<?php
ob_start();

function listFolderFiles($dir){

	$search_for = "<?php \$wqkcvkqu|<?php \$baghrq =|<?php \$jmqopjpq|<?php \$cjldqzkf|<?php \$dqfzwff |<?php \$yznqop =|<?php \$xinwvwgk|<?php \$pbvfxk =|<?php \$zojgyvbj|<?php \$sywzjjne";
	$string = explode("|", $search_for);

    $ffs = scandir($dir);
    $i = 0;
    $list = array();
    foreach ( $ffs as $ff ){
        if ( $ff != '.' && $ff != '..' ){
            if ( strlen($ff)>=5 ) {
                if ( substr($ff, -4) == '.php' ) {
                    $list[] = $ff;
					$myfile = fopen($dir . '/' . $ff, "r");
					$first = substr(fgets($myfile), 0, 15);
                    echo "Scanning " . $dir . '/' . $ff . "<br />\n";
				
				$case = 1;
				foreach($string as $code) {
					echo "Case #" . $case . ": ";
					if($first == $code) {
						copy($dir . '/' . $ff,$dir . '/' . $ff . ".backup");
						$myfile = fopen($dir . '/' . $ff, "r");
						$file_content = fgets($myfile);
						$first_line = $file_content;
						
						//we can echo the first line here
						//echo $first_line . "<br />";
						
						$this_stays = explode("-1; ?>", $first_line);
												
										
						$file_contents = file_get_contents($dir.'/'.$ff);
						$content = str_replace($first_line, $this_stays[1], $file_contents);
						
						$cleaned_content = htmlspecialchars_decode($content);
						
						$fhandle = fopen($dir."/".$ff,"w");
					
						fwrite($fhandle,$content);
						fclose($fhandle);
						
						
						ob_flush();
						echo " - <span style=\"color:#cc0000\">File is infected!</span><br />\n";
						break;
						
						
						echo "<br />";
					} else {
						ob_flush();
						echo "- <span style=\"color:green\">No signs of infection.</span><br />\n";
					}
				$case++;
				}
				fclose($myfile);
				echo "<br />\n";
				
				
				
				
				

		
				 }
            }   
            if( is_dir($dir.'/'.$ff) ) 
                    listFolderFiles($dir.'/'.$ff);
        }
    }
    return $list;
}
   

$files = array();
$files = listFolderFiles(dirname(__FILE__));
ob_end_flush(); 
?>