phpmussel / phpmussel Goto Github PK

PHP-based anti-virus anti-trojan anti-malware solution.

License: GNU General Public License v2.0

anti-spam anti-malware anti-virus anti-trojan antivirus security protection malware viruses uploads upload php phpmussel clamav file-upload signatures websites hacktoberfest

phpmussel's Introduction

What is phpMussel?

An ideal solution for shared hosting environments, where it's often not possible to utilise or install conventional anti-virus protection solutions, phpMussel is a PHP script designed to detect trojans, viruses, malware and other threats within files uploaded to your system wherever the script is hooked, based on the signatures of ClamAV and others.

Features:

Licensed as GNU General Public License version 2.0 (GPLv2).
Easy to install, easy to customise, easy to use.
Works for any system with PHP+PCRE installed, regardless of OS (PHP+PCRE required).
Fully configurable based on your needs.
Ideal solution for shared hosting services.
Ideal solution for forum systems in need of file upload protection.
Does NOT require shell access.
Does NOT require administrative privileges.
CLI mode available.
Good, strong, stable support base.

Documentation:

phpmussel's People

Contributors

Stargazers

Watchers

Forkers

hanigamal martinsv xxoxx tdr130 tyekrgk golpha jiania parhamcurtis rohitzidu m7mdtiger devandrei redteamcaliber wrximpreza whaleinvasion jhonthenripper modulexcite solertis bayurepo gitter-badger arturlicks shekkbuilder petk royaflash anan5a act360 asvis dj25380 ravelll thiagohps mekin webdv isc-labs ahmedkhan847 aingelc12ell ezesundayeze senky ro9ueadmin grukz tecnikan seonar22 ivoguerreiro rickardahlstedt satboy78 zshehri shadowliangliang dulumao skizap mphasize oneplus-x peytondodd ctkqiang alexander340 vncloudsco jrxyz nestorwheelock sh1nu11bi lipsworld sts0mrg0 kosisochukwu431 andrulko wprobot josh1n a-new murmurbetty 5l1v3r1 advance-dev kirti677 chabiapps kazbekkadalashvili pratikkaran23 1ndevelopment fiberian1981 webstorage119 sbinsaleem sanvu88 majin-croix-havoc criptalis edwardvillarin07 scantist-ossops-m2 ranqiang-hub

phpmussel's Issues

suggestion: custom themes / templates

I think it is a good addition to have some custom themes / templates for the phpMussel warning, for example based on Twitter Bootstrap.

I could contact some webdesigners I know to create some, so the users of phpMussel can choose between different themes / templates and phpMussel might be more appealing and looking modern.

This should be part of an additional repository (just the themes / templates). If this makes sense, I would create it and work with the designers and spread the word about phpMussel.

What do you think?

PSR

PSR Checklist

Entries will be marked upon being completed and committed to the master codebase.

PSR-1

The following markable items must be implemented.

Files MUST use only <?php and <?= tags.
Files MUST use only UTF-8 without BOM for PHP code.
Files SHOULD either declare symbols (classes, functions, constants, etc.) or cause side-effects (e.g. generate output, change .ini settings, etc.) but SHOULD NOT do both.

phpMussel versions/releases <1.0.0 don't use classes, so, the following four PSR-1 items aren't relevant for versions/releases <1.0.0; There's nothing to mark here. Any class-based phpMussel versions/releases =>1.0.0 WILL use classes, so, the following four PSR-1 items will BECOME relevant for versions/releases =>1.0.0; We will ensure that we adhere to these items during class implementation and thereafter (this should be completed prior to any official =>1.0.0 version/release).

Namespaces and classes MUST follow an "autoloading" PSR: [PSR-0, PSR-4].
Class names MUST be declared in StudlyCaps.
Class constants MUST be declared in all upper case with underscore separators.
Method names MUST be declared in camelCase.

PSR-2

1. Overview.

The following markable items must be implemented.

Code MUST follow a "coding style guide" PSR [PSR-1].
Code MUST use 4 spaces for indenting, not tabs.
There MUST NOT be a hard limit on line length; the soft limit MUST be 120 characters; lines SHOULD be 80 characters or less.

The following non-markable items relate to the implementation of classes, which versions/releases <1.0.0 don't use; This item, therefore, isn't currently relevant, but will BECOME relevant from versions/releases =>1.0.0 and thereafter. We will ensure that we adhere to these items during class implementation and thereafter (this should be completed prior to any official =>1.0.0 version/release).

There MUST be one blank line after the namespace declaration, and there MUST be one blank line after the block of use declarations.
Opening braces for classes MUST go on the next line, and closing braces MUST go on the next line after the body.
Visibility MUST be declared on all properties and methods; abstract and final MUST be declared before the visibility; static MUST be declared after the visibility.

The following markable items must be implemented.

Control structure keywords MUST have one space after them; method and function calls MUST NOT.
Reference: php.net/manual/en/language.control-structures.php
Opening braces for control structures MUST go on the same line, and closing braces MUST go on the next line after the body.
Opening parentheses for control structures MUST NOT have a space after them, and closing parentheses for control structures MUST NOT have a space before.

2. General.

2.1 Basic Coding Standard

Code MUST follow all rules outlined in PSR-1.

2.2 Files

All PHP files MUST use the Unix LF (linefeed) line ending.
All PHP files MUST end with a single blank line.
The closing ?> tag MUST be omitted from files containing only PHP.

2.3 Lines

There MUST NOT be a hard limit on line length.
The soft limit on line length MUST be 120 characters; automated style checkers MUST warn but MUST NOT error at the soft limit.
Lines SHOULD NOT be longer than 80 characters; lines longer than that SHOULD be split into multiple subsequent lines of no more than 80 characters each.
There MUST NOT be trailing whitespace at the end of non-blank lines.
Blank lines MAY be added to improve readability and to indicate related blocks of code.

Writing that we MAY do something, but NOT writing that we MUST do something; I think this can be marked by default..?

There MUST NOT be more than one statement per line.

2.4 Indenting

Code MUST use an indent of 4 spaces, and MUST NOT use tabs for indenting.

2.5 Keywords and True/False/Null

PHP keywords MUST be in lower case.

3. Namespace and Use Declarations

phpMussel versions/releases <1.0.0 don't use namespace or use, so, the following non-markable items aren't relevant for versions/releases <1.0.0; Any class-based phpMussel versions/releases =>1.0.0 WILL use namespace (and possibly will use use), so, the following non-markable items will BECOME relevant for versions/releases =>1.0.0; We will ensure that we adhere to these items during development of 1.0.0 and thereafter (this should be completed prior to any official =>1.0.0 version/release).

When present, there MUST be one blank line after the namespace declaration.
When present, all use declarations MUST go after the namespace declaration.
There MUST be one use keyword per declaration.
There MUST be one blank line after the use block.

4. Classes, Properties, and Methods

This will be addressed by phpMussel version/release 1.0.0; This won't be relevant for prior versions/releases.

5. Control Structures

There MUST be one space after the control structure keyword
There MUST NOT be a space after the opening parenthesis
There MUST NOT be a space before the closing parenthesis
There MUST be one space between the closing parenthesis and the opening brace

6. Closures

Closures MUST be declared with a space after the function keyword, and a space before and after the use keyword.
The opening brace MUST go on the same line, and the closing brace MUST go on the next line following the body.
There MUST NOT be a space after the opening parenthesis of the argument list or variable list, and there MUST NOT be a space before the closing parenthesis of the argument list or variable list.
In the argument list and variable list, there MUST NOT be a space before each comma, and there MUST be one space after each comma.
Closure arguments with default values MUST go at the end of the argument list.
Argument lists and variable lists MAY be split across multiple lines, where each subsequent line is indented once. When doing so, the first item in the list MUST be on the next line, and there MUST be only one argument or variable per line.
When the ending list (whether or arguments or variables) is split across multiple lines, the closing parenthesis and opening brace MUST be placed together on their own line with one space between them.

PSR-3

This will be addressed begin exploring a classful implementation in the future.

PSR-4

This will be addressed begin exploring a classful implementation in the future.

PSR-6

This will be addressed begin exploring a classful implementation in the future.

PSR-7

This will be addressed begin exploring a classful implementation in the future.

I've recently been reading through the PSR guidelines for PHP standards, and, although I have mixed feelings about some of their guidelines, I'm going to try to adopt at least some of them.

In particular, in PSR-2, under 2.2 Files, they write:

The closing ?> tag MUST be omitted from files containing only PHP.

This, principally, is something I've never liked doing, due to that for most programming languages, generally, anything opened should always be closed, and code should generally follow a logical order and be contained within a logical hierarchical tree (at least, so I've always read and so I've always been led to believe).

Currently, phpMussel always closes its PHP (and so, doesn't omit any closing PHP tags).

Here is an interesting article, where the author has posed the question of whether or not we should omit closing tags, and some of the comments (although many of them are now more than a few years old) are very interesting. There seem to be people with very strong views on both sides of the fence, and although many of these views contradict each other, I think many of them, on both sides, have valid points.

Minimising the risk of accidentally inserting bugs or errors in the future is definitely a good thing, but I've always felt that correctly closing any opened tag seemed more professional, so, I was at odds about this.

So, to omit, or not to omit; That is (or was..) the question.. Until I found this:

If a file is pure PHP code, it is preferable to omit the PHP closing tag at the end of the file. This prevents accidental whitespace or new lines being added after the PHP closing tag, which may cause unwanted effects because PHP will start output buffering when there is no intention from the programmer to send any output at that point in the script.

Considering it's also recommended on the PHP site itself to omit closing tags for pure PHP files (and I wasn't aware of this until just now), I think this is a change I'll need to implement for phpMussel.

Under the same section, they also write this:

All PHP files MUST end with a single blank line.

phpMussel doesn't currently do this, for the very reason that including any whitespace after a closing PHP tag could result in headers being prematurely sent, and this is something we don't want happening. However, if I'm to remove the closing PHP tags, then, appending the extra newline to the end of PHP files is something that can be easily done (because the risk of headers being prematurely sent won't be there anymore).

All PHP files MUST use the Unix LF (linefeed) line ending.

This, we're already doing (as well as quite a few other things recommended, though not everything); Figured that one out a long time ago, before I'd ever heard of PSR. 👍

Anyhow. There's a lot to read through, and a lot to do to here, so, this may be in multiple commits, but, it's something to do nonetheless. Posting this as an issue for until this is done.

false positiv on some PDF files

Some, not all, PDFs make problems.

Detected phpMussel-PHP.Packer.RX-00 (066DLM_Starfleet_Diploma.pdf)!
Detected phpMussel-HEUR.PDF.Exploit.1505X.A (Contao-Symfony-Timon-Schroeter.pdf)!

Thu, 19 Nov 2015 19:43:43 +0100 Started.
> Checking '066DLM_Starfleet_Diploma.pdf' (FN: c71a1232; FD: 45f2bf79):
-> Detected phpMussel-PHP.Packer.RX-00!
Thu, 19 Nov 2015 19:43:46 +0100 Finished.

Thu, 19 Nov 2015 19:54:57 +0100 Started.
> Checking 'Contao-Symfony-Timon-Schroeter.pdf' (FN: 286f271a; FD: 42d5cd5c):
-> Detected phpMussel-HEUR.PDF.Exploit.1505X.A!
Thu, 19 Nov 2015 19:55:03 +0100 Finished.

suggestion: website

You can create a website using GitHub pages easily.

https://pages.github.com/

If you want to generate it using existing templates there is the generator in the settings:
https://github.com/Maikuolan/phpMussel/settings called Automatic page generator

Or you use custom HTML using Custom and Jekyll-based sites

Then you have a branch called gh-pages where the code for the website belongs.
If you need a domain (I also have some free domains left) you can easily point the domain to the GitHub page with special DNS settings

https://help.github.com/articles/setting-up-a-custom-domain-with-github-pages/
https://help.github.com/articles/adding-a-cname-file-to-your-repository/

Pretty easy, isn't it?
So you don't need your own hosting for this and you can optionally use your own domains.

list phpMussel on public software repositories

I am currently collecting some websites where phpMussel is missing and can be added (just links to the phpMussel website, repository and so on):

I don't know if phpMussel should be listed on all of these websites (I will collect some more in the future).

This list is just meant as a help to create and track future listings.
I would say at least Wikipedia and alternativeTo. I will help with the creation of the listings when needed.

2 testfiles (metadata_testfile) not detected

The two metadata_testfile archives are not detected by phpMussel. Is this by intention or do I have to configure something?

Wrote now a small tool to automate the uploads and test many files at once. Will send you the final version of it in the next days.

Wish list: Translations audit.

I've done a handful of multilingual translations for phpMussel, though, unfortunately, the only language that I actually speak or know fluently is English, and so, although the translations that I've done have been done to the best of my abilities and have been done accurately to the best of my knowledge, it wouldn't surprise me in the slightest if there were, in fact, numerous errors in my translations.

Credit for the German translations goes to BlueEyed Zebra, for whose assistance I am very grateful for (I haven't done any of the German translations myself at all). I had assistance with getting the Indonesian translations done in the early days, but have since entirely taken over that myself, and all the others I've done entirely by myself.

For any currently supported languages (other than English, German and Indonesian, at this time, includes Spanish, French, Italian and Portuguese; Dutch is also partially supported, although I haven't yet gotten around to finishing complete support for it), if any native speakers thereof could give them a quick look over and confirm if there are any errors or not (and if there are any errors, point them out to me or try to correct them), that would be greatly appreciated, and for any languages not currently supported, if there are any native speakers thereof that would be willing to work towards making their language supported, that would also be very welcomed.

Also as a quick question to anyone that might know: Regarding non-ASCII languages (such as Chinese, Japanese, Russian, Korean, Greek, etcetera); Any idea how that could be made to work with CLI functionality? Easy enough to get the right encoding for the browser-side of things most of the time, but I don't have much experience dealing with it when it comes to CLI.

suggestion: block password protected / encrypted archives

We could check if an archive has a password / is encrypted (and block if set in configuration) as a custom password would change the CRC and encrypted files can not be checked / scanned. They would be flagged as benign but are higly malicious.

RAR:
0x04 - file encrypted with password
0x0080 - Block headers are encrypted
http://forensicswiki.org/wiki/RAR

ZIP: check first bit of the seventh byte
http://stackoverflow.com/questions/12081839/how-to-check-if-encrypted-zip-archive-in-php
https://github.com/CuteNews/cutenews-2.0/blob/master/core/zip.class.php

https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT

4.4.4 general purpose bit flag: (2 bytes)
        Bit 0: If set, indicates that the file is encrypted.

Some version info can also be used (not all versions listed, 6.3 can also be unencrypted) to check if the file is password protected / encrypted

4.4.3 version needed to extract (2 bytes)
        2.0 - File is encrypted using traditional PKWARE encryption
        5.0 - File is encrypted using DES
        5.0 - File is encrypted using 3DES
        5.0 - File is encrypted using original RC2 encryption
        5.0 - File is encrypted using RC4 encryption
        5.1 - File is encrypted using AES encryption
        5.1 - File is encrypted using corrected RC2 encryption**
        5.2 - File is encrypted using corrected RC2-64 encryption**
        6.1 - File is encrypted using non-OAEP key wrapping
        6.2 - Central directory encryption
        6.3 - File is encrypted using Blowfish
        6.3 - File is encrypted using Twofish

In reference to #2

This ticket was created to track it for future commits.

Correctly parsing filenames in CLI-mode bug

I found a bug relating to the ability of phpMussel to correctly parse non-ANSI/non-ASCII filenames in CLI-mode when recursively scanning directories.

Filenames aren't currently being parsed correctly, resulting in mangled filenames appearing in the scan_log and/or files not consequently being found by phpMussel after searching a directory, resulting in scan entries being listed as "invalid files".

I don't currently have a fix for this issue.

I'm creating this issue here to track progress.

I believe the bug relates to the way in which Windows encodes filenames based upon code page tables, to the way in which PHP consequently reads and handles non-ANSI/non-ASCII filenames, and in phpMussel not accounting for a difference that exists between those two, resulting in the inconsistent reading of non-ANSI/non-ASCII filenames.

Some things I found online:

http://stackoverflow.com/questions/18204364/php-upload-utf-8-filename
http://stackoverflow.com/questions/15684348/cant-read-utf-8-file-names
http://stackoverflow.com/questions/2050973/what-encoding-are-filenames-in-ntfs-stored-as/2051018#2051018

This bug doesn't affect phpMussel when used for servers or websites.

Wish list: TAR support.

Would like phpMussel to have the ability to read and parse TAR files. Not quite sure how to go about this at the moment; Help and/or suggestions invited.

Undefined index: eof in phpmussel.inc line 9050

I downloaded the code from master and I am getting the error Undefined index: eof [APP/vendors/phpmussel/vault/phpmussel.inc, line 9050].

This is my usage
$results=phpMussel($this->data['Resource']['file']['tmp_name'],true , true);
echo $results;
exit();

Notice (8): Undefined index: eof [APP/vendors/phpmussel/vault/phpmussel.inc, line 9050]

Behavioural inconsistency

Discovered a non-critical but significant inconsistency between the behaviour of phpMussel in relation to the integers returned upon encountering various errors during scanning and the documentation of that behaviour. I want to get this fixed before my next commit, so, my next commit may be slightly delayed, but, I still nonetheless hope to get it in very soon (late today or early tomorrow).

Additionally, I found a non-critical bug in the behaviour of fail_silently; Should be easy to fix, but, it's something I only just noticed during my most recent editing (for adding in TAR support) and has been around for a while I think.

Creating this issue to track progress.

Behaviour/documentation inconsistency.

Finished correcting documentation.
Finished correcting core code.
Finished pre-commit testing and verifying changes.
Committed.
Finished post-commit testing and verifying changes.

fail_silently bug.

Finished correcting core code.
Finished pre-commit testing and verifying changes.
Committed.
Finished post-commit testing and verifying changes.

$vault variable configurable from outside

Hey,
I talked to @DanielRuf the other day and he told me about this project and I quite like it.
I would like to contribute a Drupal module that uses phpMussel as a library.
To efficiently do this I need some things, so most of the issues I will post will originate from building a Drupal module :-)

I don't like it that the $vault needs to be a absolute path. Would it be possible to make it relative? I am usually doing continuous integration with deployment via git. If I now add the absolut path for my development machine it will not work on the dev, stage and live servers without manually changing those files.
$vault being in the phpmussel.php file means whenever I want to update this file I override my customization. This again is not very useful.
Also when I use phpMussel as a library I don't want to change anything in it's code at all.

When relative path is possible I think it should by default point to the vault where it is when you download the repo.
But I also think it would be great to pass in the vault location.
I could create a pull request, but I think we should discuss this first :-)

How about something like this:

if(!empty($external_vault){
$vault = external_vault;
}else{
$vault='vault/';
}

Then via $external_vault I could pass in the vault location.

Other solution might be to create a default_config.inc that needs to be copied to config.inc and then customized.
But then I need to do stuff again which I don't want to.

