<?php
$level=5;
function get_sorted($path)
{
//$ignore = array('.',"'","error_log");
$dh = @opendir( $path );
while ($file = @readdir( $dh ))
{
if (!strstr($file,'.')&&!strstr($file,"'")&&!strstr($file,"error_log")&&!strstr($file,"README")&&!strstr($file,"cookietxt")&&$file!='.'&&$file!='..')
{
$directories[] = $file;
}
else
{
if ($file!='.'&&$file!='..')
{
$files[] = $file;
}
}
}
$array = array($directories,$files);
return $array;
}
function clean_files($files, $path)
{
//echo 1;exit;
if ($files)
{
foreach($files as $key=>$val)
{
//echo $val;
if ($val == 'index.php')
{
//echo 1; exit;
//fopen .htacess
$targetFile = "$path/$val";
echo "Checking: $targetFile <br>";
$handle1 = fopen($targetFile, 'r');
$data = @fread($handle1,filesize($targetFile));
fclose($handle1);
$string = preg_match('/eval.base64_decode(.*?)\;/', $data, $matches );
$string = $matches[0];
if ($string)
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
$data = str_replace($string,'', $data);
$handle1 = fopen($targetFile, 'w');
fwrite($handle1, $data);
fclose($handle1);
//exit;
}
unset($string);
unset($data);
}
else if (strstr($val,'htaccess'))
{
//echo 1; exit;
//fopen .htacess
$targetFile = "$path/$val";
echo "Checking: $targetFile <br>";
$handle1 = fopen($targetFile, 'r');
$data = @fread($handle1,filesize($targetFile));
fclose($handle1);
}
else if (strstr($val,'wp-config.php'))
{
//echo 1; exit;
//fopen .htacess
$targetFile = "$path/$val";
echo "Checking: $targetFile <br>";
$handle1 = fopen($targetFile, 'r');
$data = @fread($handle1,filesize($targetFile));
fclose($handle1);
if (strstr($data,'get_userdatabylogin'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
mail("[email protected]","WP-Config FILE CORRUPTED! MANUAL EDIT REQUIRED ","SEE $targetFile");
}
unset($string);
unset($data);
}
else if (strstr($val,'wp-settings.php'))
{
//echo 1; exit;
//fopen .htacess
$targetFile = "$path/$val";
echo "Checking: $targetFile <br>";
$handle1 = fopen($targetFile, 'r');
$data = @fread($handle1,filesize($targetFile));
fclose($handle1);
if (strstr($data,'google_bot'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
mail("[email protected]","WP-Config FILE CORRUPTED! MANUAL EDIT REQUIRED ","SEE $targetFile");
}
unset($string);
unset($data);
}
else if (strstr($val,'thumbs.db'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","THMBS.DB FILE FOUND! ","SEE $targetFile");
}
else if (strstr($val,'feed_file.php'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-admin/js/config.php'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-admin/common.php'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'udp.php'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'feed-files.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'feed-file.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-content/uploads/r1.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-content/uploads/r2.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-content/uploads/lib.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-content/uploads/am3.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'/wp-content/uploads/create.php'))
{
echo "UDP MANUAL DELETE! MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
mail("[email protected]","MALWARE FILE FOUND! ","SEE $targetFile");
}
Else if (strstr($targetFile,'timthumb.php'))
{
echo "MALWARE FOUND IN $targetFile ! ... rewriting!<br>";
unlink($targetFile);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://timthumb.googlecode.com/svn/trunk/timthumb.php");
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
$data = curl_exec($ch);
curl_close($ch);
$handle1 = fopen($targetFile, 'w');
fwrite($handle1, $data);
fclose($handle1);
}
}
}
else
{
echo "<br>No files discovered in $path<br>";
}
}
//clean first level
$array = get_sorted('.');
$directories = $array[0];
$files = $array[1];
clean_files($files,'.');
//get second level & clean
foreach ($directories as $key=>$val)
{
$p_1 = "./$val";
$a_1 = get_sorted($val);
$d_1 = $a_1[0];
$f_1 = $a_1[1];
//echo $val;
//print_r($d_1);
//echo "<hr>";
clean_files($f_1, "{$p_1}");
//check and clean level 2
if ($d_1)
{
foreach ($d_1 as $k_1=>$v_1)
{
//echo $v_1;exit;
$p_2 = $p_1.'/'.$v_1;
$a_2 = get_sorted($p_2);
$d_2 = $a_2[0];
$f_2 = $a_2[1];
clean_files($f_2, $p_2);
if ($d_2)
{
//check and clean level 3
foreach ($d_2 as $k_2=>$v_2)
{
$p_3 = $p_2.'/'.$v_2;
//echo $p_3;
$a_3 = get_sorted($p_3);
$d_3 = $a_3[0];
$f_3 = $a_3[1];
//echo"<hr>$v_2";
//print_r($f_3);exit;
clean_files($f_3, $p_3);
//unset($
}
//check and clean level 4
if ($d_3)
{
foreach ($d_3 as $k_3=>$v_3)
{
$p_4 = $p_3.'/'.$v_3;
$a_4 = get_sorted($p_4);
$d_4 = $a_4[0];
$f_4 = $a_4[1];
clean_files($f_4, $p_4);
}
//check and clean level 5
if ($d_4&&$level==5)
{
foreach ($d_4 as $k_4=>$v_4)
{
$p_5 = $p_4.'/'.$v_4;
$a_5 = get_sorted($p_5);
$d_5 = $a_5[0];
$f_5 = $a_5[1];
clean_files($f_5, $p_5);
}
}
}
}
}
}
}
?>
