scanmailqueue-indi.sh

scanmailqueue-indi.sh

#/bin/bash
freshclam;
echo > /usr/local/src/mailscamsind.txt;
echo > /usr/local/src/maliciousfilesind;
echo > /usr/local/src/permissionupdatedind;
echo > /usr/local/src/scanclamfile.log;
echo > /usr/local/src/scanclam.log;
#tail -10000 /var/log/exim_mainlog | grep -w "cwd" | grep -v "exim" | grep -v "root" | grep -vw "/" | cut -d= -f2 | awk '{print $1}' | sort | uniq -c | sort -rn >> /usr/local/src/mailscams.txt
#for i in `head -5 /usr/local/src/mailscams.txt | awk '{print $2}' | grep -v '^$'`; do
i=$1
echo $i
countvar=`echo $i | cut -d/ -f4`
echo $countvar;
if [ ! -z "$countvar" ]
then
cd $i;
find $i -type f -name '*.php' -exec egrep -q 'yMxbgVDJ96|wUu2jGoB|$xYEzDu6r3EZT|$ZR2%tuMpYFr|$knmui74|x47LOBA|EWnBCG-hUfK|vC82XHO|rOqYibX4WA|ALaEJ!Pw|vHHEE8M|v08X2QH|vO5CQ7A|qjyxw29|snnqbra|m4fcc8cc8|h27817c5|qcv57cai|ixgaaoq|quxyhbexdbj' {} \; -print >> /usr/local/src/maliciousfilesind

find $i -type f -name '*.php' -exec grep -li "gzinflate(base64_decode" {} \; -print >> /usr/local/src/maliciousfilesind

##########################Find malicious files with Globals#########################################
globalmal=`grep -lr "GLOBALS" $i`
        for k in $globalmal; do
        countglob=`grep -roh "GLOBALS" $k | wc -w`;
if [ "$countglob" -ne 519 ]
then
        if [ "$countglob" -ge 537 ]
        then
        echo $k >> /usr/local/src/maliciousfilesind;
        fi
        if [ "$countglob" -ge 363 ]
        then
        echo $k >> /usr/local/src/maliciousfilesind;
        fi
fi
        done
##########################Find malicious files with Globals#########################################
grep -wlr "chr(112)" $i >> /usr/local/src/maliciousfilesind;
grep -wlr "chr(40)" $i >> /usr/local/src/maliciousfilesind;
malusers=`echo $i | cut -d/ -f3`
echo $malusers;
/usr/local/sbin/maldet -a $i > /usr/local/src/$malusers-maldetscan.log
malscamid=`cat /usr/local/src/$malusers-maldetscan.log | grep "maldet --report" | awk '{print $11}'`
/usr/local/sbin/maldet -q $malscamid;
rm -fv /usr/local/src/$malusers-maldetscan.log;
clamscan -ir $i -l /usr/local/src/scanclam.log --no-summary --quiet
sed '/[--]$/d' /usr/local/src/scanclam.log > /usr/local/src/scanclamfile.log
fi
exim -bpru | grep $malusers | awk {'print $3'}| xargs exim -Mrm
exim -bpru | grep '<>' | awk {'print $3'}| xargs exim -Mrm;
cat /usr/local/src/scanclamfile.log | grep -v -e '^$' | cut -d: -f1 >> /usr/local/src/maliciousfilesind;
for j in `cat /usr/local/src/maliciousfilesind |grep -v -e '^$'`; do
countdr=`echo $j | grep "barcodes.php"`;
if [ -z "$countdr" ]
then
echo $j
chmod 000 $j;
chown root.root $j;
echo "File permissions/Ownerhsip updated : $j" >> /usr/local/src/permissionupdatedind
fi
done