Exploit and Webshell Scanner/Remover using ClamAV
- mkscan with auto-quarantine
cat <<EOF > /usr/local/bin/mkscan
#!/bin/bash
clamscan -d /usr/local/share/mkscan.db -l log.txt -r --max-filesize=100000 -o --move=/tmp/quarantine --detect-pua=yes $1
EOF
- mkscan WITHOUT auto-quarantine
cat <<EOF > /usr/local/bin/mkscan
#!/bin/bash
clamscan -d /usr/local/share/mkscan.db -l log.txt -r --max-filesize=100000 -o --detect-pua=yes $1
EOF
- mkscan.db
cat <<EOF > /usr/local/share/mkscan.db
PHP-Unwanted-eval_basecode64=6576616c286261736536345f6465636f6465
PHP-AndelaGrab=40696e695f7365742827646973706c61795f6572726f7273272c2030293b
PHP-AndelaGrab=64697361626c655f66756e6374696f6e73203d204e6f6e65
PHP-AndelaGrab-WS=407365745f74696d655f6c696d69742830293b
PHP-Unwanted-ShowSource=73686f775f736f7572636528
Unwanted-Link-Exploilt=687474703a2f2f7777772e6578706f696c742e636f6d2f
Unwanted-Link-BizimSEO=68747470733a2f2f62697a696d73656f2e636f2f
PHP-Unwanted-eval_rotl13=6576616c287374725f726f743133
PHP-Unwanted-eval_trim_base64=6576616c287472696d286261736536345f6465636f6465
Unwanted-Shell-etcpasswd=2f6574632f706173737764
PHP-FM_Show=666d5f73686f775f666f6f7465722829
PHP-FM_Show-Images=6956424f5277304b47676f414141414e5355684555674141414145414141414243415941414141664663534a4141414145456c4551565234326d4c342f2f382f41304341415141492f414c2b32364a4e466741414141424a52553545726b4a6767673d3d
PHP-Webadmin=77656261646d696e2e706870202d20612073696d706c65205765622d62617365642066696c65206d616e61676572
PHP-FM_Show-Robots=656e63747970653d226d756c7469706172742f666f726d2d6461746122206e616d653d2275706c6f61643432222069643d2275706c6f6164343222
PHP-Unwanted-aQ0O010O=557365722d4167656e743a206151304f3031304f
PHP-Unwanted-filegetcontentbase64=66696c655f6765745f636f6e74656e7473286261736536345f6465636f646528
PHP-Unwanted-assert=3c3f70687020246b3d22617373222e22657274223b20246b28247b225f504f222e225354227d205b61646d696e735d293b3f3e0a
PHP-AngelaGrab-SlackerCode=736c61636b657263306465
EOF