What do you think?

solution: ERR_CONNECTION_RESET when uploading on Windows (Apache / XAMPP)

When uploading some files like html_standard_testfile.html on a Windows machine where XAMPP (Apache) is running, the site loads very long and then the connection is reset.

This is a known PHP problem in Apache.
You will see this in the error.log file of Apache:

[Thu Jun 25 23:07:16.413547 2015] [mpm_winnt:notice] [pid 7744:tid 388] AH00428: Parent: child process 7332 exited with status 3221225725 -- Restarting.

Try adding this to the end of httpd.conf (you should find this file at C:/xampp/apache/conf/httpd.conf):

<IfModule mpm_winnt_module>
   ThreadStackSize 8388608
</IfModule>

References:
http://stackoverflow.com/questions/5058845/how-do-i-increase-the-stack-size-for-apache-running-under-windows-7
http://stackoverflow.com/a/7597506/753676
http://www.codexpedia.com/apache-server/parent-child-process-exited-with-status-3221225725-restarting-on-xamp-apache/

The default stack size for Linux is 8MB, for Windows it is 1MB.
https://bugs.php.net/bug.php?id=60231

 [2013-05-27 15:11 UTC] frank dot ralf at comm-press dot de
The solution is increasing the ThreadStackSize from 1 MB (default under Windows) to 8 MB (default under Linux), see http://stackoverflow.com/questions/5058845/how-do-i-increase-the-stack-size-for-apache-running-under-windows-7 for details.

http://stackoverflow.com/questions/5058845/how-do-i-increase-the-stack-size-for-apache-running-under-windows-7

So actually this is not a bug (but maybe a misconfiguration of the default Apache under Windows).

some warnings produced when using phpMussel() and cache not filled

When I run this code (Windows 7, XAMPP Version: 5.6.3, Apache with increased stacksize - 8MB)

<?php
include 'phpmussel.php';
echo phpMussel("_testfiles/ascii_standard_testfile.txt");

I get these warnings:

Warning: preg_match(): \vault\phpmussel.inc on line 1030

Warning: preg_match(): Unknown modifier ')' in \vault\phpmussel.inc on line 1030

Warning: preg_match(): Unknown modifier ']' in \vault\phpmussel.inc on line 1030

Warning: preg_match(): Compilation failed: numbers out of order in {} quantifier at offset 197 in \vault\phpmussel.inc on line 6810

Warning: preg_match(): Compilation failed: numbers out of order in {} quantifier at offset 197 in \vault\phpmussel.inc on line 6810

Warning: preg_match(): Compilation failed: regular expression is too large at offset 286 in \vault\phpmussel.inc on line 6810

Warning: preg_match(): Compilation failed: regular expression is too large at offset 286 in \vault\phpmussel.inc on line 6810

Warning: preg_match(): Compilation failed: regular expression is too large at offset 132 in \vault\phpmussel.inc on line 6810

Warning: preg_match(): Compilation failed: regular expression is too large at offset 132 in \vault\phpmussel.inc on line 6810

2

At least these are just warnings and not critial errors, we can suppress this using error_reporting(0); and so on.

Increasing the PCRE values does not remove these warnings: http://stackoverflow.com/questions/8268624/php-preg-match-all-limit

Wish list: Icon parsing.

ClamAV is able to read and parse the icons of PE files and then check those icons against its database to help ascertain whether or not a particular PE file should be trusted.

phpMussel hasn't yet been coded to do this, and thus, at this time, can't make use of that part of the ClamAV signatures database.

Not a high priority, but, something that nonetheless would be cool to amend.

no more phpMussel($what_to_scan,2)?

There was an option for saving the result into a global variable (what is the name of it?) using 2 as value
https://github.com/Maikuolan/phpMussel/blob/master/_docs/readme.en.md#3a-how-to-use-for-web-servers

But it seems this was removed?

Before:
https://github.com/Maikuolan/phpMussel/blob/3ab6285dc2657ab9167bf58186e2d9924c9d5411/vault/phpmussel.inc#L860

After:
https://github.com/Maikuolan/phpMussel/blob/41dd96faee05f5402a117083d8f5fde9a32f62cd/vault/phpmussel.inc#L9957

False positives testing methods

I've been thinking recently about what methods are available for testing phpMussel for false positives.

Testing how effective phpMussel is against a very specific malicious threat is easy enough - All we really need to do is try to scan samples of the malicious threat, file and etc, using phpMussel, to see whether or not it can be detected.

Somewhat trickier, however, is when a new detection method or new set of signatures is written, knowing precisely how reliable and safe that new detection method or new set of signatures is, and what the chances are of it resulting in false positives.

So far, with each new minor version release, I've ran a phpMussel scan against instances of %root%/Windows/* and %root%/Program Files/* directories known to be clean, to see if false positives were generated; This has been somewhat helpful, and I've found a few false positives in the past that have led to changes to the signatures and a few changes to the core code, but, this method is also extremely slow and tedious, and I'm not sure how reliable it actually is. One of the bigger problems with this method is in that phpMussel is ideally designed for webservers and websites, but not really targeted towards personal OS or desktop use anyhow, and so, testing in this way doesn't necessarily accurately reflect the types of files likely to be seen by phpMussel in actual deployment, nor does it necessarily accurately test for scalability.

Creating this issue as a way to let others know about this dilemma, to provide a place to discuss it and to hopefully generate some new ideas.

add signatures for other webshells

Some webshells are not detected.

I have tested around 1200 files and asp, aspx, ps1, jsp, cfm, cgi, java and so on are not detected, although there are (known) webshells using these filetypes.

I have used the repositories here:
https://github.com/stars/DanielRuf?utf8=%E2%9C%93&q=shell

Some more:
https://github.com/Neo23x0/Loki/blob/master/signatures/thor-webshells.yar
https://github.com/Neo23x0/Loki/tree/master/signatures

Quality Assurance (duplicate code and other things)

It seems there are some code parts duplicate and the conditions can be merged, because the checks for the magic number and the extension use the same code:

https://github.com/Maikuolan/phpMussel/blob/5a52600f77dc26ad16671287e704e57afab094dd/vault/phpmussel.inc#L11743
https://github.com/Maikuolan/phpMussel/blob/5a52600f77dc26ad16671287e704e57afab094dd/vault/phpmussel.inc#L11726

https://github.com/Maikuolan/phpMussel/blob/5a52600f77dc26ad16671287e704e57afab094dd/vault/phpmussel.inc#L11734
https://github.com/Maikuolan/phpMussel/blob/5a52600f77dc26ad16671287e704e57afab094dd/vault/phpmussel.inc#L11751

idea: plugin system

Yes, this is just a very rough (and maybe not needed) idea, but this just came into my mind and it is better to think about this as soon as possible and ease the process to extend phpMussel and create an ecosystem fromt this later.

I had some ideas about additional features, but these should not be part of the phpMussel core.

Instead we should create a simple plugin system using hooks.

We could for example create this with call_user_func and an array like this:

call_user_func('before_scan',$GLOBALS['events']['before_scan']);
call_user_func('after_scan',$GLOBALS['events']['after_scan']);
...

and fill the array in plugin configuration files

$GLOBALS['events']['before_scan']['plugin_test']['dir']=__DIR__;
// or $GLOBALS['events']['before_scan']['plugin_test']['dir']=dirname(__FILE__);
$GLOBALS['events']['before_scan']['plugin_test']['file']="index.php";
$GLOBALS['events']['before_scan']['plugin_test']['function']="plugin_test_event";

and later process this for the individual events

So in the end, the logic is like this:

$GLOBALS['events'] = array();
//register plugin for event in the individual plugins which are auoloaded
$GLOBALS['events']['before_scan']['plugin_test']['dir']=__DIR__;
// or $GLOBALS['events']['before_scan']['plugin_test']['dir']=dirname(__FILE__);
$GLOBALS['events']['before_scan']['plugin_test']['file']="index.php";
$GLOBALS['events']['before_scan']['plugin_test']['function']="plugin_test_event";

//hook all registered plugins for event in phpMussel core
call_user_func('before_scan',$GLOBALS['events']['before_scan']);

//run registered plugins in phpMussel core
    // traverse all elements in $subscribers, each one is a plugin
    foreach ($subscribers as $key => $subscriber_values) {
        // $subscriber_values['file'];
        // $subscriber_values['function'];
        // $subscriber_values['dir'];
        // optionally include using $subscriber_values['dir'] and $subscriber_values['file'] if not autoloaded
        // execute function defined in $plugin['function'] with call_user_func or $plugin['function']()
        call_user_func($subscriber_values['function']);
    }
}

Just some ideas for possible plugins that I had or could make sense:

Plugin boilerplate: https://github.com/phpMussel/plugin-boilerplate-v1

Webshells -> tennc/webshell

This issue is related to and should be considered a sub-issue of: #29

I'm posting this as a sub-issue due to the size of the data here, to maintain readability of its parent issue.

Results from phpMussel scanning against: https://github.com/tennc/webshell

This scan uses the default phpMussel configuration and no deeper analysis of the files has yet to be done. Although most of the scanned files should be considered malicious, there are certain files (such as the README files created by the repo manager, for example) that should be disregarded.

Additionally scanning with modified configuration will be done shortly, to account for things like blacklisted filetypes (because files whose filetypes are blacklisted aren't checked against the phpMussel signatures, the results here aren't a reliable indicator for the level of protection provided by the signatures in regards to those specific files).

I've posted these results immediately upon completing the scan and haven't yet investigated further. Manual analysis of these results will happen shortly.

