External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove too regular patterns

Browse Source
This commit is contained in:
Gabor Gyorvari
2016-12-27 15:48:48 +01:00
parent 608caf6d5e
commit 91174b5a60
1 changed files with 20 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
scan.php
View File

@@ -161,6 +161,7 @@ class MalwareScanner
'\x65\x76\x61\x6C' /* case, dec/hex issue? */,
'ZXZhbCg', // eval
"'ev'.'al'.'",
'/eval\s*\(/i',
'eval(base64_decode(',
'\x47\x4c\x4f\x42\x41LS', // GLOBALS
@@ -175,31 +176,27 @@ class MalwareScanner
/* too open? */
// 'gzinflate(base64_decode(',
'md5($_GET[', // md5($_GET["ms-load"])
'sendMail',
'echo "ok-ok"',
'/ShellBOT/i',
'/YW55cmVzdWx0cy5uZXQ=/i',
'/eval\s*\(/i',
'/base64_decode\s*\(/i',
'/str_rot13/i',
'/uudecode/i',
'/preg_replace',
'bgeteam',
'DisablePHP=',
'=urldecode',
'moban.html',
'<?php eval',
'$data = base64_decode("',
'a,b,c,d,e,f,g',
'/ShellBOT/i',
'/YW55cmVzdWx0cy5uZXQ=/i',
'/base64_decode\s*\(/i',
'/str_rot13/i',
'/uudecode/i',
'/preg_replace',
'bgeteam',
'DisablePHP=',
'=urldecode',
'moban.html',
'<?php eval',
'$data = base64_decode("',
'a,b,c,d,e,f,g',
' freetellafriend.com',
'SHELL_PASSWORD',
'curl_get_from_webpage',
'base=base64_encode',
'@x0powo',
'@preg_replace',
'1@1.com',
'META http-equiv="refresh" content="0;',
'curl_get_from_webpage',
'base=base64_encode',
'@x0powo',
'@preg_replace',
'1@1.com',
'META http-equiv="refresh" content="0;',
'="create_";global'
);
if ($this->ExtraCheck) {