我的一个客户的服务器上感染了数千个文件的病毒。

幸运的是，我在这个人的服务器上处理过很多其他恶意软件，这个看起来很容易做简单的正则表达式(他把他所有的网站都放在同一个帐户上:(但我正在和他一起解决这个问题).

但基本上，与我见过的大多数恶意软件不同的是，它会在关闭好代码之前注入(inject) php(这使得很难确定什么是好代码/坏代码)，当前的恶意软件总是添加一个新的 <?php ... malware ... ?> .

所以基本上，假设这里有好的代码:

<?php
require('./wp-blog-header.php'); 
?>

不是在 require 语句之后但在 ?> 之前立即添加某种 base64_decode eval(当页面恰好以条件/复杂语句结尾时，这会使删除变得困难)，这将始终添加以下代码新<?php ... ?>像这样:

<?php
require('./wp-blog-header.php'); 
?><?php ... malware ...?>

我不想在这里放置任何恶意代码，但是恶意代码总是这样开始的:

<?php @error_reporting(0); if (!isset($eva1fYlbakBcVSir)) {$eva1fYlbakBcVSir = "tons and tons of characters";$eva1tYlbakBcVSir = "\x6335\1443\3x6f\1534\x70\170\x65";$SNIPSNIPSNIPSNIP;} ?>

我想在每个文件中搜索 <?php @error_reporting(0); if (!isset如果它是页面上的最后一个 PHP 语句，则删除

最佳答案

下面是如何使用纯 php 清理整个项目。

In no respect shall I incur any liability for any damages, including, but limited to, direct, indirect, special, or consequential damages arising out of, resulting from, or any way connected to the use of the code provided, whether or not based upon warranty, contract, tort, or otherwise; whether or not injury was sustained by persons or property or otherwise; and whether or not loss was sustained from, or arose out of, the results of, the use if this code. ;p

<?php 
//Enter it as it is and escape any single quotes
$find='<?php @error_reporting(0); if (!isset($eva1fYlbakBcVSir)) {$eva1fYlbakBcVSir =\'\';?>';

echo findString('./',$find);

function findString($path,$find){
    $return='';
    ob_start();
    if ($handle = opendir($path)) {
        while (false !== ($file = readdir($handle))) {
            if ($file != "." && $file != "..") {
                if(is_dir($path.'/'.$file)){
                    $sub=findString($path.'/'.$file,$find);
                    if(isset($sub)){
                        echo $sub.PHP_EOL;
                    }
                }else{
                    $ext=substr(strtolower($file),-3);
                    if($ext=='php'){
                        $filesource=file_get_contents($path.'/'.$file);
                        $pos = strpos($filesource, $find);
                        if ($pos === false) {
                            continue;
                        } else {
                        //The cleaning bit
                        echo "The string '".htmlentities($find)."' was found in the file '$path/$file and exists at position $pos and has been removed from the source file.<br />";
                        $clean_source = str_replace($find,'',$filesource);
                        file_put_contents($path.'/'.$file,$clean_source);
                        }
                    }else{
                        continue;
                    }
                }
            }
        }
        closedir($handle);
    }
    $return = ob_get_contents();
    ob_end_clean();
    return $return;
}
?>

祝你好运。

更新(使用正则表达式):

<?php 
error_reporting(E_ALL);
$find='<\?php @error_reporting\(0\); if \(!isset\((.*?)\?>';

echo findString('./',$find);

function findString($path,$find){
    $return='';
    ob_start();
    if ($handle = opendir($path)) {
        while (false !== ($file = readdir($handle))) {
            if ($file != "." && $file != "..") {
                if(is_dir($path.'/'.$file)){
                    $sub=findString($path.'/'.$file,$find);
                    if(isset($sub)){
                        echo $sub.PHP_EOL;
                    }
                }else{
                    $ext=substr(strtolower($file),-3);
                    if($ext=='php'){

                        $filesource=file_get_contents($path.'/'.$file);
                        //The cleaning bit
                        echo "The string '".htmlentities($find)."' was found in the file '$path/$file and has been removed from the source file.<br />";
                        $clean_source = preg_replace('#'.$find.'#','',$filesource);
                        // $clean_source = str_replace($find,'',$filesource);
                        file_put_contents($path.'/'.$file,$clean_source);
                    }else{
                        continue;
                    }
                }
            }
        }
        closedir($handle);
    }
    $return = ob_get_contents();
    ob_end_clean();
    return $return;
}
?>

关于PHP/SSH 正则表达式脚本/命令，用于从多个文件中删除相同的恶意软件代码，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/10422503/