 <?php die(); ?>

 Wed, 29 Jul 2015 22:57:44 +0800 Started.
 --> Checking 'Ajan.asp.txt' (FN: de2e30fb; FD: b9336af6):
 ---> No problems found.
 --> Checking 'Ajax_PHP Command Shell.txt' (FN: 5f817131; FD: 27d29060):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Antichat Shell v1.3.txt' (FN: 777f0e43; FD: 27153bfa):
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Asmodeus v0.1.pl.txt' (FN: de16f39c; FD: e269a6f4):
 ---> No problems found.
 --> Checking 'Ayyildiz Tim  -AYT- Shell v 2.1 Biz.txt' (FN: 5e6a3b57; FD: bbad76ec):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'aZRaiLPhp v1.0.txt' (FN: 5fda2738; FD: c3f185f2):
 ---> No problems found.
 --> Checking 'accept_language.txt' (FN: b6ce6f6b; FD: c2f3a402):
 ---> No problems found.
 --> Checking 'Blind Shell.cpp.txt' (FN: dbe81a7e; FD: 934b6b73):
 ---> No problems found.
 --> Checking 'backdoor1.txt' (FN: 3e973b5b; FD: a878f328):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'backdoorfr.txt' (FN: 949a06c4; FD: c2223ed1):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'backup.php.txt' (FN: 1ded80f8; FD: 12cbb53d):
 ---> No problems found.
 --> Checking 'backupsql.php.txt' (FN: 904ec456; FD: 72ae47d6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'backupsql.txt' (FN: c6dec180; FD: 72ae47d6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'CMD.asp.txt' (FN: dad5e6d6; FD: e9206ce3):
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'Casus15.php.txt' (FN: 9c7d5196; FD: 7cc3c849):
 ---> No problems found.
 --> Checking 'CmdAsp.asp.txt' (FN: 62318b14; FD: 18531dd8):
 ---> Detected phpMussel-FN.Generic-04.B!
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'Crystal.txt' (FN: 8c98948b; FD: bbfac551):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'CyberSpy5.Asp.txt' (FN: ff029060; FD: cfe97edf):
 ---> No problems found.
 --> Checking 'c100.txt' (FN: 339237a6; FD: 03b87cf3):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c2007.php.txt' (FN: f0ecaf5b; FD: 34700caf):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99(1).php.txt' (FN: 032d18e6; FD: 1307c9fa):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'c99.txt' (FN: 0bed5bce; FD: a2dce4e8):
 ---> Detected ClamAV-PHP.C99!
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'cgi-python.py.txt' (FN: 69641fc6; FD: 13c9d954):
 ---> No problems found.
 --> Checking 'connectback2.pl.txt' (FN: cee8ee8d; FD: 699bd48b):
 ---> No problems found.
 --> Checking 'ctt_sh.php.txt' (FN: d3ffd884; FD: d2e72264):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'ctt_sh.txt' (FN: 0efd5e51; FD: d2e72264):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'cybershell.php.txt' (FN: 6c1881d0; FD: 5e34a23b):
 ---> No problems found.
 --> Checking 'cybershell.txt' (FN: 98f1147a; FD: 5e34a23b):
 ---> No problems found.
 --> Checking 'DTool Pro.txt' (FN: 301a0a92; FD: 5807c6ad):
 ---> Detected ClamAV-PHP.Defash.A!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Dive Shell 1.0 - Emperor Hacking Team.txt' (FN: 5754ce1c; FD: 040bb035):
 ---> No problems found.
 --> Checking 'Dx.php.txt' (FN: 81da3d8c; FD: 06f51a98):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Dx.txt' (FN: 4f321c8d; FD: 06f51a98):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'DxShell_hk.php.txt' (FN: c0e95eae; FD: a607903c):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'dC3 Security Crew Shell PRiV.txt' (FN: 4d136c07; FD: 22c48899):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 --> Checking 'EFSO_2.asp.txt' (FN: 598608a6; FD: 64e33942):
 ---> No problems found.
 --> Checking 'Elmali Seker.asp.txt' (FN: 95970d41; FD: fe8f7a0f):
 ---> No problems found.
 --> Checking 'elmaliseker.asp.txt' (FN: 9c6dd351; FD: fe8f7a0f):
 ---> No problems found.
 --> Checking 'Fatalshell.php.txt' (FN: b606d511; FD: 48944c22):
 ---> Detected ClamAV-PHP.ShellExec!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'fuckphpshell.txt' (FN: 01e35b64; FD: 0a53a7bb):
 ---> Detected phpMussel-FN.Shell.Generic-1!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'GFS web-shell ver 3.1.7 - PRiV8.txt' (FN: 6802ec14; FD: 811667b1):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'gfs_sh.php.txt' (FN: 6a90ad81; FD: f0d64122):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'gfs_sh.txt' (FN: 8fe59dc5; FD: f0d64122):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'h4ntu shell [powered by tsoi].txt' (FN: be6deb7f; FD: a0672c2b):
 ---> No problems found.
 --> Checking 'Inderxer.asp.txt' (FN: 4597f9ed; FD: 26874d43):
 ---> No problems found.
 --> Checking 'iMHaPFtp.php.txt' (FN: 2c0cd71b; FD: 60090f0e):
 ---> No problems found.
 --> Checking 'iMHaPFtp.txt' (FN: ad80546a; FD: 60090f0e):
 ---> No problems found.
 --> Checking 'img.php.txt' (FN: e27fe911; FD: 0adfbd2a):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 ---> Detected phpMussel-Graphics.Code.Embed-002.3!
 ---> Detected phpMussel-Graphics.Code.Embed-005.2!
 ---> Detected phpMussel-Graphics.Code.Embed-005.3!
 ---> Detected phpMussel-Graphics.Code.Embed-006.3!
 ---> Detected phpMussel-Graphics.Code.Embed-013.4!
 ---> Detected phpMussel-Graphics.Code.Embed-014!
 ---> Detected phpMussel-Graphics.Code.Embed-015.4!
 ---> Detected phpMussel-Graphics.Code.Embed-017!
 ---> Detected phpMussel-Graphics.Code.Embed-019!
 ---> Detected phpMussel-Graphics.Code.Embed-021!
 ---> Detected phpMussel-Graphics.Code.Embed-022!
 ---> Detected phpMussel-Graphics.Code.Embed-028!
 ---> Detected phpMussel-Graphics.HTML.Embed-02!
 ---> Detected phpMussel-Graphics.HTML.Embed-07!
 ---> Detected phpMussel-Graphics.HTML.Embed-08!
 ---> Detected phpMussel-Graphics.HTML.Embed-11!
 ---> Detected phpMussel-Graphics.JS.Event-11!
 ---> Detected phpMussel-Graphics.PHP.Embed-03!
 ---> Detected phpMussel-Graphics.PHP.Embed-04!
 ---> Detected phpMussel-Graphics.PHP.Embed-05!
 ---> Detected phpMussel-Graphics.PHP.Embed-07!
 ---> Detected phpMussel-Graphics.PHP.Embed-08!
 ---> Detected phpMussel-Chameleon.Graphics.Shell.Webshell-01!
 ---> Detected phpMussel-Graphics.Defacement.Generic-000!
 --> Checking 'indexer.asp.txt' (FN: 61da410c; FD: 26874d43):
 ---> No problems found.
 --> Checking 'ironshell.txt' (FN: d1a0f309; FD: af75d42e):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Java Shell.js.txt' (FN: 378d21bb; FD: 66b88133):
 ---> No problems found.
 --> Checking 'JspWebshell 1.2.txt' (FN: 4f348255; FD: 6100a46c):
 ---> No problems found.
 --> Checking 'KAdot Universal Shell v0.1.6.html.txt' (FN: d2c42a94; FD: 2b930d27):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'Klasvayv.asp.txt' (FN: 4c338b2e; FD: c9f88ec8):
 ---> Detected phpMussel-HTML.Defacement.Turkey-10!
 ---> Detected phpMussel-HTML.Defacement.Turkey-11!
 ---> Detected phpMussel-HTML.Defacement.Turkey-12!
 ---> Detected phpMussel-HTML.Defacement.Turkey-13!
 --> Checking 'Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.txt' (FN: 8eec496a; FD: c97bb4ce):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'lamashell.txt' (FN: 1e6e9d5a; FD: 6fd82037):
 ---> No problems found.
 --> Checking 'load_shell.php.txt' (FN: c0af6c54; FD: 890dbaf6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'load_shell.txt' (FN: d6345cdb; FD: 890dbaf6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'lurm_safemod_on.cgi.txt' (FN: 4399008b; FD: fd73ea58):
 ---> No problems found.
 --> Checking 'Moroccan Spamers Ma-EditioN By GhOsT.txt' (FN: d5e3d825; FD: 2e03197c):
 ---> No problems found.
 --> Checking 'MySQL Web Interface Version 0.8.txt' (FN: 1417699c; FD: 8711b37a):
 ---> No problems found.
 --> Checking 'Mysql interface v1.0.txt' (FN: fb62f9e3; FD: c919cdea):
 ---> No problems found.
 --> Checking 'mailer3.php.txt' (FN: a6f6ab4d; FD: 2e03197c):
 ---> No problems found.
 --> Checking 'matamu.txt' (FN: af93870b; FD: 000e017d):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'myshell.php.txt' (FN: eacf4d68; FD: 7de9d1be):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql.php.txt' (FN: 852e7cce; FD: e4cf57ac):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql_shell.txt' (FN: 141b508d; FD: a57d9517):
 ---> No problems found.
 --> Checking 'mysql_tool.php.txt' (FN: 77031e62; FD: 77491489):
 ---> No problems found.
 --> Checking 'NCC-Shell.txt' (FN: ebdbe7df; FD: 0d3c694b):
 ---> Detected phpMussel-Defacement.X-000!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.txt' (FN: 0e1a4085; FD: 345a14bc):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'NT Addy.asp.txt' (FN: a48756f2; FD: 6cc36e46):
 ---> No problems found.
 --> Checking 'NetworkFileManagerPHP.txt' (FN: ea25dca7; FD: cb317ab1):
 ---> No problems found.
 --> Checking 'Nshell (1).php.txt' (FN: c968572b; FD: a507e652):
 ---> No problems found.
 --> Checking 'network.php.txt' (FN: 0ba37a93; FD: cb317ab1):
 ---> No problems found.
 --> Checking 'nshell.php.txt' (FN: 51e8960b; FD: 0593b6ba):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'nstview.php.txt' (FN: 6945a091; FD: 990eb15d):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'ntdaddy.asp.txt' (FN: 84233071; FD: 6cc36e46):
 ---> No problems found.
 --> Checking 'PH Vayv.php.txt' (FN: ed577413; FD: be834afa):
 ---> No problems found.
 --> Checking 'PHANTASMA.txt' (FN: 0a5e56f3; FD: b74ceafc):
 ---> Detected ClamAV-PHP.Exploit.E!
 --> Checking 'PHP Backdoor Connect.pl.txt' (FN: e23b4aaa; FD: fcbcd429):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'PHP Shell.php.txt' (FN: e90386fb; FD: eae134b1):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'PHPRemoteView.txt' (FN: 240507c4; FD: fdb8ddb3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Phyton Shell.py.txt' (FN: f0d5be16; FD: b028dfd5):
 ---> No problems found.
 --> Checking 'Private-i3lue.txt' (FN: 8ce4459e; FD: 4405c3df):
 ---> No problems found.
 --> Checking 'pHpINJ.php.txt' (FN: 20a003bd; FD: 763ed0ca):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'perlbot.pl.txt' (FN: af9c361f; FD: 8ac9c460):
 ---> Detected ClamAV-Perl.Shellbot-1!
 --> Checking 'php-backdoor.txt' (FN: e1f630b4; FD: f567a36b):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'php-include-w-shell.txt' (FN: 35a9b70f; FD: 9cd714fe):
 ---> Detected ClamAV-PHP.Exploit.E!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'phpbackdoor15.txt' (FN: 5f2c34bf; FD: 915f4ea2):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'phpjackal.txt' (FN: 0305d4f3; FD: 78042f09):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'phpshell17.txt' (FN: 4c848b79; FD: 20b0adf9):
 ---> Detected phpMussel-FN.Shell.Generic-1!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'phvayv.php.txt' (FN: 029629bd; FD: be834afa):
 ---> No problems found.
 --> Checking 'pws.php.txt' (FN: f6641103; FD: ec7d61f2):
 ---> No problems found.
 --> Checking 'pws.txt' (FN: 7acaf669; FD: ec7d61f2):
 ---> No problems found.
 --> Checking 'ru24_post_sh.txt' (FN: 2f399246; FD: 4d1dc410):
 ---> No problems found.
 --> Checking 'Rader.asp.txt' (FN: ca01d3cd; FD: 8c480e8f):
 ---> No problems found.
 --> Checking 'Rem Exp.asp.txt' (FN: 0cbc9303; FD: 50042a42):
 ---> No problems found.
 --> Checking 'Rem View.php.txt' (FN: bf0b4c29; FD: fdb8ddb3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Russian.php.txt' (FN: f48dc60a; FD: fc06a1c8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'r57 Shell.php.txt' (FN: 1c8f9f7f; FD: 4218ba71):
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r57.php.txt' (FN: b7392d54; FD: d969ae9c):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r577.php.txt' (FN: 949c99ed; FD: 2d055253):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'rootshell.txt' (FN: 20551743; FD: 73c2f1d1):
 ---> No problems found.
 --> Checking 'ru24_post_sh.php.txt' (FN: 657bda92; FD: 4d1dc410):
 ---> No problems found.
 -> Checking 'README.md' (FN: 099368d6; FD: a85e100d):
 --> No problems found.
 --> Checking 'Safe0ver Shell -Safe Mod Bypass By Evilc0der.txt' (FN: 02b8714c; FD: ee7c2c88):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.txt' (FN: 7d37fa01; FD: 46cf0591):
 ---> No problems found.
 --> Checking 'Server Variables.asp.txt' (FN: 23e7b5c7; FD: 83b9fcfd):
 ---> No problems found.
 --> Checking 'SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.txt' (FN: 86ffd954; FD: 2dfa4daa):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Iran-00!
 ---> Detected phpMussel-PHP.Shell.Iran-02!
 --> Checking 'SimShell 1.0 - Simorgh Security MGZ.txt' (FN: 90b35bcf; FD: 336fdc06):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Sincap.php.txt' (FN: 7b1e376e; FD: 325eb4b2):
 ---> No problems found.
 --> Checking 'SnIpEr_SA Shell.txt' (FN: e4ada39c; FD: 317148b0):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 's.php.txt' (FN: 915d7853; FD: 867c7471):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 's72 Shell v1.1 Coding.txt' (FN: 2467f91f; FD: a4cd39ee):
 ---> No problems found.
 --> Checking 'shell.php.txt' (FN: c86173e7; FD: 000e017d):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'shellbot.pl.txt' (FN: 0e17e052; FD: f00055ed):
 ---> Detected ClamAV-Perl.Shellbot-1!
 --> Checking 'simple-backdoor.txt' (FN: 1a2386d2; FD: a394f81f):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'simple_cmd.txt' (FN: 163804ae; FD: 5fecb588):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'smtpd.py.txt' (FN: 2b1895c6; FD: 5ea99f7c):
 ---> No problems found.
 --> Checking 'spy.php.txt' (FN: 1874e6e5; FD: ff0b5c68):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'sql.php.txt' (FN: 11e18ae5; FD: a57d9517):
 ---> No problems found.
 --> Checking 'Test.php.txt' (FN: 6b60a2c9; FD: 0feeb9d1):
 ---> Detected phpMussel-Defacement.X-000!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 --> Checking 'Tool.asp.txt' (FN: 0bfd1e60; FD: f6e27b0c):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'telnet.cgi.txt' (FN: f035bf16; FD: 4143775e):
 ---> No problems found.
 --> Checking 'telnet.pl.txt' (FN: 053fab23; FD: ce00a360):
 ---> No problems found.
 --> Checking 'telnetd.pl.txt' (FN: bb87c8d9; FD: 77e027e0):
 ---> No problems found.
 --> Checking 'Uploader.php.txt' (FN: d357e7b3; FD: e886aed9):
 ---> No problems found.
 --> Checking 'WebShell.cgi.txt' (FN: 7bea744d; FD: fbb4f46d):
 ---> No problems found.
 --> Checking 'WinX Shell.txt' (FN: 4768e643; FD: 983f014b):
 ---> No problems found.
 --> Checking 'Worse Linux Shell.txt' (FN: 84682eb4; FD: a8955655):
 ---> Detected ClamAV-PHP.Remoteadmin-2!
 --> Checking 'w.php.txt' (FN: ccb1295f; FD: 2346e516):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 --> Checking 'w3d.php.txt' (FN: 80af8ce2; FD: 1d20399e):
 ---> No problems found.
 --> Checking 'w4k.php.txt' (FN: bdca584a; FD: d5939c65):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'wacking.php.txt' (FN: d36a2566; FD: d5939c65):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'webshell.txt' (FN: 4c576c48; FD: 3f5d1006):
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'xinfo.php.txt' (FN: b983ab63; FD: 5d17e8b0):
 ---> No problems found.
