cpanel hacked files scanner

#!/bin/sh
cd /root
echo >> c99result.txt
for j in `ls /var/cpanel/users`
do
echo "Scanning user: $j"
cd /home/$j
find /home/$j -iname '*.php' > /root/c99list
for i in `cat /root/c99list`
do
result=$( perl -e 'alarm shift @ARGV; exec @ARGV' 10 php -q $i | grep -Eie '-rw-r--r--|drwxr-xr-x|drwxrwxrwx|-rw-r-xr-x|-rwxrwxrwx|-rw-rw-rw-|-rwx------')
if [ $? -eq 0 ]; then
echo "Possible Shell Script found on $i" >> /root/c99result.txt
fi
done

echo "Completed processing $j" >> /root/c99result.txt
done
Save and Exit.

Run this shell script to scan hacked files.

root@server1 [~]# ./scanfiles.sh



Once scanning process completed, check report file /root/c99result.txt.