cc global antivirus

-- Good AV+
-- 2023 No Rights Reserved
-- Please Don't Copy
-- Version 1
--Made By A, https://www.youtube.com/channel/UCKzfoGetJvmkkBuY8xmJxdg, and hecker
local safe = shell.getRunningProgram() -- av will delete itself because it detects the patterns listed within itself.
local detectedPatternsString = ""

local maliciousPatterns = {
    "%(shell%.getRunningProgram%(%), \"r\"%)",
    "payload",
    "os%.pullEvent = os%.pullEventRaw",
    "in ipairs%(fs%.list%(directory%)%)",
    "[%a_][%w_]*:%s*byte%s*%(%s*%)%s*%+.-%%.-",
    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890",
    'fs.open("startup", "w")',
    "fs.open('startup', 'w')",
    "shell.setAlias%("
}
local maliciousPatternsExplain = {
    "Self-Replicating ",
    "Interfering ",
    "Cannot Be Terminated ",
    "Scanning for files ",
    "Encryption ",
    "Suspicious Activity ",
    "Suspicious Activity ",
    "Suspicious Activity ",
    "Changing Aliases "
}

local function typeofInfection(detectedPatterns)

    for _, pattern in ipairs(detectedPatterns) do
        if pattern == "Self-Replicating " then
            selfReplicating = true
        elseif pattern == "Scanning for files " then
            scanningForFiles = true
        elseif pattern == "Cannot Be Terminated " then
            cannotBeTerminated = true
        elseif pattern == "Interfering " then
            interfering = true
        elseif pattern == "Encryption " then
            Encryption = true
        elseif pattern == "Suspicious Activity  " then
            SuspiciousActivity = true
        elseif pattern == "Changing Aliases " then
            interfering = true
            nolua = true
        end
    end
    local endType = "Unknown"

    if selfReplicating and scanningForFiles then
        endType = "Quill"
        if nolua then endType = "Quill(Evading)" end
    elseif selfReplicating and interfering then
        endType = "Quill"
        if nolua then endType = "Quill(Evading)" end
    elseif cannotBeTerminated and interfering then
        endType = "Malware"
    elseif scanningForFiles then
        endType = "Spyware"
    elseif Encryption and cannotBeTerminated then
        endType = "Ransomware"
    elseif interfering and nolua then
        endType = "Ransomware"
    elseif selfReplicating and nolua then
        endType = "Quill(Evading)"
    elseif nolua then
        endType = "Malware"
    end

    return endType
end


local function isMalicious(contents)
    local matches = 0  -- Initialize a counter for matches
    local detectedPatterns = {} -- Initialize a table to store detected patterns

    for i, pattern in ipairs(maliciousPatterns) do
        if contents:find(pattern) then
            matches = matches + 1  -- Increment the counter for each match
            table.insert(detectedPatterns, maliciousPatternsExplain[i])  -- Add the explanation to the table
        end
    end

    if matches >= 3 then
        return true, detectedPatterns  -- Return true if at least three matches are found
    end

    return false, detectedPatterns
end

local function scanAndRemove(directory)
    for _, file in ipairs(fs.list(directory)) do
        local fullPath = fs.combine(directory, file)
        if not fs.isDir(fullPath) then
            local handle = fs.open(fullPath, "r")
            if handle then
                local contents = handle.readAll()
                handle.close()
                local isMal, patterns = isMalicious(contents)
                if isMal then
                    if fullPath ~= safe then  -- Check if the file is not the safe program
                        fs.delete(fullPath)
                        local fileName = fs.getName(fullPath)
                        print("Removed malicious file: " .. fileName)
                        print("Family Type: "..typeofInfection(patterns))
                        detectedPatternsString = detectedPatternsString .. "---=File Detected=---\n"
                        detectedPatternsString = detectedPatternsString .. "Removed malicious file: " .. fileName
                        detectedPatternsString = detectedPatternsString .. "\nFamily Type: "..typeofInfection(patterns)
                        if #patterns > 0 then
                            print("Detected Patterns:")
                            for _, pattern in ipairs(patterns) do
                                print("- " .. pattern)
                            end
                            detectedPatternsString = detectedPatternsString .. "\nDetected Patterns:\n"
                            detectedPatternsString = detectedPatternsString .. table.concat(patterns, "\n")
                            file = fs.open(".avlog", "w")
                            file.write(detectedPatternsString)
                            file.close()
                        end
                    end
                end
            end
        else
            if not fullPath:sub(1, 4) == "rom/" then
                scanAndRemove(fullPath)
            end
        end
    end
end

-- Start scanning from the current directory
local currentDir = ""
scanAndRemove(currentDir)
print("All files logged into .avlog, use `edit .avlog` to see the full log.")