black-dragon74
/ FixLoveGreenPencilsMalware.sh
Created
December 2, 2020 21:04
Fixes love green pencils wordpress malware
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # Regex to fix DB is: "s/<script[\s\S]*?>[\s\S]*?<\/script>//g" | |
| totalInfections=0 | |
| filesProcessed=0 | |
| echo "Welcome to lovegreenpencils malware fixer by black-dragon74" | |
| echo "This fix is divided into 3 phases." | |
| echo "Phase 1 fixes the \`beckup\` files." |
ImSeaWorld
/ dlgp.php
Last active
February 3, 2023 22:47
LoveGreenPencils WordPress malware removal script. I didn't like those green pencils. Discussion: https://stackoverflow.com/questions/64907298/wordpress-website-infected-by-virus-how-to-backup-or-recover/64921065 Shell Script: https://gist.github.com/black-dragon74/86fc18a91e814019228c02531f0ea01c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| define('NOTFOUND', -1); | |
| define('REMOVED', -2); | |
| define('EXISTNT', -3); | |
| define('ERROR', -4); | |
| // This is found in the database. | |
| $Script_A = "<script src='https://port.lovegreenpencils.ga/m.js?n=ns1' type='text/javascript'></script>"; | |
| // Thrown on indexs | |
| $Script_D = "<script type='text/javascript' src='https://port.lovegreenpencils.ga/m.js?n=nb5'></script>"; | |
| // This is found in JS files. |