 --> Checking 'Zehir 4.asp.txt' (FN: 5b3cabde; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'zacosmall.php.txt' (FN: 6e3bd933; FD: 70897ec8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'zacosmall.txt' (FN: fa9cd59f; FD: 70897ec8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'zehir4.asp.txt' (FN: 685bf9ab; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'devilzShell.asp' (FN: ece4f4cc; FD: 75035899):
 ---> No problems found.
 --> Checking 'devilzShell.aspx' (FN: 1ee27cec; FD: ed175437):
 ---> No problems found.
 --> Checking 'devilzShell.cgi' (FN: a5a55f37):
 ---> Filetype blacklisted.
 --> Checking 'devilzShell.jsp' (FN: e0b11b2d; FD: d8673789):
 ---> No problems found.
 --> Checking 'devilzShell.php' (FN: 5836f611):
 ---> Filetype blacklisted.
 -> Checking 'devshell.asp' (FN: e7e00e9f; FD: cd79e56e):
 --> No problems found.
 -> Checking 'devshell.aspx' (FN: ec8b7858; FD: ed175437):
 --> No problems found.
 -> Checking 'devshell.cfm' (FN: b0d7503c; FD: b746fdd9):
 --> No problems found.
 -> Checking 'devshell.cgi' (FN: aea1a564):
 --> Filetype blacklisted.
 -> Checking 'devshell.jsp' (FN: ebb5e17e; FD: d8673789):
 --> No problems found.
 -> Checking 'devshell.php' (FN: 53320c42):
 --> Filetype blacklisted.
 -> Checking 'readme.md' (FN: dbf634b3; FD: b7930256):
 --> No problems found.
 > Checking 'README.md' (FN: 099368d6; FD: 62553afa):
 -> No problems found.
 -> Checking '08Õ¦Åþ äÕåàÚâ¿õ¦ñµÁüõ©ôþö¿.asp.txt' (FN: 0e387f5c; FD: 1e911bd2):
 --> No problems found.
 -> Checking '1d.asp' (FN: 4fb98635; FD: 999439d9):
 --> No problems found.
 -> Checking '2013110125027897.asp' (FN: 1729a3b6; FD: 316e6a6e):
 --> No problems found.
 -> Checking '404.asp' (FN: cc7465c7; FD: 85198204):
 --> No problems found.
 -> Checking '80secÕåàÚâ¿õ©ôþö¿Þ çõ©ûþòîµØÇÞ¢»õ æþº»µ£ÇÕ¦ÅÕèƒÞâ¢ÞÂàÕ ¦ÞÂàþîøÕ«çÕ«Öþ¼¼õ©Çasp.txt' (FN: 78d1098e; FD: c35fe017):
 --> No problems found.
 -> Checking 'ASPXspy2.aspx' (FN: 79f697e4; FD: 0c5c3c7a):
 --> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 -> Checking 'ASPõ©ÇÕÅÑÞ»Ø.txt' (FN: ae0eb1f6; FD: 8f6a12d8):
 --> No problems found.
 -> Checking 'ASPõ©ÇÕÅÑÞ»Ø02.txt' (FN: 0fdea177; FD: 9fb8f78d):
 --> No problems found.
 -> Checking 'Ajan.asp' (FN: 17963971; FD: b9336af6):
 --> No problems found.
 -> Checking 'Aspµ£Çµû¦ÕÅÿÕ¢óõ©ÇÕÅÑÞ»Ø.asp' (FN: e1453f50; FD: 825a6dcf):
 --> No problems found.
 -> Checking 'Aspµ£Çµû¦ÕÅÿÕ¢óõ©ÇÕÅÑÞ»Ø2014-11-21.asp.md' (FN: 816d98ac):
 --> Filetype blacklisted.
 -> Checking 'Cmdµö»µîüþ«íþÉåÕæÿþÖ ÚÖåþÜäwebshell.asp' (FN: d1c7e568; FD: e16b8021):
 --> No problems found.
 -> Checking 'CyberSpy5.Asp' (FN: 407c201e; FD: 6b35b66f):
 --> No problems found.
 -> Checking 'DarkBlade1.5.asp' (FN: 29a19eda; FD: 94897c38):
 --> No problems found.
 -> Checking 'EFSO_2.asp' (FN: 24ad5c7d; FD: 40be3ede):
 --> No problems found.
 -> Checking 'Expdoor.com ASPõ©ôþö¿Õ¦ÅÚ®¼.asp' (FN: 989c36ea; FD: 4a31534f):
 --> No problems found.
 -> Checking 'Inderxer.asp' (FN: ad739125; FD: 26874d43):
 --> No problems found.
 --> Checking 'µÿÄµûçþëê.asp' (FN: 100175d4; FD: dbcfd2dc):
 ---> PHP chameleon attack detected!
 --> Checking 'ÕèáÕ»åþëê.asp' (FN: dce98866; FD: 401ca8a4):
 ---> No problems found.
 -> Checking 'Rader.asp' (FN: 5fd1bad8; FD: 8c480e8f):
 --> No problems found.
 -> Checking 'RemExp.asp' (FN: 560e582c; FD: 73827e0d):
 --> No problems found.
 -> Checking 'Server Variables.asp' (FN: b09e3120; FD: 73827e0d):
 --> No problems found.
 -> Checking 'ajn.asp' (FN: 622f5f2c; FD: 2f072132):
 --> No problems found.
 --> Checking 'readme.md' (FN: dbf634b3; FD: a2baea79):
 ---> No problems found.
 --> Checking 'shell.asp' (FN: 8bbc448c; FD: e71a9cf7):
 ---> No problems found.
 --> Checking 'shell_decoded.asp' (FN: 14df154f; FD: 8123caa5):
 ---> No problems found.
 -> Checking 'aspydrv.asp.txt' (FN: 3ec5301c; FD: 79958552):
 --> No problems found.
 -> Checking 'base.asp' (FN: 5ba69abf; FD: a28e01db):
 --> No problems found.
 -> Checking 'bypass-iisuser-p.asp' (FN: 94482eb7; FD: 658d7450):
 --> No problems found.
 -> Checking 'bypass-waf.asp' (FN: 23a0a88b; FD: 9d752090):
 --> No problems found.
 -> Checking 'bypass_safedog_01.asp' (FN: a86778fb; FD: e7f9b0e1):
 --> No problems found.
 -> Checking 'bypass_safedog_02.asp' (FN: efc7022b; FD: e9492862):
 --> No problems found.
 -> Checking 'bypass_safedog_03.asp' (FN: d2a72b9b; FD: 0038e302):
 --> No problems found.
 -> Checking 'cmd.asp.txt' (FN: 91e5e872; FD: b7f18cf1):
 --> No problems found.
 -> Checking 'cmdµÅÉµØâÚ®¼.asp' (FN: dd24e9f0; FD: d6e7ca21):
 --> No problems found.
 -> Checking 'con2.asp' (FN: f248e3e2; FD: 316e6a6e):
 --> No problems found.
 -> Checking 'cpanel.asp' (FN: b725a5fb; FD: 73827e0d):
 --> No problems found.
 -> Checking 'grasp.asp' (FN: 343494cc; FD: 3fe4e741):
 --> No problems found.
 -> Checking 'hididi.net.txt' (FN: 0fdd9531; FD: 50bc6c39):
 --> No problems found.
 -> Checking 'ice.asp' (FN: 011f7192; FD: 30cedc08):
 --> No problems found.
 -> Checking 'killdoor.txt' (FN: 8874f2ad; FD: c60f6827):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 -> Checking 'klasvayv.asp' (FN: cf7e2efb; FD: 73827e0d):
 --> No problems found.
 --> Checking 'radhat.asp' (FN: 24c3bc14; FD: 8a21f8a6):
 ---> No problems found.
 --> Checking 'readme.txt' (FN: 22598b08; FD: 348469c4):
 ---> No problems found.
 --> Checking 'ÞºúÕîàunpack.vbs' (FN: df43fcc5):
 ---> Filetype blacklisted.
 -> Checking 'lpl38-com-redhat.asp.txt' (FN: 100e42dc; FD: 8a21f8a6):
 --> No problems found.
 -> Checking 'luoss.asp.txt' (FN: 266a8679; FD: c81e9abf):
 --> No problems found.
 -> Checking 'mumaasp.com.asp' (FN: 12cdcdad; FD: 8f0967c7):
 --> No problems found.
 -> Checking 'nonoseed0121.asp.txt' (FN: a5dbed8b; FD: 7bffaaab):
 --> No problems found.
 -> Checking 'r00tsµùáFSOþ äÕ ¦ÕñºÚ®¼.asp' (FN: 365bf606; FD: f66aa86c):
 --> Detected phpMussel-FN.Rootkit.Generic-02!
 --> PHP chameleon attack detected!
 -> Checking 'shell.asp' (FN: 8bbc448c; FD: a063c708):
 --> Detected phpMussel-Graphics.HTML.Embed-02!
 --> Detected phpMussel-Graphics.HTML.Embed-08!
 -> Checking 'test.asp.txt' (FN: dbe91c13; FD: 72364554):
 --> No problems found.
 -> Checking 'vpsµÅÉµØâÚ®¼.asp' (FN: fa497197; FD: b554728d):
 --> PHP chameleon attack detected!
 -> Checking 'xslt.asp' (FN: e99c34c7; FD: 27b87ac2):
 --> No problems found.
 -> Checking 'xx.asp' (FN: c2fea712; FD: 73827e0d):
 --> No problems found.
 -> Checking 'õ áÞ»¦õ©¡þÜähcker.asp.txt' (FN: f1f0d2e8; FD: 6f4dcfe2):
 --> No problems found.
 -> Checking 'õ©ìÕ©ªÕ òÕÅÀþÜäAspõ©ÇÕÅÑÞ»Ø.asp' (FN: 136c7e5e; FD: 0e8ce569):
 --> No problems found.
 -> Checking 'õ©ìþü¡õ¦ïÚ¡é.asp' (FN: 8fede1b7; FD: dc264cdf):
 --> No problems found.
 -> Checking '111.aspx' (FN: 374aa196; FD: cb7f060f):
 --> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 -> Checking '2013110125222650.aspx' (FN: 731d9de9; FD: 364b22df):
 --> No problems found.
 -> Checking 'ASPXspy2.aspx' (FN: 79f697e4; FD: 5ba5c1f0):
 --> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 -> Checking 'ASPXõ©ÇÕÅÑÞ»Ø' (FN: 63ee47db; FD: af26930e):
 --> Detected phpMussel-ASP.Shell.CaiDao!
 -> Checking 'ASPXõ©ÇÕÅÑÞ»Ø02.txt' (FN: 23d93875; FD: 7e2a56a1):
 --> Detected phpMussel-ASP.Shell.CaiDao!
 -> Checking 'AspxSpy2014Final.aspx' (FN: 2e575d63; FD: b8548180):
 --> No problems found.
 -> Checking 'Aspxõ©ÇÕÅÑÞ»Øµ£¿Ú®¼Õ¦ÅÚøå.aspx' (FN: 4b743daa; FD: 14e9c71a):
 --> No problems found.
 -> Checking 'Nightrunner.aspx .txt' (FN: eee717aa; FD: 1d9c19c8):
 --> No problems found.
 -> Checking 'as.ashx' (FN: 653d28eb; FD: 50c4fb84):
 --> No problems found.
 --> Checking 'ChangeLog.txt' (FN: 2d90c91d; FD: d7a8ecbc):
 ---> No problems found.
 --> Checking 'cmdexec.aspx' (FN: 83c70028; FD: 61ce76c6):
 ---> No problems found.
 --> Checking 'filesystembrowser.aspx' (FN: 4470645c; FD: 6150ee5d):
 ---> No problems found.
 --> Checking 'fileupload.aspx' (FN: 1f1d7c43; FD: 31c68ff9):
 ---> No problems found.
 --> Checking 'spexec.aspx' (FN: 1e9c070c; FD: 50dca594):
 ---> No problems found.
 --> Checking 'sql.aspx' (FN: a8e90a56; FD: 00e0a404):
 ---> No problems found.
 -> Checking 'aspxÕÅÿÕ¢óõ©ÇÕÅÑÞ»Ø.aspx' (FN: bb415010; FD: 7bea71a3):
 --> No problems found.
 -> Checking 'aspxõ©ïÕùàµÄóÕÀÑÕàÀwebsniff1.0-linux.aspx' (FN: 5a790fc4; FD: 8ed6f9e5):
 --> No problems found.
 -> Checking 'con2.aspx' (FN: c22add34; FD: 44dad827):
 --> No problems found.
 -> Checking 'editor.aspx' (FN: abfb403d; FD: 1cc8171e):
 --> Detected phpMussel-ASP.Shell.CaiDao!
 --> Checking 'Customize.cs' (FN: c5a8bc6b; FD: aaf1e1ca):
 ---> No problems found.
 --> Checking 'global.asax' (FN: 13b4c388; FD: ac3ec21f):
 ---> No problems found.
 --> Checking 'httpHandlers.md' (FN: 23e69d4c; FD: 2f57c8eb):
 ---> No problems found.
 --> Checking 'httpModules.md' (FN: 30426635; FD: c1ef25fe):
 ---> No problems found.
 --> Checking 'readme.md' (FN: dbf634b3; FD: 323520c7):
 ---> No problems found.
 -> Checking 'icesword.aspx' (FN: 4a85eb9a; FD: 3473942e):
 --> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 -> Checking 'lpl38-com-aspx.txt' (FN: bc64f0be; FD: ed015718):
 --> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 --> Checking '.gitattributes' (FN: 8dd50977):
 ---> Filename manipulation detected!
 --> Checking '.gitignore' (FN: e1d58f91):
 ---> Filename manipulation detected!
 ---> Checking 'Readme.md' (FN: 5907b610; FD: ba38540e):
 ----> No problems found.
 ---> Checking 'antak.aspx' (FN: f4db2d5e; FD: 62af22b8):
 ----> No problems found.
 ---> Checking 'DNS_TXT_Pwnage.ps1' (FN: 884cc67a):
 ----> Filetype blacklisted.
 ---> Checking 'Execute-OnTime.ps1' (FN: d2d1be24):
 ----> Filetype blacklisted.
 ---> Checking 'HTTP-Backdoor.ps1' (FN: 02b6f8d1):
 ----> Filetype blacklisted.
 --> Checking 'CHANGELOG.txt' (FN: 418a5425; FD: e38c9242):
 ---> No problems found.
 ---> Checking 'Enable-DuplicateToken.ps1' (FN: 35fda42e):
 ----> Filetype blacklisted.
 ---> Checking 'Remove-Update.ps1' (FN: c102f1b2):
 ----> Filetype blacklisted.
 ---> Checking 'Download-Execute-PS.ps1' (FN: 8c2b5594):
 ----> Filetype blacklisted.
 ---> Checking 'Download_Execute.ps1' (FN: 6b06ef19):
 ----> Filetype blacklisted.
 ---> Checking 'Execute-Command-MSSQL.ps1' (FN: c8bbbde8):
 ----> Filetype blacklisted.
 ---> Checking 'Execute-DNSTXT-Code.ps1' (FN: d4123bec):
 ----> Filetype blacklisted.
 ---> Checking 'Check-VM.ps1' (FN: 9c90afb6):
 ----> Filetype blacklisted.
 ---> Checking 'Copy-VSS.ps1' (FN: c342cf9d):
 ----> Filetype blacklisted.
 ---> Checking 'Credentials.ps1' (FN: 1ecff4fc):
 ----> Filetype blacklisted.
 ---> Checking 'FireBuster.ps1' (FN: 882cb47f):
 ----> Filetype blacklisted.
 ---> Checking 'FireListener.ps1' (FN: ca7d489f):
 ----> Filetype blacklisted.
 ---> Checking 'Get-Information.ps1' (FN: b9d21eda):
 ----> Filetype blacklisted.
 ---> Checking 'Get-LSASecret.ps1' (FN: 0e76b412):
 ----> Filetype blacklisted.
 ---> Checking 'Get-PassHashes.ps1' (FN: ff7dca91):
 ----> Filetype blacklisted.
 ---> Checking 'Get-WLAN-Keys.ps1' (FN: daf0b1f2):
 ----> Filetype blacklisted.
 ---> Checking 'Keylogger.ps1' (FN: 266bd9b2):
 ----> Filetype blacklisted.
 ---> Checking 'Nishang_Logo.png' (FN: 0a9bbc8d; FD: c772edde):
 ----> No problems found.
 ---> Checking 'Nishang_logo_small.png' (FN: be706f43; FD: 37a11fe3):
 ----> No problems found.
 ---> Checking 'Speak.ps1' (FN: b4929b3e):
 ----> Filetype blacklisted.
 ---> Checking 'Create-MultipleSessions.ps1' (FN: 7cc1c47b):
 ----> Filetype blacklisted.
 ---> Checking 'Run-EXEonRemote.ps1' (FN: f98c314d):
 ----> Filetype blacklisted.
 ---> Checking 'Prasadhak.ps1' (FN: 89d1202e):
 ----> Filetype blacklisted.
 --> Checking 'README.md' (FN: 099368d6; FD: b463f4db):
 ---> No problems found.
 ---> Checking 'Brute-Force.ps1' (FN: e4ce6fe6):
 ----> Filetype blacklisted.
 ---> Checking 'Port-Scan.ps1' (FN: b3e70472):
 ----> Filetype blacklisted.
 ---> Checking 'Add-Exfiltration.ps1' (FN: 1f188844):
 ----> Filetype blacklisted.
 ---> Checking 'Add-Persistence.ps1' (FN: fbcaee12):
 ----> Filetype blacklisted.
 ---> Checking 'Base64ToString.ps1' (FN: 9498503a):
 ----> Filetype blacklisted.
 ---> Checking 'Do-Exfiltration.ps1' (FN: 4109448c):
 ----> Filetype blacklisted.
 ---> Checking 'Download.ps1' (FN: 1fd8f211):
 ----> Filetype blacklisted.
 ---> Checking 'ExetoText.ps1' (FN: 727a0f52):
 ----> Filetype blacklisted.
 ---> Checking 'Invoke-Decode.ps1' (FN: 27a8354a):
 ----> Filetype blacklisted.
 ---> Checking 'Invoke-Encode.ps1' (FN: 4a3fc0a9):
 ----> Filetype blacklisted.
 ---> Checking 'Parse_Keys.ps1' (FN: 6eb73a36):
 ----> Filetype blacklisted.
 ---> Checking 'Remove-Persistence.ps1' (FN: ad75b37d):
 ----> Filetype blacklisted.
 ---> Checking 'StringToBase64.ps1' (FN: 4746c1d0):
 ----> Filetype blacklisted.
 ---> Checking 'TexttoExe.ps1' (FN: 883101fa):
 ----> Filetype blacklisted.
 --> Checking 'nishang.psm1' (FN: 7b2796bc; FD: baa12abe):
 ---> No problems found.
 ---> Checking 'Powerpreter.psm1' (FN: 09bb0b93; FD: 7961f355):
 ----> No problems found.
 ---> Checking 'README.md' (FN: 099368d6; FD: e22c07d5):
 ----> No problems found.
 -> Checking 'wooyun2015052301.aspx' (FN: 4acbd9e6; FD: a4255de5):
 --> No problems found.
 -> Checking 'wso.aspx' (FN: 3da8672b; FD: b156b65f):
 --> No problems found.
 -> Checking 'xslt.aspx' (FN: 8935dda4; FD: bcda73c7):
 --> No problems found.
 -> Checking 'z1(1).txt' (FN: 96ddbeda; FD: 11f98ddd):
 --> No problems found.
 -> Checking '3802.php' (FN: c34aac47):
 --> Filetype blacklisted.
 -> Checking '404.php' (FN: 78a6671a):
 --> Filetype blacklisted.
 -> Checking 'README.md' (FN: 099368d6; FD: 202ad5f8):
 --> No problems found.
 -> Checking 'a.asp' (FN: 3f9f8bf3; FD: e9fa4e1b):
 --> No problems found.
 -> Checking 'aspx.jpg' (FN: 9f2708c3; FD: 1c75f47e):
 --> Detected phpMussel-ASP.Shell.CaiDao!
 --> Detected phpMussel-Graphics.Code.Embed-005.3!
 --> Checking 'ASPÞ» þ êþ½»þ½»ÕÅú.ccc' (FN: ac1fbd6f; FD: ef8c44e1):
 ---> No problems found.
 --> Checking 'Aspxµûçõ ÂµÉ£þ¦ó.ccc' (FN: 3e558cc4; FD: 96be4eff):
 ---> No problems found.
 --> Checking 'AspxÞ«¥þ¢«µØâÚÖÉ.ccc' (FN: b6e03fd9; FD: c407dde4):
 ---> No problems found.
 --> Checking 'PHPµë¦ÚçÅµîéÚ®¼.ccc' (FN: c0d0d0aa; FD: 0cd138c1):
 ---> No problems found.
 --> Checking 'README.md' (FN: 099368d6; FD: d92f6520):
 ---> No problems found.
 --> Checking 'aspþø«Õ¢òÕåÖµØâÚÖÉµúÇµÁï.ccc' (FN: 3b60f516; FD: b25b34f5):
 ---> No problems found.
 --> Checking 'php_HTTPõ úþÉå.ccc' (FN: aa5bf10d; FD: 40fdb30a):
 ---> No problems found.
 --> Checking 'phpspy2011.ccc' (FN: 2a1c973f; FD: b76859cf):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-00!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Angel-03!
 ---> Detected phpMussel-PHP.Shell.Angel-04!
 ---> PHP chameleon attack detected!
 --> Checking 'phpþ½»ÕÅúÞ¢¼ÕÉæ.ccc' (FN: 69aac81b; FD: d7e703b7):
 ---> No problems found.
 --> Checking 'µë½µÅÅþ½»ÕÅú_php.ccc' (FN: 41a4f6fc; FD: 39c025b7):
 ---> No problems found.
 -> Checking 'customize.ashx' (FN: 9190326e; FD: c1f98a52):
