| Chiave<\/td> | Valore<\/td><\/tr>#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (cShell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#fonk_kap = get_cfg_var#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (fonk_kap = get_cfg_var)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#PHPSHELL_VERSION#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (PHPSHELL_VERSION)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Root-Access Shell#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Root-Access Shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#s101 Interamente creata da Sora101#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (s101 Interamente creata da Sora101)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#SimAttacker - Vrsion#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (SimAttacker - Vrsion)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Shell Dizini:#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Shell Dizini:)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\/etc\/syslog.conf#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\/etc\/syslog.conf)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#die\(PHP_OS.chr\(49\).chr\(48\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED die\(PHP_OS.chr\(49\).chr\(48\)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#stCurlLink = base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (stCurlLink = base64_decode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#cookey =#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (cookey =)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#cxyyt = array\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (cxyyt = array\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#.str_pad\(strtoupper\(dechex\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (.str_pad\(strtoupper\(dechex\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#veb65c0b0 = array_keys\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (veb65c0b0 = array_keys\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#=Array\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (=Array(base64_decode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#edoced_46esab#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (edoced_46esab)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\*\/base64_decode\/\*#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\*\/base64_decode\/\*)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(stripslashes\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (eval\(stripslashes\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(\@gzinflate\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (eval\(\@gzinflate\(base64_decode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eva1fYlbakBcVSir#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (eva1fYlbakBcVSir)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#preg_replace\(\"\/\.\*\/e\"\,\"\\x65#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (preg_replace\(\"\/\.\*\/e\"\,\"\\x65)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#cg2bW3yV4NSpnvKX2cFAvjczD7#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (cg2bW3yV4NSpnvKX2cFAvjczD7)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#fcgr2boWm3yVC4NShpnvaKrXC2ocFAdvjcezD7#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (fcgr2boWm3yVC4NShpnvaKrXC2ocFAdvjcezD7)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Macro Hack#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Macro Hack)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#JGs9MTQzOyRtPWV4cGxvZGUoIjsiLCIyMzQ7MjUzOzI1Mzs#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (JGs9MTQzOyRtPWV4cGxvZGUoIjsiLCIyMzQ7MjUzOzI1Mzs)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#XERATUTA#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (XERATUTA)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#unserialize\(string_cpt\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unserialize\(string_cpt\(base64_decode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#data.dat.gz#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (data.dat.gz)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Scam Redirector#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Scam Redirector)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\/images\/config.db#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\/images\/config.db)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\/temp\/links.db#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\/temp\/links.db)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#LS0tLS0tLS0tLS0tLS0t#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (LS0tLS0tLS0tLS0tLS0t)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#BlackMail#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (BlackMail)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\{ hauguen priv\@ spammer \}#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\{ hauguen priv\@ spammer \})";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#echo \'Shell Ok \';#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (echo \'Shell Ok \';)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Da Slake PHP MAILER#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Da Slake PHP MAILER)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#: : M A I L E R : : \$ d o m a i n - I n s i d e T e a m v#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (: : M A I L E R : : \$ d o m a i n - I n s i d e T e a m v)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\/etc\/valiases/#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\/etc\/valiases/)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#numemails#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (numemails)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#PHP Mailer#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (PHP Mailer)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\/etc\/named.conf#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\/etc\/named.conf)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#set_index .= base64_encode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (set_index .= base64_encode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(strrev\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (eval\(gzinflate\(base64_decode\(strrev\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#system file do not delete#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (system file do not delete)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#nslookup -type=MX#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (nslookup -type=MX)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$copyto = explode\(\'wp-content\'\,#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (copyto = explode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#default_action =(.*)default_charset =(.*)preg_replace\((/*)\,str_replace\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED FilesMan Shell";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\<\?php for\(\$o=0,\$e=#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\<\?php for\(\$o=0,\$e=)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$felp = explode\(\$kaka#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (\$felp = explode\(\$kaka)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#getdata = base64_decode\(\$datacheck\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (getdata = base64_decode\(\$datacheck\);)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#array_map\(strrev\(\"ed\".\"oced_\".