) {
addResult("僵尸软件检测", "僵尸软件", "suspicious",
"对单一域名大量请求,可能是DDoS攻击行为",
"高频域名:" + highFreq.slice(0,2).join(','),
"1.检查请求是否正常\\n2.使用广告拦截插件\\n3.关闭可疑页面",
standard, locationStr);
} else {
addResult("僵尸软件检测", "僵尸软件", "safe", "未发现僵尸特征", "请求数:" + resourceCount, "无需处理", standard, "无异常");
}
callback();
}

// ==================== 8. 勒索软件检测 ====================
function checkRansomwareFeatures(callback) {
updateProgress("正在检测勒索软件特征…");
var standard = "检测标准: 勒索关键词、加密货币地址(比特币/以太坊)";

var pageText = document.body.innerText.toLowerCase();
var keywords = ['encrypted', 'decrypt', 'bitcoin', 'ransom', 'wannacry', 'lockbit',
'文件被加密', '恢复文件', '赎金', 'your files are encrypted', 'pay the ransom',
'cryptocurrency', 'wallet address', 'monero', 'ethereum'];
var found = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();
var cryptoAddresses = [];

for (var i = 0; i < keywords.length; i++) {
if (pageText.indexOf(keywords[i].toLowerCase()) !== -1) {
found.push(keywords[i]);
abnormalInfo.push("勒索关键词: " + keywords[i]);
}
}

var btcPatterns = [
/(bc1|[13])[a-km-zA-HJ-NP-Z1-9]{25,59}/g,
/bitcoin:[13][a-km-zA-HJ-NP-Z1-9]{25,34}/gi
];
for (var i = 0; i < btcPatterns.length; i++) {
var btcMatch = pageText.match(btcPatterns[i]);
if (btcMatch) {
cryptoAddresses.push("比特币地址: " + btcMatch[0]);
abnormalInfo.push("比特币地址: " + btcMatch[0]);
}
}

var ethPattern = /0x[a-fA-F0-9]{40}/g;
var ethMatch = pageText.match(ethPattern);
if (ethMatch) {
cryptoAddresses.push("以太坊地址: " + ethMatch[0]);
abnormalInfo.push("以太坊地址: " + ethMatch[0]);
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if ((cryptoAddresses.length > 0) && found.length > 0) {
addResult("勒索软件检测", "勒索软件", "suspicious",
"页面包含加密货币地址和勒索关键词",
"匹配:" + found.slice(0,3).join(','),
"1.不要支付赎金!\\n2.立即断开网络\\n3.使用杀毒软件扫描",
standard, locationStr);
} else if (found.length > 3) {
addResult("勒索软件检测", "勒索软件", "suspicious",
"页面包含勒索软件相关关键词", "匹配:" + found.slice(0,3).join(','),
"1.不要支付赎金\\n2.立即断开网络连接\\n3.备份重要文件",
standard, locationStr);
} else {
addResult("勒索软件检测", "勒索软件", "safe", "未发现勒索特征", "无勒索关键词", "无需处理", standard, "无异常");
}
callback();
}

// ==================== 9. 存储异常检测 ====================
function checkStorageAnomaly(callback) {
updateProgress("正在检测存储异常…");
var standard = "检测标准: 存储使用率>80%或localStorage>5MB";

var timestamp = getCurrentTimestamp();
var abnormalInfo = [];

if ('storage' in navigator && 'estimate' in navigator.storage) {
navigator.storage.estimate().then(function(est) {
var usage = est.usage || 0;
var quota = est.quota || 0;
var percent = (usage / quota) * 100;
var usageMB = usage / 1024 / 1024;
var quotaMB = quota / 1024 / 1024;

abnormalInfo.push("总存储使用量: " + usageMB.toFixed(2) + "MB");
abnormalInfo.push("总存储配额: " + quotaMB.toFixed(2) + "MB");
abnormalInfo.push("使用率: " + percent.toFixed(1) + "%");

var lsSize = 0;
var largeKeys = [];
for (var i = 0; i < localStorage.length; i++) {
var key = localStorage.key(i);
var val = localStorage.getItem(key);
var itemSize = (key.length + (val ? val.length : 0)) * 2;
lsSize += itemSize;
if (itemSize > 1024 * 100) {
largeKeys.push({key: key, size: (itemSize/1024).toFixed(1) + "KB"});
}
}
var lsMB = lsSize / 1024 / 1024;
abnormalInfo.push("localStorage使用量: " + lsMB.toFixed(2) + "MB");