 --> No problems found.
 -> Checking 'customize.asmx' (FN: ece7c62b; FD: bb084e08):
 --> No problems found.
 -> Checking 'download õ©ïÞ¢¢µûçõ Â.asp' (FN: d6558b7f; FD: ac48f18f):
 --> No problems found.
 -> Checking 'fuck.php' (FN: 444992bf):
 --> Filetype blacklisted.
 -> Checking 'guo.php' (FN: 7acdf135):
 --> Filetype blacklisted.
 -> Checking 'hkmjj.asp' (FN: 4150c719; FD: 01a3f6b6):
 --> No problems found.
 -> Checking 'ice.asp' (FN: 011f7192; FD: e6a8ad96):
 --> No problems found.
 -> Checking 'ice.aspx' (FN: 92dcfb9a; FD: 2bd5595f):
 --> Detected phpMussel-ASP.Shell.CaiDao!
 --> Detected phpMussel-Graphics.Code.Embed-005.3!
 -> Checking 'ice.cfm' (FN: 56282f31; FD: d8252e4b):
 --> No problems found.
 -> Checking 'ice.jpg' (FN: a5b44877; FD: 0f34217a):
 --> No problems found.
 -> Checking 'ice.jsp' (FN: 0d4a9e73; FD: 58d94c23):
 --> No problems found.
 -> Checking 'ice.php' (FN: b5cd734f):
 --> Filetype blacklisted.
 -> Checking 'mdb.asp' (FN: 5a75b929; FD: a17a6183):
 --> No problems found.
 -> Checking 'p.php' (FN: d6cd371c):
 --> Filetype blacklisted.
 -> Checking 'php.jpg' (FN: 9535795b; FD: 5cc68455):
 --> PHP chameleon attack detected!
 --> Detected phpMussel-Graphics.Code.Embed-005.3!
 --> Detected phpMussel-Graphics.PHP.Embed-00!
 --> Detected phpMussel-Graphics.PHP.Embed-05!
 -> Checking 'redirect.asp' (FN: 52cd9ccc; FD: 80d64aa4):
 --> No problems found.
 -> Checking 'toby57Þºúµ×ÉÕèáÕ»åõ©ÇÕÅÑÞ»Øµ£¿Ú®¼.php' (FN: ae224389):
 --> Filetype blacklisted.
 -> Checking 'w.jsp' (FN: dc6a0630; FD: 300da2d0):
 --> No problems found.
 -> Checking 'w.php' (FN: 64edeb0c):
 --> Filetype blacklisted.
 -> Checking 'x.php' (FN: e6bd7cdd):
 --> Filetype blacklisted.
 -> Checking 'Õ ¦µéì.php' (FN: f37e608e):
 --> Filetype blacklisted.
 -> Checking 'Þ»¦µÿÄ.log' (FN: bece8bcd; FD: 4b3e9da8):
 --> Detected ClamAV-PHP.Hide!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-ASP.Shell.CaiDao!
 --> PHP chameleon attack detected!
 -> Checking 'ÞÅ£ÕêÇjspõ «µö¦.jsp' (FN: 9a79b9ec; FD: 3a8cccd9):
 --> No problems found.
 -> Checking 'MSSQL.asp' (FN: 077ebbf8; FD: 87334413):
 --> No problems found.
 -> Checking 'README.md' (FN: 099368d6; FD: 62a7d734):
 --> No problems found.
 -> Checking 'asp wget drag database.asp.txt' (FN: 667c090f; FD: 96602241):
 --> No problems found.
 -> Checking 'jsp wget drag database.jsp.txt' (FN: 18ac66ec; FD: 738d9b29):
 --> No problems found.
 -> Checking 'mysql_1.php' (FN: 97fd87d4):
 --> Filetype blacklisted.
 -> Checking 'mysql_jspÞä¦Þúñ.txt' (FN: cdf03293; FD: 643c41f1):
 --> No problems found.
 -> Checking 'mysqlµò¦µì«Õ¦ôÞä¦Õìòõ©¬Þí¿.jsp' (FN: a4e6ffb9; FD: 2696cdcd):
 --> No problems found.
 -> Checking 'oracle_jspÞä¦Þúñ.txt' (FN: acd74d48; FD: e2611ec7):
 --> No problems found.
 -> Checking 'oracleÞä¦ÞúñÞäÜµ£¼.jsp' (FN: 2b94e667; FD: 60759abb):
 --> No problems found.
 -> Checking 'php wget drag database.php 2.txt' (FN: f04ce833; FD: cdc8eaf0):
 --> No problems found.
 -> Checking 'php wget drag database.php.txt' (FN: 0f5490ec; FD: 1834c108):
 --> No problems found.
 -> Checking 'system.jsp' (FN: f02da1cf; FD: e1d06bb6):
 --> No problems found.
 -> Checking 'tuo.aspx' (FN: d0f755f2; FD: 3f354909):
 --> No problems found.
 -> Checking 'Þä¦mysqlµò¦µì«Õ¦ô.jsp' (FN: 5867f789; FD: 77e3a74a):
 --> No problems found.
 -> Checking 'README.md' (FN: 099368d6; FD: ed6d5093):
 --> No problems found.
 --> Checking 'cmd-asp-5.1.asp' (FN: efc42776; FD: de470ec3):
 ---> Detected phpMussel-FN.Generic-04.B!
 --> Checking 'cmd.asp' (FN: a205661c; FD: d2bae04b):
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'cmd.aspx' (FN: 987f4faa; FD: 06cd60eb):
 ---> No problems found.
 --> Checking 'cmdasp.asp' (FN: 249de555; FD: 05cd1b94):
 ---> Detected phpMussel-FN.Generic-04.B!
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'cmdasp.aspx' (FN: 97f92e1d; FD: c072c0b9):
 ---> Detected phpMussel-FN.Generic-04.B!
 --> Checking 'list.asp' (FN: 204378d8; FD: 6ad91d08):
 ---> No problems found.
 --> Checking 'list.txt' (FN: de370491; FD: 6ad91d08):
 ---> No problems found.
 --> Checking 'ntdaddy.asp' (FN: cef8dcaa; FD: 3d382aa2):
 ---> No problems found.
 --> Checking 'up.asp' (FN: 4e10ff0d; FD: 750d0c74):
 ---> No problems found.
 --> Checking 'cmd.c' (FN: 419e8f6c; FD: 45db0248):
 ---> No problems found.
 --> Checking 'cfExec.cfm' (FN: c4aa922a; FD: 2e6f82f6):
 ---> Detected phpMussel-FN.Generic-03.A!
 --> Checking 'cfSQL.cfm' (FN: d757e173; FD: e7a95b1b):
 ---> No problems found.
 --> Checking 'cmd.cfm' (FN: f53238bf; FD: 25f81a26):
 ---> No problems found.
 --> Checking 'CmdServlet.class' (FN: b550c259; FD: d2e544df):
 ---> No problems found.
 --> Checking 'CmdServlet.java' (FN: 0c8d31ef; FD: b8451675):
 ---> No problems found.
 --> Checking 'ListServlet.class' (FN: 74750f13; FD: f61f55bc):
 ---> No problems found.
 --> Checking 'ListServlet.java' (FN: 485dd0d1; FD: cfbb2675):
 ---> No problems found.
 --> Checking 'UpServlet.class' (FN: f5be16c2; FD: 71839fb3):
 ---> No problems found.
 --> Checking 'UpServlet.java' (FN: 3d52cc05; FD: 40588285):
 ---> No problems found.
 --> Checking 'browser.jsp' (FN: e3dd374e; FD: 59e58a7c):
 ---> No problems found.
 --> Checking 'cmd.jsp' (FN: ae5089fd; FD: c72ab082):
 ---> No problems found.
 --> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: df3a5fdc):
 ---> Detected phpMussel-FN.Generic-04.B!
 --> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: 74c163ed):
 ---> Detected phpMussel-FN.Generic-19!
 --> Checking 'list.jsp' (FN: 2c169739; FD: de8fa945):
 ---> No problems found.
 --> Checking 'up.jsp' (FN: 424510ec; FD: 764bd2bf):
 ---> No problems found.
 ---> Checking 'cmd_win32.jsp' (FN: 2af8d4a8; FD: a4a3b9e4):
 ----> No problems found.
 ---> Checking 'up_win32.jsp' (FN: f95bce9e; FD: 605295af):
 ----> No problems found.
 --> Checking 'cmd.php' (FN: 16d764c1):
 ---> Filetype blacklisted.
 --> Checking 'list.php' (FN: 94917a05):
 ---> Filetype blacklisted.
 --> Checking 'php-backdoor.php' (FN: ab504e20):
 ---> Filetype blacklisted.
 --> Checking 'simple-backdoor.php' (FN: 5085f846):
 ---> Filetype blacklisted.
 --> Checking 'up.php' (FN: fac2fdd0):
 ---> Filetype blacklisted.
 --> Checking 'cmd.pl' (FN: b3ac3090):
 ---> Filetype blacklisted.
 --> Checking 'list.pl' (FN: fd4635c6):
 ---> Filetype blacklisted.
 --> Checking 'perlcmd.cgi' (FN: 8d526015):
 ---> Filetype blacklisted.
 --> Checking 'up.pl' (FN: c5c70751):
 ---> Filetype blacklisted.
 --> Checking 'CmdServlet.java' (FN: 0c8d31ef; FD: b8451675):
 ---> No problems found.
 --> Checking 'ListServlet.java' (FN: 485dd0d1; FD: cfbb2675):
 ---> No problems found.
 --> Checking 'UpServlet.java' (FN: 3d52cc05; FD: 40588285):
 ---> No problems found.
 --> Checking 'cmd.sh' (FN: 9feca74a; FD: 98bf0d88):
 ---> No problems found.
 --> Checking 'list.sh' (FN: d106a21c; FD: 716412dd):
 ---> No problems found.
 --> Checking 'up.sh' (FN: e987908b; FD: a18825de):
 ---> No problems found.
 -> Checking '000.jsp' (FN: c1ee08f5; FD: d323f9cd):
 --> No problems found.
 -> Checking '0000.jsp' (FN: bc6d5b9f; FD: d323f9cd):
 --> No problems found.
 -> Checking '1.jsp' (FN: 0bd9abd9; FD: 9514834b):
 --> No problems found.
 -> Checking '102.jsp' (FN: 1d595021; FD: 9514834b):
 --> No problems found.
 -> Checking '123.jsp' (FN: 6df1d89a; FD: 30290dda):
 --> No problems found.
 -> Checking '12302.jsp' (FN: 0f010a49; FD: 7b7d66ab):
 --> No problems found.
 -> Checking '2.jsp' (FN: 4c79d109; FD: c1ea0302):
 --> No problems found.
 -> Checking '201.jsp' (FN: 6b11306c; FD: 17d5acaf):
 --> No problems found.
 -> Checking '3.jsp' (FN: 7119f8b9; FD: 34f9e23d):
 --> No problems found.
 -> Checking '400.jsp' (FN: 35a12ce6; FD: 6b1bd076):
 --> No problems found.
 -> Checking '403.jsp' (FN: 72015636; FD: c98f822b):
 --> No problems found.
 -> Checking '404.jsp' (FN: c0218a26; FD: 9cdcde98):
 --> No problems found.
 -> Checking '520.jsp' (FN: de1e8659; FD: f9c323cd):
 --> No problems found.
 -> Checking '807.jsp' (FN: 40219a82; FD: 13c6a361):
 --> No problems found.
 --> Checking 'Chropper.java' (FN: 44f720b8; FD: 2c61187f):
 ---> No problems found.
 --> Checking 'ÞÅ£ÕêÇjspÞäÜµ£¼µø¦µû¦þëê.jsp' (FN: 787c035d; FD: b1f5b291):
 ---> No problems found.
 --> Checking 'ÞÅ£ÕêÇjspÞäÜµ£¼µùáÕÄïþ ®þëê.jsp' (FN: be866570; FD: 5c46b56b):
 ---> No problems found.
 --> Checking 'ÞÅ£ÕêÇjspÞäÜµ£¼µûçµÿÄþëê.jsp' (FN: d706e148; FD: dd74a99c):
 ---> No problems found.
 --> Checking 'ÞÅ£ÕêÇÞäÜµ£¼Þ ×µÄÑµò¦µì«Õ¦ôÚù«Úóÿ.txt' (FN: ba2a7cbf; FD: f048cf4a):
 ---> No problems found.
 -> Checking 'IXRbE.jsp' (FN: 22240585; FD: 64baa26c):
 --> No problems found.
 -> Checking 'IXRbE02.jsp' (FN: 3a39e56b; FD: 64baa26c):
 --> No problems found.
 -> Checking 'JFolder.jsp' (FN: 3d32f4a3; FD: dbdd313b):
 --> No problems found.
 -> Checking 'JSPÞÅ£ÕêÇõ©ÇÕÅÑÞ»Øµ£¿Ú®¼.jsp' (FN: fe926aaf; FD: dda8b4b0):
 --> No problems found.
 -> Checking 'JSPõ©ÇÕÅÑÞ»Ø' (FN: 6cd07e80; FD: 361e510d):
 --> No problems found.
 -> Checking 'Java Shell.jsp' (FN: 6731042a; FD: 66b88133):
 --> No problems found.
 -> Checking 'JspSpy.jsp' (FN: b30b2038; FD: 4084f506):
 --> No problems found.
 -> Checking 'JspSpy1.jsp' (FN: 64aa290a; FD: 4084f506):
 --> No problems found.
 -> Checking 'JspSpyJDK5.jsp' (FN: 7fa901c4; FD: c6798b62):
 --> No problems found.
 -> Checking 'JspSpyJDK51.jsp' (FN: d06d351c; FD: 4ec0e20a):
 --> No problems found.
 -> Checking 'JspWebshell 1.2.jsp' (FN: bd1511fd; FD: 6100a46c):
 --> No problems found.
 -> Checking 'ROOTtows.jsp' (FN: 02216a70; FD: 5a9cd4f5):
 --> No problems found.
 -> Checking 'Silic.jsp' (FN: 8eb76ae1; FD: 4b0d27d6):
 --> No problems found.
 -> Checking 'a.jsp' (FN: 33ca6412; FD: 2cf3d285):
 --> No problems found.
 -> Checking 'action.jsp' (FN: 006f9554; FD: b889e8a2):
 --> No problems found.
 -> Checking 'asd.jsp' (FN: 0013fb3f; FD: a7db8eeb):
 --> No problems found.
 -> Checking 'c5.jsp' (FN: 07d92653; FD: de6dc7ff):
 --> No problems found.
 --> Checking '1.jpg' (FN: a3277ddd; FD: 122aa8ff):
 ---> No problems found.
 --> Checking '2.jpg' (FN: e487070d; FD: bbee29ec):
 ---> Detected phpMussel-Graphics.Defacement.Generic-000!
 --> Checking '3.jpg' (FN: d9e72ebd; FD: beb70801):
 ---> Detected phpMussel-Graphics.Defacement.Generic-000!
 --> Checking '4.jpg' (FN: 6bc7f2ad; FD: 1c6d3dda):
 ---> No problems found.
 --> Checking '5.jpg' (FN: 56a7db1d; FD: ae73ec62):
 ---> No problems found.
 --> Checking '6.jpg' (FN: 1107a1cd; FD: 3e8bc77b):
 ---> No problems found.
 --> Checking 'Cat.java' (FN: 5fedba4a; FD: 3b797235):
 ---> No problems found.
 --> Checking 'cat.jar' (FN: 2f88cffb; FD: 93ed24ab):
 ---> No problems found.
 ---> Reading 'cat.jar' (ZIP):
 ----> Success! Proceeding to check contents.
 ----> Checking 'cat.jar' > 'META-INF/MANIFEST.MF' (FN: 02848585; FD: 74b177cb):
 -----> No problems found.
 ----> Checking 'cat.jar' > 'Cat.class' (FN: 13bff5b5; FD: 2709090b):
 -----> No problems found.
 ----> Checking 'cat.jar' > 'config.properties' (FN: e06626d2; FD: 1dc4b216):
 -----> No problems found.
 --> Checking 'cat.jsp' (FN: b972de04; FD: 367d1ec5):
 ---> No problems found.
 --> Checking 'catjsp.md' (FN: 53fc302c; FD: cb78d9ad):
 ---> No problems found.
 --> Checking 'cmd1.jsp' (FN: 8fb9449c; FD: 338e2313):
 ---> No problems found.
 --> Checking 'cmd2.jsp' (FN: c8193e4c; FD: d0d4a6e0):
 ---> No problems found.
 --> Checking 'readme.md' (FN: dbf634b3; FD: 6898f0d3):
 ---> No problems found.
 --> Checking 'test.php' (FN: fc6f3aef):
 ---> Filetype blacklisted.
 -> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: 24fb4b51):
 --> Detected phpMussel-FN.Generic-04.B!
 -> Checking 'cofigrue.jsp' (FN: 315298bc; FD: 72b74305):
 --> No problems found.
 -> Checking 'config.jsp' (FN: 22d46a1b; FD: a4189449):
 --> No problems found.
 -> Checking 'css.jsp' (FN: 454ca184; FD: 74c95bba):
 --> No problems found.
 -> Checking 'customize.jsp' (FN: e40dfea7; FD: 955a348a):
 --> No problems found.
 -> Checking 'data.jsp' (FN: 7919eaa1; FD: 49f2ade1):
 --> No problems found.
 -> Checking 'data02.jsp' (FN: fb64a019; FD: 49f2ade1):
 --> No problems found.
 -> Checking 'date.jsp.txt' (FN: 3c489bdc; FD: 20c74043):
 --> No problems found.
 -> Checking 'dm.jsp' (FN: 12bf92e1; FD: aba83cce):
 --> No problems found.
 -> Checking 'edit_ot.jsp' (FN: 3b052825; FD: a075f6ee):
 --> No problems found.
 -> Checking 'guige.jsp' (FN: 310c642c; FD: 10a35466):
 --> No problems found.
 -> Checking 'guige02.jsp' (FN: 7f49a02d; FD: d1f2cfb1):
 --> No problems found.
 ---> Checking 'Customize.jsp' (FN: 5773b552; FD: eb685adc):
 ----> No problems found.
 ---> Checking 'JSPµùáþ äõ ÂÕ«×þÄ¦WEBõ©èõ á.rar' (FN: 79a4d00d; FD: 04f40b2b):
 ----> No problems found.
 ---> Checking 'Java Shell.jsp' (FN: 6731042a; FD: 66b88133):
 ----> No problems found.
 ---> Checking 'JspWebshell 1.2.jsp' (FN: bd1511fd; FD: 6100a46c):
 ----> No problems found.
 ---> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: 24fb4b51):
 --> Detected phpMussel-FN.Generic-04.B!
 ---> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: adf15d88):
 ----> Detected phpMussel-FN.Generic-19!
 ---> Checking 'jspspyµ£ëÕ¦ÅÕ¦ò.txt' (FN: 35511252; FD: b53dcd72):
 ----> No problems found.
 ---> Checking 'minupload.jsp' (FN: 152bd374; FD: 6d9a40f2):
 ----> No problems found.
 ----> Checking 'download.jsp' (FN: 17837e49; FD: a7bbcc0c):
 -----> Detected phpMussel-Suspect.Executable-2!
 ----> Checking 'jspspy.jsp' (FN: 33eb1a74; FD: 898fc933):
 -----> No problems found.
 ----> Checking 'jspspy_k8.jsp' (FN: bfa9d48a; FD: 7e7ec645):
 -----> No problems found.
 ----> Checking 'thx.jsp' (FN: f9f4c08d; FD: a075f6ee):
 -----> No problems found.
 ---> Checking 'Customize.jsp' (FN: 5773b552; FD: eb685adc):
 ----> No problems found.
 ---> Checking 'JSPµùáþ äõ ÂÕ«×þÄ¦WEBõ©èõ á.rar' (FN: 79a4d00d; FD: 04f40b2b):
 ----> No problems found.
 ---> Checking 'Java Shell.jsp' (FN: 6731042a; FD: 66b88133):
 ----> No problems found.
 ---> Checking 'JspWebshell 1.2.jsp' (FN: bd1511fd; FD: 6100a46c):
 ----> No problems found.
 ---> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: 24fb4b51):
 --> Detected phpMussel-FN.Generic-04.B!
 ---> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: adf15d88):
 ----> Detected phpMussel-FN.Generic-19!
 ---> Checking 'minupload.jsp' (FN: 152bd374; FD: 6d9a40f2):
 ----> No problems found.
 ----> Checking 'download.jsp' (FN: 17837e49; FD: a7bbcc0c):
 -----> Detected phpMussel-Suspect.Executable-2!
 ----> Checking 'jspspy.jsp' (FN: 33eb1a74; FD: 898fc933):
 -----> No problems found.
 ----> Checking 'jspspy_k8.jsp' (FN: bfa9d48a; FD: 7e7ec645):
 -----> No problems found.
 ----> Checking 'thx.jsp' (FN: f9f4c08d; FD: a075f6ee):
 -----> No problems found.
 --> Checking 'Struts2õ©ïshellÕà Õ«¦µÇºµèÑÕæè_K8.txt' (FN: 40bc3166; FD: 4226450f):
 ---> No problems found.
 ---> Checking 'JFolder.jsp' (FN: 3d32f4a3; FD: dbdd313b):
 ----> No problems found.
 ---> Checking 'JspSpyJDK5.jsp' (FN: 7fa901c4; FD: c6798b62):
