5 Commits
1.0.8 ... 1.0.9

Author SHA1 Message Date
Gabor Gyorvari
9624ec4403 README update with new -r flag 2021-02-24 16:47:13 +01:00
Győrvári Gábor
335b13b7c4 Merge pull request #67 from mitchobrian/master
Feature flagHideErr #66
2021-02-24 16:45:34 +01:00
Michael Palmer
78bee49176 https://github.com/scr34m/php-malware-scanner/issues/66 2021-02-24 13:36:10 +01:00
Győrvári Gábor
cc0fdc7a9f Merge pull request #63 from aldavigdis/patch-1
Adding definitions based on recent code injection
2020-11-17 08:07:52 +01:00
Alda Vigdis Skarphedinsdottir
ec8f9920ba Adding definitions based on recent code injection 2020-11-17 04:06:03 +01:00
3 changed files with 21 additions and 3 deletions

View File

@@ -26,6 +26,7 @@ Usage: php scan.php -d <directory>
-x --extra-check Adds GoogleBot and htaccess to Scan List -x --extra-check Adds GoogleBot and htaccess to Scan List
-l --follow-symlink Follow symlinked directories -l --follow-symlink Follow symlinked directories
-k --hide-ok Hide results with 'OK' status -k --hide-ok Hide results with 'OK' status
-r --hide-err Hide results with 'ER' status
-w --hide-whitelist Hide results with 'WL' status -w --hide-whitelist Hide results with 'WL' status
-n --no-color Disable color mode -n --no-color Disable color mode
-s --no-stop Continue scanning file after first hit -s --no-stop Continue scanning file after first hit

View File

@@ -201,6 +201,7 @@ eval(base64_decode(
$data = base64_decode(" $data = base64_decode("
edoced_46esab edoced_46esab
base=base64_encode base=base64_encode
'b'.'ase6'.'4_e'.'ncode'
cr"."eat"."e_fun"."cti"."on cr"."eat"."e_fun"."cti"."on
gz'.'inf'.'late gz'.'inf'.'late
# fopo.com.ar - free online php obfuscator. It conveniently leaves comments in the code. # fopo.com.ar - free online php obfuscator. It conveniently leaves comments in the code.
@@ -260,6 +261,9 @@ itsoknoproblembro
tmhapbzcerff tmhapbzcerff
IndoXploit IndoXploit
FaisaL Ahmed aka rEd X FaisaL Ahmed aka rEd X
smisbot
smotherbot
Indonesian Hacker Rulez
# WP-VCD Malware https://www.getastra.com/blog/911/how-to-fix-wp-vcd-backdoor-hack-in-wordpress-functions-php/ # WP-VCD Malware https://www.getastra.com/blog/911/how-to-fix-wp-vcd-backdoor-hack-in-wordpress-functions-php/
wp-vcd wp-vcd

View File

@@ -2,13 +2,13 @@
/* /*
* Copyright (c) 2016 Gabor Gyorvari * Copyright (c) 2016 Gabor Gyorvari
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -31,6 +31,7 @@ class MalwareScanner
private $flagChecksum = false; private $flagChecksum = false;
private $flagComments = false; private $flagComments = false;
private $flagHideOk = false; private $flagHideOk = false;
private $flagHideErr = false;
private $flagHideWhitelist = false; private $flagHideWhitelist = false;
private $flagNoStop = false; private $flagNoStop = false;
private $flagPattern = false; private $flagPattern = false;
@@ -298,6 +299,9 @@ class MalwareScanner
if (isset($options['hide-ok']) || isset($options['k'])) { if (isset($options['hide-ok']) || isset($options['k'])) {
$this->setFlagHideOk(true); $this->setFlagHideOk(true);
} }
if (isset($options['hide-err']) || isset($options['r'])) {
$this->setFlagHideErr(true);
}
if (isset($options['hide-whitelist']) || isset($options['w'])) { if (isset($options['hide-whitelist']) || isset($options['w'])) {
$this->setFlagHideWhitelist(true); $this->setFlagHideWhitelist(true);
} }
@@ -396,6 +400,11 @@ class MalwareScanner
$this->flagHideOk = $b; $this->flagHideOk = $b;
} }
public function setFlagHideErr($b)
{
$this->flagHideErr = $b;
}
public function setFlagHideWhitelist($b) public function setFlagHideWhitelist($b)
{ {
$this->flagHideWhitelist = $b; $this->flagHideWhitelist = $b;
@@ -490,6 +499,9 @@ class MalwareScanner
$state = 'WL'; $state = 'WL';
$state_color = $this->ANSI_YELLOW; $state_color = $this->ANSI_YELLOW;
} else { } else {
if ($this->flagHideErr) {
return;
}
$state = 'ER'; $state = 'ER';
$state_color = $this->ANSI_RED; $state_color = $this->ANSI_RED;
} }
@@ -820,6 +832,7 @@ class MalwareScanner
echo ' -x --extra-check Adds GoogleBot and htaccess to Scan List' . PHP_EOL; echo ' -x --extra-check Adds GoogleBot and htaccess to Scan List' . PHP_EOL;
echo ' -l --follow-symlink Follow symlinked directories' . PHP_EOL; echo ' -l --follow-symlink Follow symlinked directories' . PHP_EOL;
echo ' -k --hide-ok Hide results with \'OK\' status' . PHP_EOL; echo ' -k --hide-ok Hide results with \'OK\' status' . PHP_EOL;
echo ' -r --hide-err Hide results with \'ER\' status' . PHP_EOL;
echo ' -w --hide-whitelist Hide results with \'WL\' status' . PHP_EOL; echo ' -w --hide-whitelist Hide results with \'WL\' status' . PHP_EOL;
echo ' -n --no-color Disable color mode' . PHP_EOL; echo ' -n --no-color Disable color mode' . PHP_EOL;
echo ' -s --no-stop Continue scanning file after first hit' . PHP_EOL; echo ' -s --no-stop Continue scanning file after first hit' . PHP_EOL;