.RU JS Infection Removal

<?php
// .RU JS infection search script
// Written by Nate Stiller - 8/24/2010
// http://natestiller.com
ini_set('max_execution_time',500);
ob_implicit_flush (true);
ob_end_flush();
$mtime = microtime();
$mtime = explode(" ",$mtime);
$mtime = $mtime[1] + $mtime[0];
$starttime = $mtime;

echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Russian Hack Cleaner</title>
<style type="text/css">
<!--
body,td,th {
        font-family: Verdana, Geneva, sans-serif;
        font-size: 12px;
}
-->
</style></head>

<body><h1>.RU Script Remover</h1>
<br>';

$action=$_GET['action'];

if($action){
        $extentions=explode(",",trim($_GET['ext']));
        if($_GET['recurse']=='yes'){ $recurse=true; } else { $recurse=false; }
        $files = directoryToArray("./", $recurse);
        if($action=='fix'){ echo '<h1>Fixing Files:</h1>'; } else { echo '<h1>Searching Files:</h1>'; }
        echo '<table width="100%" border="0"><tr><td><strong>Filename</strong></td><td><strong>Infected Code</strong></td></tr>';
        foreach($files as $filename){
                $ext = substr($filename, strrpos($filename, '.') + 1);
                if(in_array($ext,$extentions)){
                        $matches=searchFile($filename);
                        if($matches){
                                $infectedcode=htmlentities($matches[0][0].$matches[1][0].$matches[2][0]);
                                echo "<tr><td>$filename</td><td>$infectedcode</td></tr>";
                                if($action=='fix'){ cleanFile($filename); }
                        } else {
                                $cleanlog.="<tr><td>$filename</td></tr>";
                        }
                }
        }

        $mtime = microtime();
        $mtime = explode(" ",$mtime);
        $mtime = $mtime[1] + $mtime[0];
        $endtime = $mtime;
        $totaltime = ($endtime - $starttime);
        echo "Done searching ".count($files)." files in ".round($totaltime, 2)." seconds.<br><br>";
        echo '</table><br><hr width="85%"><h2>Clean Files:</h2><table width="100%" border="0">'.$cleanlog.'</table>';

} else {

        echo '- Make sure you backup your website before you run this script<br>
- When selection "Search AND Fix", it will create a backup of any file it changes named "filename.ext.old"<br>
- If you want to search more than just the default files you can add the extentions you want. Seperate the list with commas and no

spaces<br>
- With recurse folders checked, the script will search through all files and folders. Unchecked will only search files inside the

current folder<br>
<br>
<form action="'.$SCRIPT_NAME.'" method="get">
<table>
<tr>
<td>Action:</td>
<td><select name="action"><option value="search" selected="selected">Search Only</option>
<option value="fix">Search AND Fix</option></select></td>
</tr>
<tr>
<td>File Extentions:</td>
<td><input type="text" name="ext" value="php,js,html,htm" /></td>
</tr>
<tr>
  <td>Recurse Folders:</td>
  <td><input name="recurse" type="checkbox" value="yes" checked /></td>
</tr>
<tr>
<td><input type="submit" value="Go!" /></td>
<td>Press GO only once and be patient! Depending on the number of files, the script may take a couple minutes.</td>
</tr>
</table></form>';
}

function cleanFile($filename){
        $count1=0;$count2=0;$count3=0;
        $filecontents=file_get_contents($filename);
        $cleaned=
        preg_replace('/<script.+?http:\/\/.+?\.ru\/.+?script>/i','',
        preg_replace('/document\.write\(\'<sc.+?http:\/\/.+?\.ru\/.+?pt>\'\);/i','',
        preg_replace('/<!--[a-zA-Z0-9]{32}-->/i','',
        $filecontents,-1,$count1),-1,$count2),-1,$count3);
        file_put_contents($filename.".old",$filecontents);
        $fp=@fopen($filename,'w');
        if($fp){
                fwrite($fp,$cleaned);
                fclose($fp);
        }
        $count=$count1+$count2+$count3;
        if($count > 0){return true;} else {return false;}
}

function searchFile($filename){
        $count1=0;$count2=0;$count3=0;
        $filecontents=file_get_contents($filename);
        $count1=preg_match_all('/<script.+?http:\/\/.+?\.ru\/.+?script>/i',$filecontents,$matches1);
        $count2=preg_match_all('/document\.write\(\'<sc.+?http:\/\/.+?\.ru\/.+?pt>\'\);/i',$filecontents,$matches2);
        $count3=preg_match_all('/<!--[a-zA-Z0-9]{32}-->/i',$filecontents,$matches3);
        $allmatches=array_merge_recursive($matches1,$matches2,$matches3);
        $count=$count1+$count2+$count3;
        if($count > 0){return $allmatches;} else {return false;}
}

function directoryToArray($directory, $recursive) {
        $array_items = array();
        if ($handle = opendir($directory)) {
                while (false !== ($file = readdir($handle))) {
                        if ($file != "." && $file != "..") {
                                if (is_dir($directory. "/" . $file)) {
                                        if($recursive) {
                                                $array_items = array_merge($array_items, directoryToArray($directory. "/" . $file,

$recursive));
                                        }
                                } else {
                                        $file = $directory . "/" . $file;
                                        $array_items[] = trim(preg_replace("/\/\//si", "/", $file),'./');
                                }
                        }
                }
                closedir($handle);
        }
        return $array_items;
}
echo '<br><font size="1"><a href="http://natestiller.com">Created by Nate Stiller |

nate@natestiller.com</a></font></body></html>';
?>