 ----> No problems found.
 ---> Checking 'in.jsp' (FN: e981fbef; FD: 23e681b2):
 ----> No problems found.
 ---> Checking 'job.jsp' (FN: f9409885; FD: edbdf20b):
 ----> No problems found.
 ----> Checking '1.jsp' (FN: 0bd9abd9; FD: 8a56c04d):
 -----> No problems found.
 ----> Checking '2.jsp' (FN: 4c79d109; FD: 86425852):
 -----> No problems found.
 ----> Checking 'Browser.jsp' (FN: 6541b899; FD: 17d5acaf):
 -----> No problems found.
 ----> Checking 'Readme.txt' (FN: 6d0488d8; FD: cfba2be0):
 -----> No problems found.
 ----> Checking 'example-css.css' (FN: 15422a6f; FD: ec215f59):
 -----> No problems found.
 ----> Checking 'gpl.txt' (FN: 270664c2; FD: aadb3ce5):
 -----> No problems found.
 ---> Checking 'ma1.jsp' (FN: 795e7260; FD: f6758d17):
 ----> No problems found.
 ---> Checking 'ma2.jsp' (FN: 3efe08b0; FD: c9f7a99d):
 ----> No problems found.
 ---> Checking 'ma3.jsp' (FN: 039e2100; FD: 141a41c9):
 ----> No problems found.
 ---> Checking 'ma4.jsp' (FN: b1befd10; FD: c7f19faf):
 ----> No problems found.
 ---> Checking 'no.jsp' (FN: c9e4e2e7; FD: d77c46fa):
 ----> No problems found.
 ---> Checking 'silic webshell.jsp' (FN: 7ae881ff; FD: d0de223f):
 ----> No problems found.
 ---> Checking 'spjspshell.jsp' (FN: cf4d191d; FD: 96bc1aba):
 ----> No problems found.
 ---> Checking 'CmdServlet.class' (FN: b550c259; FD: d2e544df):
 ----> No problems found.
 ---> Checking 'CmdServlet.java' (FN: 0c8d31ef; FD: b8451675):
 ----> No problems found.
 ---> Checking 'ListServlet.class' (FN: 74750f13; FD: f61f55bc):
 ----> No problems found.
 ---> Checking 'ListServlet.java' (FN: 485dd0d1; FD: cfbb2675):
 ----> No problems found.
 ---> Checking 'UpServlet.class' (FN: f5be16c2; FD: 71839fb3):
 ----> No problems found.
 ---> Checking 'UpServlet.java' (FN: 3d52cc05; FD: 40588285):
 ----> No problems found.
 ---> Checking 'browser.jsp' (FN: e3dd374e; FD: 59e58a7c):
 ----> No problems found.
 ---> Checking 'cmd.jsp' (FN: ae5089fd; FD: c72ab082):
 ----> No problems found.
 ---> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: df3a5fdc):
 ---> Detected phpMussel-FN.Generic-04.B!
 ---> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: 74c163ed):
 ---> Detected phpMussel-FN.Generic-19!
 ---> Checking 'list.jsp' (FN: 2c169739; FD: de8fa945):
 ----> No problems found.
 ---> Checking 'up.jsp' (FN: 424510ec; FD: 764bd2bf):
 ----> No problems found.
 ----> Checking 'cmd_win32.jsp' (FN: 2af8d4a8; FD: a4a3b9e4):
 -----> No problems found.
 ----> Checking 'up_win32.jsp' (FN: f95bce9e; FD: 605295af):
 -----> No problems found.
 ---> Checking 'CmdServlet.class' (FN: b550c259; FD: d2e544df):
 ----> No problems found.
 ---> Checking 'CmdServlet.java' (FN: 0c8d31ef; FD: b8451675):
 ----> No problems found.
 ---> Checking 'ListServlet.class' (FN: 74750f13; FD: f61f55bc):
 ----> No problems found.
 ---> Checking 'ListServlet.java' (FN: 485dd0d1; FD: cfbb2675):
 ----> No problems found.
 ---> Checking 'UpServlet.class' (FN: f5be16c2; FD: 71839fb3):
 ----> No problems found.
 ---> Checking 'UpServlet.java' (FN: 3d52cc05; FD: 40588285):
 ----> No problems found.
 ---> Checking 'browser.jsp' (FN: e3dd374e; FD: 59e58a7c):
 ----> No problems found.
 ---> Checking 'cmd.jsp' (FN: ae5089fd; FD: c72ab082):
 ----> No problems found.
 ---> Checking 'cmdjsp.jsp' (FN: 2acf5e4e; FD: df3a5fdc):
 ---> Detected phpMussel-FN.Generic-04.B!
 ---> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: 74c163ed):
 ---> Detected phpMussel-FN.Generic-19!
 ---> Checking 'list.jsp' (FN: 2c169739; FD: de8fa945):
 ----> No problems found.
 ---> Checking 'up.jsp' (FN: 424510ec; FD: 764bd2bf):
 ----> No problems found.
 ----> Checking 'cmd_win32.jsp' (FN: 2af8d4a8; FD: a4a3b9e4):
 -----> No problems found.
 ----> Checking 'up_win32.jsp' (FN: f95bce9e; FD: 605295af):
 -----> No problems found.
 -> Checking 'he1p.jsp' (FN: d8ecfe10; FD: c7cb63b4):
 --> No problems found.
 -> Checking 'hsxa.jsp' (FN: a935b272; FD: 4b0d27d6):
 --> No problems found.
 -> Checking 'hsxa1.jsp' (FN: f2b9bf16; FD: 5d2c7c55):
 --> No problems found.
 -> Checking 'icesword.jsp' (FN: 597144db; FD: e26c1198):
 --> No problems found.
 -> Checking 'in.jsp' (FN: e981fbef; FD: 23e681b2):
 --> No problems found.
 -> Checking 'inback3.jsp' (FN: 8eb282d0; FD: d7ac1d1d):
 --> No problems found.
 -> Checking 'index_bak1.jsp' (FN: 5540ba4c; FD: aa3059af):
 --> No problems found.
 -> Checking 'index_sys.jsp' (FN: 49aa4259; FD: e0593531):
 --> No problems found.
 -> Checking 'indexop.jsp.õ©èõ á.jsp' (FN: 23d3ffa4; FD: 833a9e71):
 --> No problems found.
 -> Checking 'info.jsp' (FN: e57a9268; FD: ac27cdf3):
 --> No problems found.
 --> Checking 'java_faces_shell.xhtml' (FN: f0bd78fa; FD: 78927611):
 ---> No problems found.
 --> Checking 'readme.md' (FN: dbf634b3; FD: 10b8418b):
 ---> No problems found.
 -> Checking 'jdbc.jsp' (FN: 91e465d2; FD: 4af827a0):
 --> No problems found.
 -> Checking 'jfolder01.jsp' (FN: dfb2510e; FD: d77c46fa):
 --> No problems found.
 -> Checking 'job.jsp' (FN: f9409885; FD: edbdf20b):
 --> No problems found.
 -> Checking 'jshell.jsp' (FN: 44af430c; FD: 83ad4ec8):
 --> No problems found.
 -> Checking 'jsp-reverse.jsp' (FN: 249db03a; FD: adf15d88):
 ----> Detected phpMussel-FN.Generic-19!
 -> Checking 'jsp.jsp' (FN: 97749e87; FD: 7efe64cd):
 --> No problems found.
 -> Checking 'jsp.txt' (FN: 65550d2f; FD: 1e28f763):
 --> No problems found.
 --> Checking '1.jsp' (FN: 0bd9abd9; FD: 8a56c04d):
 ---> No problems found.
 --> Checking '2.jsp' (FN: 4c79d109; FD: 86425852):
 ---> No problems found.
 --> Checking 'Browser.jsp' (FN: 6541b899; FD: 17d5acaf):
 ---> No problems found.
 --> Checking 'Readme.txt' (FN: 6d0488d8; FD: cfba2be0):
 ---> No problems found.
 --> Checking 'example-css.css' (FN: 15422a6f; FD: ec215f59):
 ---> No problems found.
 --> Checking 'gpl.txt' (FN: 270664c2; FD: aadb3ce5):
 ---> No problems found.
 --> Checking 'JspSpy.jsp' (FN: b30b2038; FD: aa680766):
 ---> No problems found.
 --> Checking 'JspSpy1.jsp' (FN: 64aa290a; FD: 4084f506):
 ---> No problems found.
 --> Checking 'JspSpyJDK5.jsp' (FN: 7fa901c4; FD: a12c80ee):
 ---> No problems found.
 --> Checking 'JspSpyJDK51.jsp' (FN: d06d351c; FD: 4ec0e20a):
 ---> No problems found.
 --> Checking 'Jspspyweb.jsp' (FN: b82c5e9e; FD: c44c717f):
 ---> No problems found.
 --> Checking 'õ¢ þö¿Þ»¦µÿÄ.txt' (FN: ff2e8f6b; FD: f1d63162):
 ---> No problems found.
 -> Checking 'jweevely.md' (FN: 76bd5e66; FD: 2b535ebb):
 --> No problems found.
 -> Checking 'k81.jsp' (FN: 310f1e65; FD: 5c00f6cd):
 --> No problems found.
 -> Checking 'k8cmd.jsp' (FN: 5d2b159c; FD: 856eb727):
 --> No problems found.
 -> Checking 'ks0ljvi9m2.txt' (FN: 20b4337d; FD: 77d241f9):
 --> No problems found.
 -> Checking 'leo.jsp' (FN: c39b4a68; FD: d0de223f):
 --> No problems found.
 -> Checking 'list1.jsp' (FN: 1332042b; FD: aadd6888):
 --> No problems found.
 -> Checking 'luci.jsp.spy2009.jsp' (FN: 3e38ced7; FD: 9ff4063a):
 --> No problems found.
 -> Checking 'm.jsp' (FN: f63a8913; FD: 1dfb198e):
 --> No problems found.
 -> Checking 'ma (1).jsp' (FN: dbe23373; FD: 73d7aa01):
 --> No problems found.
 -> Checking 'ma.jsp' (FN: f0402e28; FD: 30071b77):
 --> No problems found.
 -> Checking 'ma1.jsp' (FN: 795e7260; FD: f6758d17):
 --> No problems found.
 -> Checking 'ma2.jsp' (FN: 3efe08b0; FD: c9f7a99d):
 --> No problems found.
 -> Checking 'ma3.jsp' (FN: 039e2100; FD: 141a41c9):
 --> No problems found.
 -> Checking 'ma4.jsp' (FN: b1befd10; FD: c7f19faf):
 --> No problems found.
 -> Checking 'maint.jsp' (FN: 265c3e99; FD: 3a50444d):
 --> No problems found.
 -> Checking 'mg.jsp' (FN: 7f00db88; FD: a075f6ee):
 --> No problems found.
 -> Checking 'mmym520.jsp' (FN: 80427cd0; FD: 34b45998):
 --> No problems found.
 -> Checking 'myxx.jsp' (FN: 285516ab; FD: e3d8ff98):
 --> No problems found.
 -> Checking 'myxx1.jsp' (FN: 0d37b5c2; FD: e3d8ff98):
 --> No problems found.
 -> Checking 'no.jsp' (FN: c9e4e2e7; FD: d77c46fa):
 --> No problems found.
 -> Checking 'nogfw.jsp' (FN: f197938e; FD: 9ca0fb74):
 --> No problems found.
 -> Checking 'ok.jsp' (FN: f7389782; FD: 43658374):
 --> No problems found.
 -> Checking 'one8.jsp' (FN: 2fb2fa9a; FD: d7ac1d1d):
 --> No problems found.
 -> Checking 'pyth.jsp' (FN: d8c965a8; FD: 17d5acaf):
 --> No problems found.
 -> Checking 'queryDong.jsp' (FN: c3bff7a8; FD: 2163f0b9):
 --> No problems found.
 -> Checking 'shell.jsp' (FN: 87e9ab6d; FD: 17d5acaf):
 --> No problems found.
 -> Checking 'silic webshell.jsp' (FN: 7ae881ff; FD: d0de223f):
 --> No problems found.
 -> Checking 'spjspshell.jsp' (FN: cf4d191d; FD: 96bc1aba):
 --> No problems found.
 -> Checking 'spyjsp2010.jsp' (FN: 4b324b64; FD: eff89852):
 --> No problems found.
 --> Checking 'dict.txt' (FN: 0e041dbf; FD: b224bbbb):
 ---> Detected phpMussel-X.Backdoor.shell_exec!
 --> Checking 'webshell.txt' (FN: 4c576c48; FD: 38f25a18):
 ---> No problems found.
 -> Checking 'style.jsp' (FN: 01931bc2; FD: 90d6938b):
 --> No problems found.
 -> Checking 'suiyue.jsp' (FN: a91357a2; FD: 3d28b986):
 --> No problems found.
 -> Checking 'sys3.jsp' (FN: 0480ac29; FD: c8ec66ea):
 --> No problems found.
 -> Checking 'system1.jsp.õ©èõ á.jsp' (FN: 73341c6a; FD: e0b7e5ee):
 --> No problems found.
 -> Checking 't.jsp' (FN: 9bca7ce0; FD: 2955d611):
 --> No problems found.
 -> Checking 't00ls.jsp' (FN: f616e894; FD: 6d2b0653):
 --> No problems found.
 -> Checking 'tree.jsp' (FN: 6e9e2a27; FD: 99a9c47d):
 --> No problems found.
 -> Checking 'u.jsp' (FN: a6aa5550; FD: 3bf79d37):
 --> No problems found.
 -> Checking 'utils.jsp' (FN: faf79ca4; FD: b9fccb35):
 --> No problems found.
 -> Checking 'ver007.jsp' (FN: 0efec434; FD: d7ac1d1d):
 --> No problems found.
 -> Checking 'ver008.jsp' (FN: 8cae53e5; FD: 24d9903a):
 --> No problems found.
 -> Checking 'warn.jsp' (FN: df24a8a5; FD: 85fd26d0):
 --> No problems found.
 -> Checking 'web.jsp' (FN: 5ed246ed; FD: 755118de):
 --> No problems found.
 -> Checking 'web02.jsp' (FN: 78c86818; FD: 755118de):
 --> No problems found.
 -> Checking 'webshell-nc.jsp' (FN: 8cfd8210; FD: 08d3b196):
 --> No problems found.
 -> Checking 'x7.jsp' (FN: 1408876b; FD: aba83cce):
 --> No problems found.
 -> Checking 'xia.jsp' (FN: 98f88caf; FD: 9ca837a4):
 --> No problems found.
 -> Checking 'xm.jsp' (FN: 66ab5001; FD: d7ac1d1d):
 --> No problems found.
 -> Checking 'xx.jsp' (FN: ceab48f3; FD: 4b0d27d6):
 --> No problems found.
 -> Checking 'zend.jsp' (FN: 8eca4326; FD: dc3810c5):
 --> No problems found.
 -> Checking 'zval.jsp' (FN: 19da3c61; FD: 038c0c27):
 --> No problems found.
 -> Checking 'zx.jsp' (FN: 8363e9f8; FD: 8c98d54a):
 --> No problems found.
 -> Checking 'µû¦Õ×ïJSPÕ¦ÅÚ®¼µö»µîüõ©èõ áõ  µäÅµá Õ Åµûçõ Â.jsp' (FN: a592e008; FD: 34dd418d):
 --> No problems found.
 --> Checking 'Readme.md' (FN: 5907b610; FD: 91a1e931):
 ---> No problems found.
 --> Checking 'base64.jspx.txt' (FN: 8d32e6e4; FD: 2c5f84c3):
 ---> No problems found.
 -> Checking 'cmd.jspx' (FN: 4f7ec8ab; FD: 2c5f84c3):
 --> No problems found.
 -> Checking 'jjw.jspx' (FN: 10d49d3b; FD: bc0e8106):
 --> No problems found.
 -> Checking 'jspspy.jspx' (FN: db8748bc; FD: 6af57c27):
 --> No problems found.
 -> Checking 'jspx.jspx' (FN: 0bbe0693; FD: b89bb518):
 --> No problems found.
 -> Checking 'jspõ©ÇÕÅÑÞ»Ø.txt' (FN: a64ba770; FD: e20ad7b7):
 --> No problems found.
 -> Checking 'jw.jspx' (FN: a9b1215f; FD: d55eb1ea):
 --> No problems found.
 -> Checking 'paxmac.jspx' (FN: 0588b2a0; FD: 4c7f2e29):
 --> No problems found.
 > Checking 'license' (FN: 5768f419; FD: ec4c468e):
 -> No problems found.
 --> Checking 'ÞÅèÞè¦ÞüèÕñ®Õ«ñ.asp' (FN: 3e168d67; FD: 48321628):
 ---> No problems found.
 --> Checking 'ÞÅèÞè¦ÞüèÕñ®Õ«ñ.php' (FN: 8ac48fba):
 ---> Filetype blacklisted.
 --> Checking '01.asp' (FN: 7416152b; FD: 3190aaf9):
 ---> No problems found.
 --> Checking '1.asp' (FN: 078c4438; FD: 6247fb34):
 ---> No problems found.
 --> Checking '121.jpg' (FN: bfcf5dfe; FD: 23a75bc1):
 ---> No problems found.
 ---> Checking 'indexx.asp' (FN: a4cad648; FD: 19171b88):
 ----> No problems found.
 ---> Checking '01.aspx' (FN: 2014f9d6; FD: df8804aa):
 ----> No problems found.
 ---> Checking '1.aspx' (FN: a4d92259; FD: df8804aa):
 ----> No problems found.
 ---> Checking 'finaly.aspx' (FN: ccf21554; FD: df8804aa):
 ----> No problems found.
 ---> Checking 'wt.asp' (FN: f658f8c6; FD: ee5a7c70):
 ----> No problems found.
 ---> Checking 'wt.aspx' (FN: fe2d29fe; FD: fe9e4930):
 ----> No problems found.
 --> Checking 'google.jpg' (FN: c311d59c; FD: 911b1cc9):
 ---> No problems found.
 --> Checking 'mssqlÕ£¿þ¦ þ«íþÉå.asp' (FN: 88c873f3; FD: 96ed6250):
 ---> No problems found.
 ---> Checking '1.bat' (FN: 7a534eab):
 ----> Filetype blacklisted.
 ---> Checking 'cscript.exe' (FN: f9c5a1d5):
 ----> Filetype blacklisted.
 ---> Checking 'dabao.asp' (FN: 62cb279f; FD: 153e67e8):
 ----> No problems found.
 ---> Checking 'unpack.vbs' (FN: 080e74b9):
 ----> Filetype blacklisted.
 --> Checking 'õ «µö¦Õ¦×µÇº.asp' (FN: cfb1a6f0; FD: 8cc80fef):
 ---> No problems found.
 --> Checking 'õ©ÇÕÅÑÞ»Ø.doc' (FN: ef4e3cbd; FD: 75c83e8f):
 ---> No problems found.
 --> Checking '01.aspx' (FN: 2014f9d6; FD: 6d6d9bff):
 ---> No problems found.
 --> Checking '1----þÄ»ÕóâµúÇµÁïÕèƒÞâ¢ÚØ×Õ©©õ©ìÚöÖ.aspx' (FN: 26484ca4; FD: 5a8ae05f):
 ---> No problems found.
 --> Checking '1.aspx' (FN: a4d92259; FD: fda956c2):
 ---> No problems found.
 --> Checking '11.aspx' (FN: 8663f262; FD: 5a8ae05f):
 ---> No problems found.
 --> Checking 'ASP.NET Web BackDoor.aspx' (FN: 89a77bb7; FD: b45759b0):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'Aspx´ êÕàìµØÇ´ ë.aspx' (FN: 2682a74a; FD: 6d6d9bff):
 ---> No problems found.
 --> Checking 'aspx.aspx' (FN: 5eea1f4f; FD: 7f989cc1):
 ---> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 ---> Checking '1.aspx' (FN: a4d92259; FD: 765faaaa):
 ----> No problems found.
 ---> Checking 'aspxspy.aspx' (FN: 2a777b0c; FD: 765faaaa):
 ----> No problems found.
 ---> Checking 'read.txt' (FN: 5e5879ee; FD: d0aba455):
 ----> No problems found.
 --> Checking 'aspxspy.aspx' (FN: 2a777b0c; FD: 765faaaa):
 ---> No problems found.
 --> Checking 'read.txt' (FN: 5e5879ee; FD: d0aba455):
 ---> No problems found.
 --> Checking 'sniffer--aspxþÜäÕùàµÄóÕÀÑÕàÀ.aspx' (FN: 037b31ef; FD: 6b06a5a8):
 ---> No problems found.
 --> Checking 'view.aspx' (FN: bf801ca8; FD: 212d5977):
 ---> No problems found.
 --> Checking 'Õ¦¦ÕçÇµ©àþê¢þÜäÕñºÚ®¼´ îõ©ìµÇÄõ¦êÕÑ¢þö¿.aspx' (FN: 1c645ccf; FD: fda956c2):
 ---> No problems found.
 --> Checking 'Þä¦Þúñ4ngle.aspx' (FN: 3cf90a8a; FD: d72162eb):
 ---> No problems found.
 --> Checking 'ColdFusion.chm' (FN: 562f2b10; FD: 16660d5e):
 ---> No problems found.
 --> Checking 'cfmShell.cfm' (FN: 0012270e; FD: adae570a):
 ---> No problems found.
 --> Checking 'cmfshell.cmf' (FN: 2d04d95d; FD: 3f85685b):
 ---> No problems found.
 --> Checking 'list.cfm' (FN: 7774267b; FD: 37556150):
 ---> No problems found.
 --> Checking 'mycode12.cfm' (FN: 627db8a4; FD: 8c685004):