if (largeKeys.length > 0) {
abnormalInfo.push("大容量存储项: " + largeKeys.map(function(k) { return k.key + "(" + k.size + ")"; }).join(", "));
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + window.location.hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (percent > 80 || lsMB > 5) {
addResult("存储异常检测", "勒索软件", "suspicious",
"存储空间使用率异常,勒索软件常大量写入加密文件",
"使用率:" + percent.toFixed(1) + "%, localStorage:" + lsMB.toFixed(2) + "MB",
"1.清理浏览器缓存\\n2.检查是否有不明数据\\n3.清除网站数据",
standard, locationStr);
} else {
addResult("存储异常检测", "通用", "safe", "存储空间正常", "使用率:" + percent.toFixed(1) + "%", "无需处理", standard, "无异常");
}
callback();
}).catch(function() { callback(); });
} else {
addResult("存储异常检测", "通用", "info", "无法获取存储信息", "不支持Storage API", "请手动检查存储空间", standard, "检测时间: " + timestamp + " | 浏览器不支持Storage API");
callback();
}
}

// ==================== 10. 网络钓鱼检测 ====================
function checkPhishingFeatures(callback) {
updateProgress("正在检测网络钓鱼特征…");
var standard = "检测标准: 钓鱼关键词、URL长度>200、可疑子域名";

var pageText = document.body.innerText.toLowerCase();
var phishKeywords = ['verify your account', 'confirm your identity', 'account suspended',
'unusual activity', 'security alert', 'update your payment', 'login required'];
var found = [];
var abnormalInfo = [];
var timestamp = getCurrentTimestamp();
var currentUrl = window.location.href;
var hostname = window.location.hostname;
var subdomainCount = hostname.split('.').length;

for (var i = 0; i < phishKeywords.length; i++) {
if (pageText.indexOf(phishKeywords[i]) !== -1) {
found.push(phishKeywords[i]);
abnormalInfo.push("钓鱼关键词: " + phishKeywords[i]);
}
}

var urlLength = currentUrl.length;
if (urlLength > 200) {
abnormalInfo.push("URL长度异常: " + urlLength + "字符 (正常<200)");
}
abnormalInfo.push("URL长度: " + urlLength);
abnormalInfo.push("域名: " + hostname);
abnormalInfo.push("子域名层级: " + subdomainCount);

var suspiciousUrlPatterns = ['login', 'signin', 'verify', 'secure', 'update', 'confirm', 'authenticate'];
var matchedPatterns = [];
for (var i = 0; i < suspiciousUrlPatterns.length; i++) {
if (currentUrl.toLowerCase().indexOf(suspiciousUrlPatterns[i]) !== -1) {
matchedPatterns.push(suspiciousUrlPatterns[i]);
}
}
if (matchedPatterns.length > 0) {
abnormalInfo.push("URL匹配可疑模式: " + matchedPatterns.join(", "));
}

var phishingDomains = ['secure-', 'verify-', 'login-', 'account-', 'signin-'];
var matchedPhishDomain = [];
for (var i = 0; i < phishingDomains.length; i++) {
if (hostname.indexOf(phishingDomains[i]) !== -1) {
matchedPhishDomain.push(phishingDomains[i]);
}
}
if (matchedPhishDomain.length > 0) {
abnormalInfo.push("域名包含可疑前缀: " + matchedPhishDomain.join(", "));
}

var locationStr = "【检测时间】" + timestamp + "\\n" +
"【当前页面】" + hostname + window.location.pathname + "\\n" +
(abnormalInfo.length > 0 ? "【异常详情】" + abnormalInfo.join("\\n ") : "");

if (found.length > 0) {
addResult("网络钓鱼检测", "钓鱼网站", "suspicious",
"页面包含钓鱼关键词,可能是钓鱼网站",
"匹配:" + found.slice(0,2).join(','),
"1.确认网站域名是否正确\\n2.检查SSL证书\\n3.不要输入敏感信息\\n4.立即关闭页面",
standard, locationStr);
} else if ((urlLength > 200 && matchedPatterns.length > 0) || matchedPhishDomain.length > 0) {
addResult("网络钓鱼检测", "钓鱼网站", "info",
"URL结构异常,请注意甄别是否为钓鱼网站",
"URL长度:" + urlLength + ", 子域名数:" + subdomainCount,
"确认网站来源是否可信,避免输入敏感信息",
standard, locationStr);
} else {
addResult("网络钓鱼检测", "钓鱼网站", "safe", "未发现钓鱼特征", "无钓鱼关键词", "无需处理", standard, "无异常");
}
callback();
}

