diff --git a/cms-ver.php b/cms-ver.php index b431e96..1a5b528 100644 --- a/cms-ver.php +++ b/cms-ver.php @@ -214,6 +214,7 @@ $versiondouble = array ( array("Joomla 1.6/1.7", "/libraries/cms/version.php", "\$RELEASE =", "\$DEV_LEVEL ="), array("Joomla 2.5/3.x", "/libraries/cms/version/version.php", "\$RELEASE =", "\$DEV_LEVEL ="), array("Joomla 3.5+", "/libraries/cms/version/version.php", "const RELEASE =", "const DEV_LEVEL ="), + array("CS-Cart", "config.php", "define('PRODUCT_NAME',", "define('PRODUCT_VERSION',"), ); diff --git a/malware5.pl b/malware5.pl index 8eb8215..67fcd0c 100644 --- a/malware5.pl +++ b/malware5.pl @@ -289,6 +289,7 @@ my @regexen = ( qr/<\?php\s+\$wphash.+?\$rootpath\s+\=\s+preg\_replace\(\'\/\(htdocs\|httpdocs\|www\).+?\$ErrorMsg\s+\=\s+mysql\_error\(\)\;.+?\}\s+\?>/is, qr/<\?php\s+\$auth\_pass\s+\=.+?\(base64\_decode\(.+?\)\;\$\_\=create\_function\(\"\"\,\@gzuncompress\(\$\_\_\)\)\;\$\_\(\)\;\?>/is, qr/<\?php\s+\$zend\_framework\=\"\\x\d\d.+?\"\;\s+\@error\_reporting\(0\)\;\s+\$zend\_framework\(\"\"\,.+?\\x\d\w\"\)\;\s+\?>/is, + qr/\$cookey\s+\=\s+\"([A-z0-9]{1,20})\"\;\s+preg\_replace\(\"\\x23.+?x3b\"\)\;/is, ); diff --git a/malwaresh.pl b/malwaresh.pl index 95ab60f..84a51cf 100644 --- a/malwaresh.pl +++ b/malwaresh.pl @@ -769,6 +769,7 @@ my @regexen = ( qr/<\?php\s+\$wphash.+?\$rootpath\s+\=\s+preg\_replace\(\'\/\(htdocs\|httpdocs\|www\).+?\$ErrorMsg\s+\=\s+mysql\_error\(\)\;.+?\}\s+\?>/is, qr/<\?php\s+\$auth\_pass\s+\=.+?\(base64\_decode\(.+?\)\;\$\_\=create\_function\(\"\"\,\@gzuncompress\(\$\_\_\)\)\;\$\_\(\)\;\?>/is, qr/<\?php\s+\$zend\_framework\=\"\\x\d\d.+?\"\;\s+\@error\_reporting\(0\)\;\s+\$zend\_framework\(\"\"\,.+?\\x\d\w\"\)\;\s+\?>/is, + qr/\$cookey\s+\=\s+\"([A-z0-9]{1,20})\"\;\s+preg\_replace\(\"\\x23.+?x3b\"\)\;/is,