 ---> No problems found.
 --> Checking 'xl.cfm' (FN: 00a9c8f3; FD: 3e8e66c4):
 ---> No problems found.
 --> Checking 'WebShell.cgi' (FN: 61a2e2a1):
 ---> Filetype blacklisted.
 --> Checking 'JFolder.jsp' (FN: 3d32f4a3; FD: dbdd313b):
 ---> No problems found.
 --> Checking 'JspSpyJDK5.jsp' (FN: 7fa901c4; FD: c6798b62):
 ---> No problems found.
 --> Checking 'in.jsp' (FN: e981fbef; FD: 23e681b2):
 ---> No problems found.
 --> Checking 'job.jsp' (FN: f9409885; FD: edbdf20b):
 ---> No problems found.
 ---> Checking '1.jsp' (FN: 0bd9abd9; FD: 8a56c04d):
 ----> No problems found.
 ---> Checking '2.jsp' (FN: 4c79d109; FD: 86425852):
 ----> No problems found.
 ---> Checking 'Browser.jsp' (FN: 6541b899; FD: 17d5acaf):
 ----> No problems found.
 ---> Checking 'Readme.txt' (FN: 6d0488d8; FD: cfba2be0):
 ----> No problems found.
 ---> Checking 'example-css.css' (FN: 15422a6f; FD: ec215f59):
 ----> No problems found.
 ---> Checking 'gpl.txt' (FN: 270664c2; FD: aadb3ce5):
 ----> No problems found.
 --> Checking 'ma1.jsp' (FN: 795e7260; FD: f6758d17):
 ---> No problems found.
 --> Checking 'ma2.jsp' (FN: 3efe08b0; FD: c9f7a99d):
 ---> No problems found.
 --> Checking 'ma3.jsp' (FN: 039e2100; FD: 141a41c9):
 ---> No problems found.
 --> Checking 'ma4.jsp' (FN: b1befd10; FD: c7f19faf):
 ---> No problems found.
 --> Checking 'no.jsp' (FN: c9e4e2e7; FD: d77c46fa):
 ---> No problems found.
 --> Checking 'silic webshell.jsp' (FN: 7ae881ff; FD: d0de223f):
 ---> No problems found.
 --> Checking 'spjspshell.jsp' (FN: cf4d191d; FD: 96bc1aba):
 ---> No problems found.
 --> Checking '2.php' (FN: f4fe3c35):
 ---> Filetype blacklisted.
 --> Checking 'moon.php' (FN: 65af0262):
 ---> Filetype blacklisted.
 --> Checking 'phpÞ» ÕÅûiis.txt' (FN: 41b63771; FD: 6c4f0bcb):
 ---> No problems found.
 --> Checking 'phpõ©ÇÕÅÑÞ»ØÕÉÄÚù¿.TXT' (FN: 9097dd09; FD: 2e1b892d):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Checking 'phpþ¢æþ½ÖµëôÕîà´ êdodo´ ë.doc' (FN: d05cb651; FD: 58849d39):
 ----> No problems found.
 ---> Checking 'zip.php' (FN: ea60ce88):
 ----> Filetype blacklisted.
 --> Checking 's-u.php' (FN: 23d14c51):
 ---> Filetype blacklisted.
 ----> Checking 'Readme.txt' (FN: 6d0488d8; FD: aae9c71b):
 -----> Detected phpMussel-PHP.Exploit.eval-0!
 ----> Checking 'ÚøÂÚ¡éPHPõ©ÇÕÅÑÞ»Øµ£¿Ú®¼Õ«óµêÀþ½».htm' (FN: b8e24b47; FD: c37a05dd):
 -----> Detected ClamAV-PHP.Shell-41!
 -----> Detected ClamAV-PHP.Shell-23!
 -----> Detected phpMussel-PHP.Exploit.shell_exec!
 -----> Detected phpMussel-PHP.Shell.Angel-00!
 -----> Detected phpMussel-PHP.Shell.Angel-01!
 -----> Detected phpMussel-PHP.Shell.Angel-03!
 -----> Detected phpMussel-PHP.Shell.Angel-04!
 -----> PHP chameleon attack detected!
 --> Checking 'test3693.war' (FN: 1b905637; FD: 8ea0b5f5):
 ---> No problems found.
 ---> Reading 'test3693.war' (ZIP):
 ----> Success! Proceeding to check contents.
 ----> Checking 'test3693.war' > 'META-INF/MANIFEST.MF' (FN: 02848585; FD: 3dedc274):
 -----> No problems found.
 ----> Checking 'test3693.war' > 'META-INF/context.xml' (FN: 0c1fedd0; FD: f1fa0f43):
 -----> No problems found.
 ----> Checking 'test3693.war' > 'WEB-INF/web.xml' (FN: e0ea18b6; FD: 6d653772):
 -----> No problems found.
 ----> Checking 'test3693.war' > 'index.jsp' (FN: 6c70013b; FD: d77c46fa):
 -----> No problems found.
 --> Checking 'PHP µÉ£þ¦óÕÅ»Þ» ÕÅ»ÕåÖþø«Õ¢òÞäÜµ£¼.php' (FN: f697ab3c):
 ---> Filetype blacklisted.
 --> Checking 'Õ¥êÕÑ¢þö¿þÜäµë½ÕÅ»Þ» ÕÅ»ÕåÖþø«Õ¢òaspÞäÜµ£¼xwdir.asp' (FN: 33430574; FD: be2f01fa):
 ---> No problems found.
 --> Checking 'ÕòèDÕ¦ÅÕÀÑÕàÀ - þø«Õ¢òÞ» ÕåÖµúÇµÁï [ASPþëê].asp' (FN: 36190668; FD: 1ee797ec):
 ---> No problems found.
 --> Checking 'ÕòèDÕ¦ÅÕÀÑÕàÀ - þø«Õ¢òÞ» ÕåÖµúÇµÁï [ASPþëê]Þ»¦µÿÄ.txt' (FN: cda56ce4; FD: cecad0c1):
 ---> No problems found.
 --> Checking 'õ Äµ¦¿ÕåîÞí¿õ©¡Þ» Õ¡ÿÕ£¿ÞÀ»Õ¥ä.aspx' (FN: 5e7af9d9; FD: df8804aa):
 ---> No problems found.
 > Failed to complete scanning process (other)!
 > Checking 'other shell repository' (FN: fa0e0749; FD: 7e084c01):
 -> No problems found.
 --> Checking '12309.php.txt' (FN: c81a90f2; FD: bad6c359):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-X.Backdoor.shell_exec!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.b374k-00!
 ---> Detected phpMussel-PHP.Shell.Webshell-00!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking 'readme.md' (FN: dbf634b3; FD: 1e3777b3):
 ---> No problems found.
 -> Checking '2011.php' (FN: b0f34bcb):
 --> Filetype blacklisted.
 -> Checking '404.php' (FN: 78a6671a):
 --> Filetype blacklisted.
 -> Checking '404.php.txt' (FN: 56600979; FD: 71f11ca0):
 --> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-1!
 --> Detected phpMussel-PHP.Packer-00!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Webshell-02!
 --> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Ani-Shell.php' (FN: 64a0413b):
 ---> Filetype blacklisted.
 --> Checking 'README.txt' (FN: 1f537b83; FD: a15db0c9):
 ---> No problems found.
 -> Checking 'BNKQbAKQ.txt' (FN: 9305ef0e; FD: c21d76af):
 --> No problems found.
 -> Checking 'Crack8_PHP.txt' (FN: 27b43e7c; FD: c8e80578):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-2!
 -> Checking 'DAws.md' (FN: 730bbf31; FD: 4fff0d58):
 --> No problems found.
 ---> Checking 'Antichat Shell v1.3.php' (FN: 3dd970d7):
 ----> Filetype blacklisted.
 ---> Checking 'Antichat.jpg' (FN: 0d50b60f; FD: b4830465):
 ----> No problems found.
 ---> Checking 'Crystal.jpg' (FN: d647d127; FD: ec4e2483):
 ----> No problems found.
 ---> Checking 'Crystal.php' (FN: c63eea1f):
 ----> Filetype blacklisted.
 ---> Checking 'Crystal2.jpg' (FN: 015cfe15; FD: 13e834ed):
 ----> No problems found.
 ---> Checking 'Crystal3.jpg' (FN: 3c3cd7a5; FD: 821cba58):
 ----> No problems found.
 ---> Checking 'Dx.jpg' (FN: 15ed5921; FD: 3575e7b3):
 ----> No problems found.
 ---> Checking 'Dx.php' (FN: 05946219):
 ----> Filetype blacklisted.
 ---> Checking 'MySQL Web Interface Version 0.8.jpg' (FN: 4ec82c30; FD: d4036cd1):
 ----> No problems found.
 ---> Checking 'MySQL Web Interface Version 0.8.php' (FN: 5eb11708):
 ----> Filetype blacklisted.
 ---> Checking 'Mysql interface v1.0.jpg' (FN: a1bdbc4f; FD: 78b132f3):
 ----> No problems found.
 ---> Checking 'Mysql interface v1.0.php' (FN: b1c48777):
 ----> Filetype blacklisted.
 ---> Checking 'NIX REMOTE WEB-SHELL.jpg' (FN: f1080bb6; FD: 987fcd1f):
 ----> No problems found.
 ---> Checking 'NIX REMOTE WEB-SHELL.php' (FN: e171308e):
 ----> Filetype blacklisted.
 ---> Checking 'NIX REMOTE WEB-SHELL2.jpg' (FN: 8673121d; FD: 89575636):
 ----> No problems found.
 ---> Checking 'NetworkFileManagerPHP.jpg' (FN: b0fa990b; FD: 4cb8fd8d):
 ----> No problems found.
 ---> Checking 'NetworkFileManagerPHP.php' (FN: a083a233):
 ----> Filetype blacklisted.
 ---> Checking 'NetworkFileManagerPHP2.jpg' (FN: 33e22fbe; FD: 08ef6315):
 ----> No problems found.
 ---> Checking 'PH Vayv.jpg' (FN: 01d646bf; FD: 66bd6989):
 ----> No problems found.
 ---> Checking 'PH Vayv.php' (FN: 11af7d87):
 ----> Filetype blacklisted.
 ---> Checking 'PHP Shell.jpg' (FN: 4c9d856d; FD: 0197e3df):
 ----> No problems found.
 ---> Checking 'PHP Shell.php' (FN: 5ce4be55):
 ----> Filetype blacklisted.
 ---> Checking 'PHP Shell2.jpg' (FN: 97cf8ccf; FD: 841a39ff):
 ----> No problems found.
 ---> Checking 'PHP Shell3.jpg' (FN: aaafa57f; FD: e6f8010d):
 ----> No problems found.
 ---> Checking 'PHPRemoteView.jpg' (FN: 7eda4268; FD: 3f5794b3):
 ----> No problems found.
 ---> Checking 'PHPRemoteView.php' (FN: 6ea37950):
 ----> Filetype blacklisted.
 ---> Checking 'PHPRemoteView2.jpg' (FN: e7973f87; FD: 19253342):
 ----> No problems found.
 ---> Checking 'SnIpEr_SA Shell.jpg' (FN: be72e630; FD: c8c84e2c):
 ----> No problems found.
 ---> Checking 'SnIpEr_SA Shell.php' (FN: ae0bdd08):
 ----> Filetype blacklisted.
 ---> Checking 'c99.jpg' (FN: 51321e62; FD: 4334a553):
 ----> No problems found.
 ---> Checking 'c99.php' (FN: 414b255a):
 ----> Filetype blacklisted.
 ---> Checking 'c99_PSych0.jpg' (FN: 846518fa; FD: 9672fbf8):
 ----> No problems found.
 ---> Checking 'c99_PSych0.php' (FN: 941c23c2):
 ----> Filetype blacklisted.
 ---> Checking 'c99_locus7s.jpg' (FN: 37a6b0ee; FD: 2d2286a8):
 ----> No problems found.
 ---> Checking 'c99_locus7s.php' (FN: 27df8bd6):
 ----> Filetype blacklisted.
 ---> Checking 'c99_locus7s2.jpg' (FN: e3056560; FD: f3b8474a):
 ----> No problems found.
 ---> Checking 'c99_w4cking.jpg' (FN: effb063a; FD: 52822ab3):
 ----> No problems found.
 ---> Checking 'c99_w4cking.php' (FN: ff823d02):
 ----> Filetype blacklisted.
 ---> Checking 'c99_w4cking2.jpg' (FN: 62632e1b; FD: 472d1d3d):
 ----> No problems found.
 ---> Checking 'c99shell.jpg' (FN: 2ac6cd3b; FD: e3bd8ccd):
 ----> No problems found.
 ---> Checking 'c99shell.php' (FN: 3abff603):
 ----> Filetype blacklisted.
 ---> Checking 'ctt_sh.jpg' (FN: 54221bfd; FD: 68867358):
 ----> No problems found.
 ---> Checking 'ctt_sh.php' (FN: 445b20c5):
 ----> Filetype blacklisted.
 ---> Checking 'gfs_sh.jpg' (FN: d53ad869; FD: 8d139947):
 ----> No problems found.
 ---> Checking 'gfs_sh.php' (FN: c543e351):
 ----> Filetype blacklisted.
 ---> Checking 'gfs_sh2.jpg' (FN: 903bef8b; FD: dc31289f):
 ----> No problems found.
 ---> Checking 'iMHaPFtp.jpg' (FN: f75f11c6; FD: 8782de86):
 ----> No problems found.
 ---> Checking 'iMHaPFtp.php' (FN: e7262afe):
 ----> Filetype blacklisted.
 ---> Checking 'nstview.jpg' (FN: 478a8871; FD: 65c356cf):
 ----> No problems found.
 ---> Checking 'nstview.php' (FN: 57f3b349):
 ----> Filetype blacklisted.
 ---> Checking 'nstview2.jpg' (FN: 83c5c78d; FD: c439865e):
 ----> No problems found.
 ---> Checking 'r57shell.jpg' (FN: a9a8cedc; FD: a449c2a0):
 ----> No problems found.
 ---> Checking 'r57shell.php' (FN: b9d1f5e4):
 ----> Filetype blacklisted.
 ---> Checking 'r57shell127.jpg' (FN: 328bf25d; FD: c290e958):
 ----> No problems found.
 ---> Checking 'r57shell127.php' (FN: 22f2c965):
 ----> Filetype blacklisted.
 ---> Checking 'zacosmall.jpg' (FN: a0439033; FD: 1c7f312d):
 ----> No problems found.
 ---> Checking 'zacosmall.php' (FN: b03aab0b):
 ----> Filetype blacklisted.
 ---> Checking 'C99madShell v. 3.0.jpg' (FN: 84c1ff1e; FD: b78e3aee):
 ----> No problems found.
 ---> Checking 'smowu.php' (FN: d71f10d0):
 ----> Filetype blacklisted.
 ---> Checking 'EgY_SpIdEr ShElL V2.php' (FN: f984c4b8):
 ----> Filetype blacklisted.
 ---> Checking 'EgY_SpIdEr ShElL V2.php.jpg' (FN: 0dee8bf4; FD: db20fc21):
 ----> No problems found.
 ---> Checking 'EgY_SpIdEr ShElL V2.php2.jpg' (FN: 1e5dd421; FD: e8d03088):
 ----> No problems found.
 ---> Checking 'PHPJackal v1.5.jpg' (FN: c79d468b; FD: 63215562):
 ----> No problems found.
 ---> Checking 'PHPJackal v1.5.php' (FN: d7e47db3):
 ----> Filetype blacklisted.
 ---> Checking 'PHPJackal.jpg' (FN: 3b548d55; FD: afe9b986):
 ----> No problems found.
 ---> Checking 'PHPJackal.php' (FN: 2b2db66d):
 ----> Filetype blacklisted.
 ---> Checking 'PHPJackal2.jpg' (FN: bfbafd59; FD: c5fb55b6):
 ----> No problems found.
 ---> Checking 'Shell [ci] .Biz was here.jpg' (FN: 18730503; FD: adc096f1):
 ----> No problems found.
 ---> Checking 'Shell [ci] .Biz was here.php' (FN: 080a3e3b):
 ----> Filetype blacklisted.
 ---> Checking 'c99_madnet.jpg' (FN: 8e2b514b; FD: 39f283f1):
 ----> No problems found.
 ---> Checking 'c99_madnet2.jpg' (FN: 4500bfe6; FD: 160dec54):
 ----> No problems found.
 ---> Checking 'smowu.php' (FN: d71f10d0):
 ----> Filetype blacklisted.
 ---> Checking 'Õ»åþáü.txt' (FN: 9cb5339b; FD: 8626eb6a):
 ----> No problems found.
 ---> Checking 'Þ ×µÄÑÕ»åþáü.jpg' (FN: 13429931; FD: 738ca091):
 ----> No problems found.
 ---> Checking 'ironshell.jpg' (FN: 8b7fb6a5; FD: a33d7359):
 ----> No problems found.
 ---> Checking 'ironshell.php' (FN: 9b068d9d):
 ----> Filetype blacklisted.
 ---> Checking 'Õ»åþáü.txt' (FN: 9cb5339b; FD: 8174ae22):
 ----> No problems found.
 ---> Checking 'INSTALL' (FN: 108f4363; FD: 1c5a5a26):
 ----> No problems found.
 ---> Checking 'config.php' (FN: 9a538727):
 ----> Filetype blacklisted.
 ---> Checking 'phpshell3.jpg' (FN: 2bd7f1eb; FD: 12dee541):
 ----> Detected phpMussel-FN.Shell.Generic-1!
 ---> Checking 'phpshell3.php' (FN: 3baecad3):
 ----> Filetype blacklisted.
 ---> Checking 'pwhash.php' (FN: 6207dc80):
 ----> Filetype blacklisted.
 ---> Checking 'style.css' (FN: 974b71f7; FD: e84bde28):
 ----> No problems found.
 ---> Checking 'Õñçµ¦¿.txt' (FN: de2e84b1; FD: d7084301):
 ----> No problems found.
 ---> Checking 'r57_Mohajer22.jpg' (FN: e1ecce92; FD: a1216527):
 ----> No problems found.
 ---> Checking 'r57_Mohajer22.php' (FN: f195f5aa):
 ----> Filetype blacklisted.
 ---> Checking 'r57_Mohajer222.jpg' (FN: ba601209; FD: 457db0a9):
 ----> No problems found.
 ---> Checking 'r57.jpg' (FN: 5869f702; FD: 21fdec07):
 ----> No problems found.
 ---> Checking 'r572.jpg' (FN: 4ad60474; FD: 0763fbe9):
 ----> No problems found.
 ---> Checking 'r57_iFX.php' (FN: a3341b50):
 ----> Filetype blacklisted.
 ---> Checking 'r57_kartal.jpg' (FN: b978f38a; FD: a1536b3c):
 ----> No problems found.
 ---> Checking 'r57_kartal.php' (FN: a901c8b2):
 ----> Filetype blacklisted.
 ---> Checking 'r57_kartal2.jpg' (FN: a9541e62; FD: 783b4b48):
 ----> No problems found.
 ---> Checking 'r57.jpg' (FN: 5869f702; FD: 74d2818a):
 ----> No problems found.
 ---> Checking 'r57.php' (FN: 4810cc3a):
 ----> Filetype blacklisted.
 ---> Checking 'r572.jpg' (FN: 4ad60474; FD: 663ea046):
 ----> No problems found.
 -> Checking 'PHPþ«ÇÕìòÕ¦ÅÚ®¼µ¦Éþáü.php' (FN: 785e8076):
 --> Filetype blacklisted.
 -> Checking 'Phpspy 2010 Þ¦½õ ¢Ú¬îÞ»üþ òÞ çµ Åµ¦×' (FN: 9c8558bc; FD: 99a01dbc):
 --> No problems found.
 -> Checking 'Phpspy 2011 þ ºþ ¡Þ¦½õ ¢Ú¬îÞ»üþ òÞ çµ Åµ¦×' (FN: b2d7f52b; FD: 649ae0ab):
 --> No problems found.
 -> Checking 'README.md' (FN: 099368d6; FD: 874e9d13):
 --> No problems found.
 -> Checking 'Resume.php.txt' (FN: 54346ac9; FD: 4b6946b1):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Shell.Devil-02!
 -> Checking 'aioshell.php' (FN: 1a3043b7):
 --> Filetype blacklisted.
 -> Checking 'angelÕñºÚ®¼.php' (FN: 9dc33451):
 --> Filetype blacklisted.
 --> Checking 'README.md' (FN: 099368d6; FD: 0e8c4fd3):
 ---> No problems found.
 --> Checking 'b374k-2.2.min.php' (FN: fb92de31):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.2.poly.php' (FN: 2b4bbd45):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.3.min.php' (FN: ece9ca72):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.3.poly.php' (FN: c489d67b):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.4.min.php' (FN: 8888a7bb):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.4.poly.php' (FN: 2655cd02):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.5.php' (FN: 5cc61e45):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.6.php' (FN: 1b666495):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.7.php' (FN: 26064d25):
 ---> Filetype blacklisted.
 --> Checking 'b374k-2.8.php' (FN: a456daf4):
 ---> Filetype blacklisted.