function renderResults() {
if (allResults.length === 0) {
resultsDiv.innerHTML = '<div class="card"><div class="card-title">✅ 检测完成</div><div class="result-item safe">未发现检测结果,请刷新重试。</div></div>';
return;
}

var html = '<div class="card"><div class="card-title">📋 检测项目明细</div>';
for (var i = 0; i < allResults.length; i++) {
var item = allResults[i];
var statusText = item.status === 'safe' ? '正常' : (item.status === 'suspicious' ? '可疑' : '信息');
var statusColor = item.status === 'suspicious' ? '#f44336' : (item.status === 'safe' ? '#4caf50' : '#2196f3');
var statusIcon = item.status === 'safe' ? '✅' : (item.status === 'suspicious' ? '⚠️' : 'ℹ️');

html += '<div class="check-item">';
html += '<div class="check-title">' + statusIcon + ' ' + item.name + ' <span class="type-tag">' + item.type + '</span> <span style="color:' + statusColor + '">[' + statusText + ']</span></div>';
html += '<div class="standard">' + item.standard + '</div>';
html += '<div class="check-status"><strong>原因:</strong>' + item.reason + '</div>';
html += '<div class="check-status"><strong>详情:</strong>' + item.detail + '</div>';
html += '<div class="check-status"><strong>建议:</strong>' + item.suggestion + '</div>';
if (item.location && item.location !== "无异常") {
html += '<div class="detail-location"><strong>⚠️ 异常位置:</strong><br>' + item.location.replace(/\\n/g, '<br>') + '</div>';
}
html += '</div>';
}
html += '</div>';

if (suspiciousItems.length > 0) {
html += '<div class="summary"><div class="card-title">⚠️ 发现可疑症状 <span class="badge">' + suspiciousItems.length + '项</span></div>';
for (var i = 0; i < suspiciousItems.length; i++) {
var item = suspiciousItems[i];
html += '<div class="detail-item">';
html += '<div class="detail-type">' + (i+1) + '. ' + item.name + ' [' + item.type + ']</div>';
html += '<div class="detail-reason">📌 原因: ' + item.reason + '</div>';
html += '<div class="detail-suggestion">💡 建议: ' + item.suggestion + '</div>';
html += '<div style="font-size:0.65rem; color:#888;">🔍 详情: ' + item.detail + '</div>';
if (item.location && item.location !== "无异常") {
html += '<div class="detail-location" style="margin-top:4px;">⚠️ 异常位置:<br>' + item.location.replace(/\\n/g, '<br>') + '</div>';
}
html += '</div>';
}
html += '<div class="card" style="margin-top:16px; background:rgba(244,67,54,0.2);">';
html += '<div class="card-title">🛡️ 总结建议</div>';
html += '<div>检测到 ' + suspiciousItems.length + ' 个可疑行为,建议使用专业安全软件进行全盘扫描。</div>';
html += '</div></div>';
} else {
html += '<div class="card" style="border-color: #4caf50; margin-top:16px;">';
html += '<div class="card-title">✅ 检测完成</div>';
html += '<div class="result-item safe">未发现明显异常症状,建议定期扫描。</div>';
html += '</div>';
}

resultsDiv.innerHTML = html;
}

function startScan() {
if (scanInProgress) return;
scanInProgress = true;
allResults = [];
suspiciousItems = [];

scanBtn.disabled = true;
scanBtn.innerText = '⏳ 检测中…';
showProgress();

var steps = [checkWormFeatures, checkTrojanFeatures, checkSpywareFeatures,
checkRogueSoftware, checkMinerFeatures, checkBackdoorFeatures,
checkBotnetFeatures, checkRansomwareFeatures, checkStorageAnomaly,
checkPhishingFeatures];
var idx = 0;

function next() {
if (idx >= steps.length) {
hideProgress();
renderResults();
scanInProgress = false;
scanBtn.disabled = false;
scanBtn.innerText = '🔍 开始检测';
return;
}
steps[idx++](next);
}
next();
}

scanBtn.onclick = function(e) { e.preventDefault(); startScan(); };
window.onload = function() { setTimeout(startScan, 200); };
</script>
</body>
</html>

赞(0)
未经允许不得转载:171主机测评 » 手机安全自检工具
分享到: 更多 (0)

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址