Скрипт поиска измененных файлов на сервере.

<?
error_reporting(E_ALL ^ E_NOTICE ^ E_WARNING);


header("Content-Type: text/html;charset=windows-1251\n\n");



define('QCR_INDEX_FILENAME', 'fn');
define('QCR_INDEX_TYPE', 'type');
define('QCR_INDEX_WRITABLE', 'wr');
define('QCR_SVALUE_FILE', '1');
define('QCR_SVALUE_FOLDER', '0');

  $g_Iframer = array();

  $g_DBShe[] = '$info .= (($perms & 0x0040) ?(($perms & 0x0800) ? \'s\' : \'x\' ) :(($perms & 0x0800) ? \'S\' : \'-\')';
  $g_DBShe[] = '<textarea name=\"phpev\" rows=\"5\" cols=\"150\">".@$_POST[\'phpev\']."</textarea><br>';
  $g_DBShe[] = '7TMGAHY5KaM9o37W/GQ/frFJetfqlRGO6FSRTMm7ILSm35o5z4+v0mcf4KaHgKS5Y17eqqvD2mmN8NzteyplNd6WOwrQVK445J/y0';
  $g_DBShe[] = 'c99ftpbrutecheck';
  $g_DBShe[] = 'c99shell';
  $g_DBShe[] = 'R0lGODlhJgAWAIAAAAAAAP///yH5BAUUAAEALAAAAAAmABYAAAIvjI+py+0PF4i0gVvzuVxXDnoQ';
  $g_DBShe[] = 'casus15';
  $g_DBShe[] = 'WSCRIPT.SHELL';
  $g_DBShe[] = 'Executed command: <b><font color=#dcdcdc>[$cmd]';
  $g_DBShe[] = 'ctshell.php';
  $g_DBShe[] = 'BDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAQABADASIAAhEBA';
  $g_DBShe[] = '[Av4bfCYCS,xKWk$+TkUS,xnGdAx[O';
  $g_DBShe[] = 'DX_Header_drawn';
  $g_DBShe[] = '9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNs';
  $g_DBShe[] = 'crlf.\'unlink($name);\'.$crlf.\'rename("~".$name, $name);\'.$crlf.\'unlink("grp_repair.php"';
  $g_DBShe[] = '/0tVSG/Suv0Ur/haUYAdn3jMQwbbocGffAeC29BN9tmBiJdV1lk+jYDU92C94jdtDif+xOYjG6CLhx31Uo9x9/eAWgsBK60kK2mLwqzqd';
  $g_DBShe[] = 'mpty($_POST[\'ur\'])) $mode |= 0400; if (!empty($_POST[\'uw\'])) $mode |= 0200; if (!empty($_POST[\'ux\'])) $mode |= 0100';
  $g_DBShe[] = 'WT+P{~EW0ErPOtnU@#@&^l^sP1ldny@#@&nsk+r0,GT+';
  $g_DBShe[] = 'klasvayv.asp?yenidosya=<%=aktifklas%>';
  $g_DBShe[] = 'nt)(disk_total_space(getcwd())/(1024*1024)) . "Mb " . "Free space " . (int)(disk_free_space(getcwd())/(1024*1024)) . "Mb <';
  $g_DBShe[] = 's().g().s().s().g().s().s().g()';
  $g_DBShe[] = 'CRbskEIS+ybKAwc6/OB1jU8Y0YIMVUhxhaOIsHACByD0wMANOHqY5Y48guiBnChkwPYNTkxdBRVRZLHFkojY96II';
  $g_DBShe[] = '$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQp';
  $g_DBShe[] = 'CB2aTZpIDEwMjQtDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KI3JlcXVp';
  $g_DBShe[] = 'NTDaddy';
  $g_DBShe[] = 'a href="<?echo "$fistik.php?dizin=$dizin/../"?>" style="text-decoration: non';
  $g_DBShe[] = 'TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG';
  $g_DBShe[] = 'RootShell!\');self.location.href=\'http:';
  $g_DBShe[] = 'm91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdX';
  $g_DBShe[] = '<%=Request.ServerVariables("script_name")%>?FolderPath=<%=Server.URLPathEncode(Folder.Driv';
  $g_DBShe[] = 'R0lGODlhFAAUAKIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAA';
  $g_DBShe[] = 'print((is_readable($f) && is_writeable($f))?"<tr><td>".w(1).b("R".w(1).font(\'red\',\'RW\',3)).w(1):(((is_readable($f))?"<tr><td>".w(1).b("R").w(4):"").((is_writabl';
  $g_DBShe[] = '(\'"\',\'&quot;\',$fn)).\'";document.list.submit();\\\'>\'.htmlspecialchars(strlen($fn)>format?substr($fn,0,format-3).\'...\':$fn).\'</a>\'.str_repeat(\' \',format-strlen($fn)';
  $g_DBShe[] = 'zehirhacker';
  $g_DBShe[] = 'sypex';
  $g_DBShe[] = 'J@!Vr@*&RHRw~JLw.G|xlhnLJ~?1.bwObxbP|!V^Cx9эрэxэ"PЭзbx~P';
  $g_DBShe[] = 'cihshell';
  $g_DBShe[] = 'X1NFU1NJT05bJ3R4dGF1dGhpbiddID0gdHJ1ZTsNCiAgICBpZiAoJF9QT1NUWydybSddKSB7DQogICAgICBzZXRjb29raWUoJ3R4dGF1dGhfJy4kcm1ncm91cCwgbW';
  $g_DBShe[] = 'JHZpc2l0Y291bnQgPSAkSFRUUF9DT09LSUVfVkFSU1sidmlzaXRzIl07IGlmK';
  $g_DBShe[] = 'Fxc99sh';
  $g_DBShe[] = 'WSOsetcookie(md5($_SERVER[\'HTTP_HOST\'])';
  $g_DBShe[] = 'CQboGl7f+xcAyUysxb5mKS6kAWsnRLdS+sKgGoZWdswLFJZV8tVzXsq+meSPHMxTI3nSUB4fJ2vR3r3OnvXtNAqN6wn/DtTTi+Cu1UOJwNL';

