Skip to content

Instantly share code, notes, and snippets.

@navarr
Created March 14, 2012 01:06
Show Gist options
  • Select an option

  • Save navarr/2033131 to your computer and use it in GitHub Desktop.

Select an option

Save navarr/2033131 to your computer and use it in GitHub Desktop.
Clean up Wordpress Virus
<?php
function run_dir($dir)
{
$d = opendir($dir);
while(($f = readdir($d)) !== false)
{
if($f == "." || $f == "..") continue;
if(filetype($dir . "/" . $f) == "dir")
{
run_dir($dir . "/" . $f);
}
else
{
$a = explode(".",$f);
if($a[count($a)-1] == "php")
{
// do pregex here
$contents = file_get_contents($dir . "/" . $f);
if(preg_match("#eval\(base64_decode\(\"[^\"]*\"\)\);#",$contents))
{
myecho("Infected PHP file: ".$f."\n");
$newcontents = preg_replace("#eval\(base64_decode\(\"[^\"]*\"\)\);#"," ",$contents);
$a = file_put_contents($dir . "/" . $f . ".infected-bak",$contents);
$b = true;
if($a) $b = file_put_contents($dir . "/" . $f, $newcontents);
if(!$a) myecho("\tFailed to Backup\n");
if(!$b) myecho("\tFailed to Clean\n");
if($a && $b) myecho("\tBacked Up & Cleaned\n");
}
}
}
}
closedir($d);
}
run_dir(".");
function myecho($words)
{
echo $words;
file_put_contents("cleanup.log",$words,FILE_APPEND);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment