diff --git a/malware3.pl b/malware3.pl index 411a13d..9d471d1 100644 --- a/malware3.pl +++ b/malware3.pl @@ -585,12 +585,12 @@ foreach my $file (sort @files) { next if $file eq 'custom-facebook-feed-admin.php'; next if $file eq 'membershipadmin.php'; next if $file eq 'wppa-settings-autosave.php'; - next if $file eq '*.txt'; - next if $file eq '*.rar'; - next if $file eq '*.zip'; - next if $file eq '*.tar'; - next if $file eq '*.gz'; - next if $file eq '*.sql'; + next if $file eq '*\.txt'; + next if $file eq '*\.rar'; + next if $file eq '*\.zip'; + next if $file eq '*\.tar'; + next if $file eq '*\.gz'; + next if $file eq '*\.sql'; diff --git a/scan.php b/scan.php index 7f11888..8cc5b58 100644 --- a/scan.php +++ b/scan.php @@ -478,41 +478,34 @@ foreach ($tree as $finfo) unset($match); } - ///<\?(php)?/i - short tag detection problem if('gif' == $ext && preg_match('/<\?php/i', $tmp)) { $counter_infected++; - //$counter_error++; if($print_infected) print "{$finfo['path']}{$finfo['fname']}"; if($print_infected || $print_all) print "\n"; { print "...INFECTED (PHP open tag inside GIF image)\n"; - // print("\n\ERROR: {$finfo['path']}{$finfo['fname']} will not be auto-deleted, you have to delete it manually if you think it's a threat!\n\n"); } } elseif('jpg' == $ext && preg_match('/<\?php/i', $tmp)) { $counter_infected++; - //$counter_error++; if($print_infected) print "{$finfo['path']}{$finfo['fname']}"; if($print_infected || $print_all) print "\n"; { print "...INFECTED (PHP open tag inside JPG image)\n"; - // print("\n\ERROR: {$finfo['path']}{$finfo['fname']} will not be auto-deleted, you have to delete it manually if you think it's a threat!\n\n"); } } elseif('jpeg' == $ext && preg_match('/<\?php/i', $tmp)) { $counter_infected++; - //$counter_error++; if($print_infected) print "{$finfo['path']}{$finfo['fname']}"; if($print_infected || $print_all) print "\n"; { print "...INFECTED (PHP open tag inside JPEG image)\n"; - // print("\n\ERROR: {$finfo['path']}{$finfo['fname']} will not be auto-deleted, you have to delete it manually if you think it's a threat!\n\n"); } }