  $g_SusDB[] = "ini_get('safe_mode')";
  $g_SusDB[] = "eval(gzinflate(base64_decode";
  $g_SusDB[] = "eval(base64_decode(";
  $g_SusDB[] = "rootshell";
  $g_SusDB[] = 'srpath://../../../..';
  $g_SusDB[] = '<iframe';
  $g_SusDB[] = 'phpinfo()';


// ==========================================================================================================
function QCR_ScanDirectories($rootDir, &$res_ar)
{
    global $g_Iframer;

    $dirContent = scandir($rootDir);
    foreach($dirContent as $key => $content)
    {
        if ($content == '.' || $content == '..') continue;
        $path = $rootDir . '/' . $content;
        $ext = substr($content, strrpos($content, '.') + 1);

        if(is_file($path) && is_readable($path))
        {
        	$need_to_scan = ($ext == 'php');  
        	      	
        	if ($need_to_scan)
        	{
	        	$key = $path;         
	            $res_ar[$key][QCR_INDEX_FILENAME] = substr( $path, strrpos( $path, '/')+1);
	            $res_ar[$key][QCR_INDEX_TYPE] = QCR_SVALUE_FILE;
        	}

        	if 
		   ((stripos($path, 'index.php')) || 
		   (stripos($path, 'index.htm')) || 
		   (stripos($path, 'index.html'))) 
		{
  			$l_Content = join("", file($path));
			if (stripos($l_Content, '<iframe')) 
			{
				$g_Iframer[] = 	$path;
			}
		    
		}
            
        }
        else if(is_dir($path) && is_readable($path))
        {
        	$need_to_scan = true; 
        	       	
        	if ($need_to_scan)
        	{
	        	$key = $path;
	        	$res_ar[$key][QCR_INDEX_FILENAME] = substr( $path, strrpos( $path, '/')+1);
	            $res_ar[$key][QCR_INDEX_TYPE] = QCR_SVALUE_FOLDER;            
	            $res_ar[$key][QCR_INDEX_WRITABLE] = is_writable($path);            
	            QCR_ScanDirectories($path, &$res_ar);


        	}
        }
        
    }

    return $res_ar;
}

///////////////////////////////////////////////////////////////////////////
function WarningPHP($l_FN) 
{
  global $g_SusDB;

  $l_Res = false;

  $l_Content = join("", file($l_FN));

  foreach ($g_SusDB as $l_Item) 
  {
    if (stripos($l_Content, $l_Item) && !stripos($l_Content, '@J521342345670No')) {
       $l_Res = true;
       break;
    } 
  }

  return $l_Res; 
}

///////////////////////////////////////////////////////////////////////////
function CriticalPHP($l_FN)
{
  global $g_DBShe;

  // @J521342345670No
  $l_Res = false;

  $l_Content = join("", file($l_FN));

  foreach ($g_DBShe as $l_Item) 
  {
    if (stripos($l_Content, $l_Item) && !stripos($l_Content, '@J521342345670No')) {
       $l_Res = true;
       break;
    }
  }

  return $l_Res; 
}


///////////////////////////////////////////////////////////////////////////
$l_Res = '';
QCR_ScanDirectories('.', $l_Res);

foreach ($l_Res as $l_Filename => $l_Item)
{
  if ($l_Item[QCR_INDEX_TYPE] == QCR_SVALUE_FOLDER) 
  {
    $l_TotalFolder++;
    // folder
    if ($l_Item[QCR_INDEX_WRITABLE]) 
    {
      $l_WritableDirectories[] = $l_Filename;
    }
  } else 
  {
    // file
    $l_TotalFiles++;
    if (WarningPHP($l_Filename)) 
    {
      $l_WarningPHP[] = $l_Filename;
    }

    if (CriticalPHP($l_Filename))
    {
      $l_CriticalPHP[] = $l_Filename;
    }
  }
}

print "<hr size=1><p>Всего проверено $l_TotalFolder директорий и $l_TotalFiles php файлов.<p>";

if (count($l_CriticalPHP) > 0) {
  print "<font color=red><p>Ахтунг! Скорее всего шелл-скрипт:<ul><li>";
  print "" . join("<li>", $l_CriticalPHP) . "";
  print "</ul></font>";
} else {
  print 'Шелл-скрипты не найдены.<p>';
}

if (count($g_Iframer) > 0) {
  print "<font color=red><p>Ахтунг! Скорее всего в файле вирус:<ul><li>";
  print "" . join("<li>", $g_Iframer) . "";
  print "</ul></font>";
}
if (count($l_WarningPHP) > 0) {
  print "<font color=orange><p>Скрипт использует подозрительный код:<ul><li>";
  print "" . join("<li>", $l_WarningPHP) . "";
  print "</ul></font>";
} else {
  print 'Подозрительные скрипты не найдены.<p>';
}

if (count($l_WritableDirectories) > 0) {
  print "<font color=blue><p>Небезопасно! Директории, доступные скрипту на запись:<ul><li>";
  print "" . join("<li>", $l_WritableDirectories) . "";
  print "</ul></font>";
} else {
  print 'Не найдено директорий, доступных на запись скриптом.<p>';
}


?>