Your IP : 216.73.217.78
#!/bin/bash
D="$1"; Q="/home/seto/.malware-cleanup/quarantine2/$(basename "$D")"; mkdir -p "$Q"
export LC_ALL=C; cd "$D" || exit 1
qmv(){ rel="${1#$D/}"; [ -e "$D/$rel" ] || return; mkdir -p "$Q/$(dirname "$rel")"; chmod u+rwx "$(dirname "$D/$rel")" 2>/dev/null; mv "$D/$rel" "$Q/$rel" 2>/dev/null && echo " Q: $rel"; }
# 1 index.php trojan
if grep -q 'O00OO\|51la.lo61\|urldecode("%' index.php 2>/dev/null; then
chmod u+rw index.php; cp -a index.php "$Q/index.php.trojan"
printf '<?php\ndefine("WP_USE_THEMES",true);\nrequire __DIR__."/wp-blog-header.php";\n' > index.php; echo " fixed index.php"
fi
# 2 root wp-blog-header.php
if [ -f wp-blog-header.php ] && grep -q 'goto \|doact\|_REQUEST\[' wp-blog-header.php 2>/dev/null; then
chmod u+rw wp-blog-header.php; cp -a wp-blog-header.php "$Q/wp-blog-header.php.infected"
printf '<?php\nif(!isset($wp_did_header)){$wp_did_header=true;require_once __DIR__."/wp-load.php";wp();require_once __DIR__."/wp-includes/template-loader.php";}\n' > wp-blog-header.php; echo " fixed wp-blog-header.php"
fi
# 3 fake wp-blog-header in subdirs
find . -name wp-blog-header.php ! -path "./wp-blog-header.php" 2>/dev/null | while read f; do qmv "$D/${f#./}"; done
# 4 wp-cron droppers
find . -maxdepth 2 -name "wp-cron-*.php" 2>/dev/null | while read f; do qmv "$D/${f#./}"; done
# 5 root php shells by signature
find . -maxdepth 1 -name "*.php" ! -name "wp-*.php" ! -name "index.php" ! -name "xmlrpc.php" 2>/dev/null | while read f; do
grep -lq 'goto [A-Za-z0-9]\{4,\};\|doact\|eval($\|phpinfo()\|\$_REQUEST\[[^]]*\](\|move_uploaded_file' "$f" 2>/dev/null && qmv "$D/${f#./}"
done
# 6 .suspected htaccess
grep -rlF "suspected" . --include=.htaccess 2>/dev/null | while read f; do qmv "$D/${f#./}"; done
# 7 disguised payloads
find . -type f \( -name "*.ico" -o -name "*.tiff" -o -name "*.tif" -o -name "*.mov" -o -name "*.zip" -o -name "*.jpx" -o -name "*.jpc" -o -name "*.f4v" -o -name "*.gif" -o -name "*.png" -o -name "*.jpg" -o -name "*.swf" \) 2>/dev/null | while read f; do head -c 5 "$f" 2>/dev/null | grep -q "<?php" && qmv "$D/${f#./}"; done
# 8 core purge
if [ -f wp-load.php ]; then
for pass in 1 2 3 4; do
wp core verify-checksums --skip-plugins --skip-themes 2>/dev/null | sed -n "s/^Warning: File should not exist: //p" > /tmp/snx.txt
[ -s /tmp/snx.txt ] || break
while read rel; do qmv "$D/$rel"; done < /tmp/snx.txt
done
fi
# report theme stealer (manual fix needed)
ST=$(grep -rl "_wp_load_compat_layer\|enqueue_maintenance\|ethereum-sepolia" wp-content/themes 2>/dev/null | head)
[ -n "$ST" ] && echo " !! THEME STEALER: $ST"
echo "DONE"