\"46esab\"\),array\(str_replace\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#if \(md5\(md5\(\$\_REQUEST\[\'hhh\'\]\)\) ==#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Upload GAGAL#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Upload GAGAL)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Config Grabber#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (Config Grabber)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#@symlink\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (@symlink\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#OOO000000=urldecode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (OOO000000=urldecode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval \(gzinflate\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (eval \(gzinflate\(base64_decode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#return rawurlencode\(rawurlencode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (return rawurlencode\(rawurlencode\()";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#=array_map\(\"ba\".\"se6\".\"4\".\"_decode\",array\(\'\',str_replace\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#d.=sprintf\(\(substr\(urlencode\(print_r\(array\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(str_rot13\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(str_rot13\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzuncompress\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzuncompress\(str_rot13\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzuncompress\(base64_decode\(str_rot13\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(str_rot13\(gzinflate\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(strrev\(str_rot13\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(strrev\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(str_rot13\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(gzinflate\(base64_decode\(str_rot13\(strrev\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#echo\(gzinflate\(base64_decode\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#^<\?php\s*\\\$md5\s*=\s*[\"|\']\w+[\"|\'];\s*\\\$wp_salt\s*=\s*[\w\(\),\"\'\;\$]+\s*\\\$wp_add_filter\s*=\s*create_function\(.*\);\s*\\\$wp_add_filter\(.*\);\s*\?>\s*#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED Shell (encrypted)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#libworker.so#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (libworker.so)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#by.\/katAK#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (by.\/katAK)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#array\(\"Google\", \"Slurp\", \"MSNBot\", \"ia_archiver\", \"Yandex\", \"Rambler\", \"StackRambler\"\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (crawler filter)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Make dir:<\/span>#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\}eval\(x0r\("#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#function x0r\(\$h3ll0s\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?php\s*preg_replace\(\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$security_code = \(empty\(\$_POST\[\'security_code\'\]\)\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\.ucwords\(str_replace\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\)\);array_multisort\(array_map\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\.rawurlencode\(strtolower\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?php\s*eval \( base64_decode \(\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(stripslashes\(\$_POST\[codee\]\)\);"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(pet\(\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?php \$g___g_=\'base\'.\(32*2\).\'_de\'.\'code\';\$g___g_=\$g___g_\(str_replace\(\"\n\", \'\', \'#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\((.*)\(base64_decode\((.*)1234567890\)\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$opt\(\"\/292\/e\",\$au,292\); die\(\);\}\}\}#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$MailTo = base64_decode\(\$_POST\[\"mailto\"\]\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#email_polucha#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#if\(isset\(\$_REQUEST\[\'(.*)eval\((.*)\); exit\(\); \} if\(isset\(\$_REQUEST\[\'(.*)exit\(\); \}\s*\?>#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#.::\[ Phproxy \]::.#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#teksasli=unescape\(teks\);document.write\(teksasli\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(base64_decode\(\$jembot\)\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#eval\(base64_decode\(\$_REQUEST\[\'p64\'\]\)\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#die\(\"Restricted accoss\"\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
/* elseif(preg_match('#F(.*)i(.*)l(.*)e(.*)s(.*)m(.*)a(.*)n#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
} */
elseif(preg_match('#<\?php\s*eval\(gzinflate\(str_rot13\(base64_decode\(\'#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#phpRemoteView#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#if \(isset\(\$_POST\[\'_\'\]\) \&\& \(sha1\(base64_decode\(\$_POST\[\'_\'\]\)\^\$str\) ==#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#x47FzcyA9ICI#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#mkdir\(\'Indishell\',0777\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Superfast Zone-H submitter#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#if\(stripos\((.*)=base64_decode\((.*)=create_function\(\"\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Done ==> \$userfile_name#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#preg_match\(\"\/google\|bot\|msn\|spider\|crawl\|spam#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#WEB(.*)Shell#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#index.php replaced successufuly\!#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#sloboz#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$URI = str_replace\(\"sync.php\", \$filename, \$URI\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\? eval\(gzuncompress\(base64_decode\(\'#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#WPcheckInstall#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#echo \"Already writed\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#if \(move_uploaded_file \(\$_FILES\[\"update\"\]\[\"tmp_name\"\], __FILE__\)\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#FilesMan#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?php(.*)= array\(\'(.*)= array\(\'(.*)= array\(\'(.*)\";if \(\!function_exists\(\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\{eval\(base64_decode\(\$_POST\[\"#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$uid = strtoupper\(md5\(uniqid\(time\(\)\)\)\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Created By Spaghy#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#= strrev\(\'ed\'.\'oc\'.\'ed_4\'.\'6e\'.\'sab\'\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#= strrev\(\'eca\'.\'lper\'.\'_ge\'.\'rp\'\);#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?php\s*if \(\!function_exists\(\"(.*)\"\)\)\s*\{\s*function(.*)= base64_decode\((.*)= strlen\((.*)= file_get_contents\(#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Mestre eCoLoGy#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#PHP eMailer#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#= \"p\".\"r\".\"e\".\"g\".\"_\".\"r\".\"e\".\"p\".\"l\".\"a\".\"c\".\"e\";#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#The Devil made me do it :\)#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#echo \"Can\'t upload file:#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#<\?\/\/BREACK\/\/\?>#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Bypass SuHosin#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#\$_FILE\(stripslashes\(\$_REQUEST\[\'HOST\'\]\)\);\}#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#atualizar_flash_player_ver#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('#Made By mr.hosam#i', $tmp))
{
if($print_infected) print "{$finfo['path']}{$finfo['fname']}";
if($print_infected || $print_all) print "...SUSPECTED (unknown shell)";
$counter_infected++;
if($print_infected || $print_all) print "\n";
continue;
}
elseif(preg_match('# |