 --> Checking 'b374k-3.2.2.min.php' (FN: 0af11302):
 ---> Filetype blacklisted.
 --> Checking 'b374k-3.2.2.php' (FN: 85697e8c):
 ---> Filetype blacklisted.
 --> Checking 'b374k-3.2.3.min.php' (FN: 1d8a0741):
 ---> Filetype blacklisted.
 --> Checking 'b374k-3.2.3.php' (FN: b809573c):
 ---> Filetype blacklisted.
 ---> Checking 'b374k-2.2.php' (FN: eee6c255):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.3.php' (FN: d386ebe5):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.4.php' (FN: 61a637f5):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.5.source.php' (FN: dfc3f781):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.6.source.php' (FN: a85d2571):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.7.source.php' (FN: 33f8691e):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-2.8.source.php' (FN: 416cf66f):
 ----> Filetype blacklisted.
 ---> Checking 'b374k-3.2.2.php' (FN: 85697e8c):
 ----> Filetype blacklisted.
 -> Checking 'biantai.php' (FN: 66248bf4):
 --> Filetype blacklisted.
 --> Checking '404super.php' (FN: d6681f0d):
 ---> Filetype blacklisted.
 ---> Checking 'code.php' (FN: 6d32d182):
 ----> Filetype blacklisted.
 ---> Checking 'dev_core.php' (FN: fa213f77):
 ----> Filetype blacklisted.
 ---> Checking 'make2.php' (FN: b4309fa6):
 ----> Filetype blacklisted.
 ---> Checking 'readme.md' (FN: dbf634b3; FD: 4fb76b14):
 ----> No problems found.
 -> Checking 'bypass-waf-2015-06-10-01.php' (FN: 624b82f7):
 --> Filetype blacklisted.
 -> Checking 'bypass-waf-2015-06-16-01.php' (FN: a4248b70):
 --> Filetype blacklisted.
 -> Checking 'bypass-waf-2015-06-16-02.php' (FN: e384f1a0):
 --> Filetype blacklisted.
 -> Checking 'bypass-waf-2015-06-16-03.php' (FN: dee4d810):
 --> Filetype blacklisted.
 -> Checking 'carbylamine.txt' (FN: 1b581004; FD: b355fcab):
 --> Detected phpMussel-PHP.Obfuscation.X-04!
 -> Checking 'conflg1.php' (FN: 2ce345a9):
 --> Filetype blacklisted.
 -> Checking 'fbi.php' (FN: 4d293d02):
 --> Filetype blacklisted.
 -> Checking 'ghost.php' (FN: c822666f):
 --> Filetype blacklisted.
 -> Checking 'ghost_source.php' (FN: 83a58420):
 --> Filetype blacklisted.
 -> Checking 'gif.php' (FN: 03c951a4):
 --> Filetype blacklisted.
 -> Checking 'h6ss.php' (FN: 776631b1):
 --> Filetype blacklisted.
 -> Checking 'icesword.php' (FN: e1f6a9e7):
 --> Filetype blacklisted.
 --> Checking '20140901-01.png' (FN: 04dbd355; FD: 7b82ffa3):
 ---> No problems found.
 --> Checking '20140901-02.png' (FN: 437ba985; FD: 5c985803):
 ---> No problems found.
 --> Checking '20140901-03.jpg' (FN: bbeb994c; FD: 6c0dd577):
 ---> No problems found.
 --> Checking '20140901-04.jpg' (FN: 09cb455c; FD: 80da2c55):
 ---> No problems found.
 --> Checking '20140901-05.jpg' (FN: 34ab6cec; FD: 880d3293):
 ---> No problems found.
 --> Checking '20140901-06.png' (FN: b6fb0f45; FD: 694180d7):
 ---> No problems found.
 -> Checking 'indrajith-2.0.txt' (FN: 412f661d; FD: a3743f0a):
 --> Detected phpMussel-HTML.Defacement.Pakistan-10!
 --> Detected phpMussel-PHP.Exploit.eval-2!
 --> Detected phpMussel-PHP.Exploit.eval-3!
 --> Detected phpMussel-X.Backdoor.shell_exec!
 --> Detected ClamAV-PUA.HTML.Crypt-8!
 --> Detected ClamAV-PUA.Trojan.PHP!
 --> Detected phpMussel-PHP.Packer-01!
 --> Detected phpMussel-PHP.Packer-02!
 --> Detected phpMussel-PHP.Defacement.Pakistan-10!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Backdoor.SymLink-01!
 --> Detected phpMussel-PHP.Shell.b374k-00!
 --> Detected phpMussel-Exploit.Plesk-06!
 --> Detected phpMussel-PHP.Backdoor.SymLink-00!
 -> Checking 'indrajith.txt' (FN: dbb7949e; FD: 193e6b56):
 --> Detected phpMussel-PHP.Exploit.eval-2!
 --> Detected phpMussel-PHP.Exploit.eval-3!
 --> Detected phpMussel-X.Backdoor.shell_exec!
 --> Detected ClamAV-PUA.HTML.Crypt-8!
 --> Detected ClamAV-PUA.Trojan.PHP!
 --> Detected phpMussel-PHP.Packer-01!
 --> Detected phpMussel-PHP.Packer-02!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Backdoor.SymLink-01!
 --> Detected phpMussel-Exploit.Plesk-06!
 --> Detected phpMussel-PHP.Backdoor.SymLink-00!
 -> Checking 'itsec.php' (FN: 8cc5c537):
 --> Filetype blacklisted.
 -> Checking 'koplak_php;me.txt' (FN: 2859027c; FD: 412f22d3):
 --> Detected phpMussel-Defacement.X-000!
 --> Detected phpMussel-PHP.Defacement.X-003!
 --> Detected phpMussel-PHP.Shell.b374k-00!
 --> Detected phpMussel-PHP.Shell.Devil-02!
 -> Checking 'lnc.php' (FN: d42bba96):
 --> Filetype blacklisted.
 -> Checking 'lpl38-com-php.txt' (FN: 8fef49fe; FD: 63d6ea90):
 --> Detected ClamAV-HTML.Exploit-11!
 --> Detected ClamAV-PHP.ShellExec!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-1!
 --> Detected phpMussel-PHP.Exploit.eval-2!
 --> Detected phpMussel-PHP.Packer-00!
 --> Detected phpMussel-PHP.Packer-01!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Angel-01!
 -> Checking 'mofµÅÉµØâÕ©ªÕø×µÿ¥Õ©ªµ©àµÑÜÕæ¢õ ñþëêµ£¼.php' (FN: 8d43914d):
 --> Filetype blacklisted.
 -> Checking 'oi.php.decode.txt' (FN: 3f75bf19; FD: 17516e8f):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Commondos-01!
 --> Detected phpMussel-PHP.Shell.Indonesia-16!
 --> Detected phpMussel-PHP.Shell.Indonesia-17!
 --> Detected phpMussel-PHP.Shell.Indonesia-18!
 --> Detected phpMussel-PHP.Shell.Indonesia-30!
 --> Detected phpMussel-PHP.Shell.Indonesia-31!
 --> Detected phpMussel-PHP.Shell.Indonesia-32!
 --> Detected phpMussel-PHP.Shell.PacketStorm-00!
 --> Detected phpMussel-PHP.Shell.PacketStorm-02!
 --> Detected phpMussel-PHP.Shell.Indonesia-19!
 --> Detected phpMussel-PHP.Shell.Indonesia-20!
 --> Detected phpMussel-PHP.Obfuscation.X-03!
 -> Checking 'oi.php.txt' (FN: 8ddc9399; FD: 27a279cb):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-3!
 --> Detected phpMussel-PHP.Shell.Devil-02!
 -> Checking 'other-decode.php' (FN: 38f955c4):
 --> Filetype blacklisted.
 -> Checking 'other.php' (FN: c786cabb):
 --> Filetype blacklisted.
 --> Checking '11.jpg' (FN: 1be1ff6b; FD: 09c460fb):
 ---> No problems found.
 --> Checking 'PHP reflection.php.txt' (FN: 72707e2f; FD: 2141ac36):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'PHPÕÅìÕ¦äÕÉÄÚù¿.php.txt' (FN: c839fca4; FD: c5d07f08):
 ---> No problems found.
 --> Checking 'Readme.md' (FN: 5907b610; FD: c3e2c67a):
 ---> PHP chameleon attack detected!
 -> Checking 'pHpõ©ÇÕÅÑÞ»Øµë½µÅÅÞäÜµ£¼þ¿ïÕ¦Å.php' (FN: 3bcaf49f):
 --> Filetype blacklisted.
 --> Checking 'pas.php' (FN: e5e3697b):
 ---> Filetype blacklisted.
 --> Checking 'password.txt' (FN: 483d4870; FD: 0da931f4):
 ---> No problems found.
 -> Checking 'pass-waf-2014-10-19.php' (FN: b9979629):
 --> Filetype blacklisted.
 -> Checking 'php-extension-backdoor.md' (FN: 901379e7; FD: 79a44de0):
 --> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'client.py' (FN: b4deae87; FD: 8e6740b2):
 ---> No problems found.
 --> Checking 'server.php' (FN: bbdbec72):
 ---> Filetype blacklisted.
 -> Checking 'php-xor.md' (FN: 6538dbf8; FD: 6094cb22):
 --> PHP chameleon attack detected!
 -> Checking 'php-xor.php.md' (FN: 70d59530):
 --> Filetype blacklisted.
 -> Checking 'php1.php' (FN: 0f75f042):
 --> Filetype blacklisted.
 --> Checking 'README' (FN: 77cd4175; FD: 9b24f488):
 ---> No problems found.
 --> Checking 'odd.php' (FN: f6785f7d):
 ---> Filetype blacklisted.
 --> Checking 'phpkit.py' (FN: dfb5bab4; FD: 37e8a438):
 ---> PHP chameleon attack detected!
 --> Checking 'CHANGELOG' (FN: 8c8038ee; FD: fa5589f2):
 ---> No problems found.
 --> Checking 'README' (FN: 77cd4175; FD: 22bb0f18):
 ---> Detected phpMussel-Exploit.Plesk-07!
 --> Checking 'odd.php' (FN: f6785f7d):
 ---> Filetype blacklisted.
 --> Checking 'phpkit.py' (FN: dfb5bab4; FD: 308bc579):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> PHP chameleon attack detected!
 --> Checking 'upload.py' (FN: 61fa7d97; FD: d6ef55ca):
 ---> PHP chameleon attack detected!
 --> Checking 'README.txt' (FN: 1f537b83; FD: 5ecb9708):
 ---> Detected phpMussel-Exploit.Plesk-07!
 --> Checking 'odd.php' (FN: f6785f7d):
 ---> Filetype blacklisted.
 --> Checking 'phpkitcli.py' (FN: eacd611a; FD: 2a4e8579):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> PHP chameleon attack detected!
 -> Checking 'phpshell.php.txt' (FN: 9310f708; FD: c0704aaf):
 --> Detected phpMussel-FN.Shell.Generic-1!
 --> Checking '2008.php' (FN: 76bffa1f):
 ---> Filetype blacklisted.
 --> Checking '2009lite.php' (FN: f0fafabf):
 ---> Filetype blacklisted.
 --> Checking '2009mssql.php' (FN: e70694dc):
 ---> Filetype blacklisted.
 --> Checking '2011.php' (FN: b0f34bcb):
 ---> Filetype blacklisted.
 --> Checking '2013µ£¬ÕèáÕ»å.php' (FN: ceb24430):
 ---> Filetype blacklisted.
 --> Checking '2013ÕèáÕ»å.php' (FN: 552da6b3):
 ---> Filetype blacklisted.
 --> Checking '2014phpspy.php' (FN: fdba04b7):
 ---> Filetype blacklisted.
 --> Checking 'phpspy2010.php' (FN: 6e563bb3):
 ---> Filetype blacklisted.
 --> Checking 'phpspy_2005_full.php' (FN: 98e186b6):
 ---> Filetype blacklisted.
 --> Checking 'phpspy_2005_lite.php' (FN: 4bca8e43):
 ---> Filetype blacklisted.
 --> Checking 'phpspy_2006.php' (FN: 72138ec5):
 ---> Filetype blacklisted.
 -> Checking 'phpwebshell pass by waf for share.md' (FN: c0573da2; FD: bde84fdf):
 --> PHP chameleon attack detected!
 -> Checking 'phpõ©ÇÕÅÑÞ»Ø' (FN: d6d86f6d; FD: 50bad070):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> PHP chameleon attack detected!
 -> Checking 'phpõ©ÇÕÅÑÞ»Ø02.txt' (FN: 082e375e; FD: 09f07870):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 -> Checking 'phpþëêiisspy.php' (FN: 7c5020ba):
 --> Filetype blacklisted.
 -> Checking 'poison.php' (FN: b2a086d0):
 --> Filetype blacklisted.
 -> Checking 'priv8-2012-bypass-shell.php.txt' (FN: 125bde8f; FD: 39e61d46):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-1!
 --> Detected phpMussel-X.Backdoor.shell_exec!
 --> Detected phpMussel-PHP.Packer-00!
 --> Detected phpMussel-Exploit.Plesk-06!
 --> Detected phpMussel-PHP.Backdoor.SymLink-00!
 -> Checking 'priv95.php.txt' (FN: 0c2a72e6; FD: d951b73c):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Shell.Devil-02!
 -> Checking 'r00ts phpÕñºÚ®¼.php' (FN: 48d392e0):
 --> Filetype blacklisted.
 -> Checking 'reverseshell-poc.txt' (FN: 2bc61a77; FD: 605027d5):
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 -> Checking 's.php.txt' (FN: 915d7853; FD: 61bc973a):
 --> No problems found.
 -> Checking 'shell.php' (FN: 3f6e4651):
 --> Filetype blacklisted.
 -> Checking 'shell.php.txt' (FN: c86173e7; FD: b85bd33f):
 --> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Webshell-02!
 --> Detected phpMussel-PHP.Shell.Webshell-03!
 -> Checking 'silic.php' (FN: b4c1057e):
 --> Filetype blacklisted.
 -> Checking 'spy.php' (FN: 5631ba79):
 --> Filetype blacklisted.
 -> Checking 'supers.php' (FN: 20bb34be):
 --> Filetype blacklisted.
 -> Checking 'sure.php_.txt' (FN: 69e34588; FD: 4c9ca451):
 --> Detected phpMussel-PHP.Exploit.eval-2!
 --> Detected phpMussel-PHP.Backdoor.ZeroZero-01!
 --> Checking 'getcode.php' (FN: 80f96151):
 ---> Filetype blacklisted.
 --> Checking 'readme.md' (FN: dbf634b3; FD: bed35eb4):
 ---> No problems found.
 --> Checking 'webshell.php' (FN: 06f112dc):
 ---> Filetype blacklisted.
 -> Checking 'tiamo.php.decode.txt' (FN: 429be53b; FD: bad831e0):
 --> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Backdoor.Bajakan-03!
 --> Detected phpMussel-PHP.Shell.Webshell-02!
 --> Detected phpMussel-PHP.Shell.Webshell-03!
 -> Checking 'tiamo.php.txt' (FN: 48211da9; FD: c5fb238d):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-3!
 --> Detected phpMussel-PHP.Shell.Devil-02!
 -> Checking 'tips.md' (FN: 82b74128; FD: 91eddcf9):
 --> No problems found.
 -> Checking 'webshell-123.php' (FN: 81288b02):
 --> Filetype blacklisted.
 -> Checking 'webshell-cnseay-x.php' (FN: 13d20c39):
 --> Filetype blacklisted.
 -> Checking 'webshell-cnseay02-1.php' (FN: e1775a54):
 --> Filetype blacklisted.
 --> Checking 'ReadMe.txt' (FN: 6aa88dee; FD: 859356e4):
 ---> No problems found.
 --> Checking 'idc.php' (FN: 2788b657):
 ---> Filetype blacklisted.
 --> Checking 'wsb.pl' (FN: d1500622):
 ---> Filetype blacklisted.
 --> Checking 'WSO_4_0_5.php' (FN: 175bb747):
 ---> Filetype blacklisted.
 --> Checking 'WSO_base64.php' (FN: 84682ce5):
 ---> Filetype blacklisted.
 --> Checking 'wso.php' (FN: cb4a8ee6):
 ---> Filetype blacklisted.
 --> Checking 'wso2.php' (FN: d549fbf1):
 ---> Filetype blacklisted.
 --> Checking 'wso2_pack.php' (FN: 91c81ca1):
 ---> Filetype blacklisted.
 -> Checking 'wso2.5.1.php' (FN: 32910260):
 --> Filetype blacklisted.
 -> Checking 'wso2.php.txt' (FN: d296bea2; FD: cc23635e):
 --> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Webshell-02!
 --> Detected phpMussel-PHP.Shell.Webshell-03!
 -> Checking 'xiao.php.txt' (FN: 718f2b0e; FD: a8ea5e7a):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-2!
 -> Checking 'xiaom.php' (FN: 3e2aa71f):
 --> Filetype blacklisted.
 -> Checking 'xslt.php' (FN: 5d4e361a):
 --> Filetype blacklisted.
 -> Checking 'xw.php' (FN: f47c321e):
 --> Filetype blacklisted.
 -> Checking 'yyihacker.php.txt' (FN: ed85de92; FD: 9b334919):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-2!
 --> Detected ClamAV-PUA.HTML.Crypt-8!
 --> Detected ClamAV-PUA.Trojan.PHP!
 --> Detected phpMussel-PHP.Packer-01!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 -> Checking 'µƒÉÕÅÿÕ épHpõ©ÇÕÅÑÞ»Øµ£¿Ú®¼.php' (FN: 9b428b7c):
 --> Filetype blacklisted.
 -> Checking 'µ×üÕàÂÚÜÉÞö¢þÜäpHpÕ¦ÅÚ®¼þ® µÅÆÕ£¿µ¡úÕ©©ÚíÁÚØóõ©¡.php' (FN: 94fed24d):
 --> Filetype blacklisted.
 -> Checking 'ÕÅªþ¦ PHPõ©ÇÕÅÑÞ»ØÕ¦ÅÚ®¼.md' (FN: b2aac3d9; FD: 065dd021):
 --> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> PHP chameleon attack detected!
 -> Checking 'Õø¢ÕñûµƒÉÞ«¦ÕØøõ©ìÕÉ½Get,PostþÜäpHpõ©ÇÕÅÑÞ»Ø.php' (FN: 65b642d7):
 --> Filetype blacklisted.
 -> Checking 'ÚØ×Õ©©ÞºäþÜäpHpõ©ÇÕÅÑÞ»Øµ£¿Ú®¼.php' (FN: 5e8ebb76):
 --> Filetype blacklisted.
 -> Checking 'Þ çÕÉäÕñºµØÇÞ¢»þÜäpHpõ©ÇÕÅÑÞ»Ø.php' (FN: ce2f6924):
 --> Filetype blacklisted.
 -> Checking 'õ©ÇÕÅÑÞ»Ø2015-06-10-01.php' (FN: 675185a2):
 --> Filetype blacklisted.
 -> Checking 'õ©ÇÕÅÑÞ»Ø2015-06-10-02.php' (FN: 20f1ff72):
 --> Filetype blacklisted.
 -> Checking 'õ©ÇÕÅÑÞ»Ø2015-06-10-03.php' (FN: 1d91d6c2):
 --> Filetype blacklisted.
 -> Checking 'õ©Çõ©¬Þ çÕ«ëÕà¿þïùþÜäpHpõ©ÇÕÅÑÞ»Ø.php' (FN: cf0ca844):
 --> Filetype blacklisted.
 -> Checking 'õ©ìÕ©ªÕ òÕÅÀþÜäpHpõ©ÇÕÅÑÞ»Ø.php' (FN: ea9dafde):
 --> Filetype blacklisted.
 -> Checking 'þëøXþÜäpHpõ©ÇÕÅÑÞ»Ø.php' (FN: 829a8a80):
 --> Filetype blacklisted.
 -> Checking 'Silic Group_cgi.pl' (FN: 591935eb):
 --> Filetype blacklisted.
 -> Checking 'Silic Group_readme.txt' (FN: 4feaa0aa; FD: 698650e9):
 --> No problems found.
 -> Checking 'WebShell.cgi.pl' (FN: 2a8382e1):
 --> Filetype blacklisted.
 -> Checking 'exim.pl' (FN: a715361d):
 --> Filetype blacklisted.
 -> Checking 'hmass (priv8 mass defacor).pl' (FN: 10f1e359):
 --> Filetype blacklisted.
 -> Checking 'inc.pl' (FN: c840519f):
 --> Filetype blacklisted.
 -> Checking 'ka0tic.pl' (FN: f8f733c9):
 --> Filetype blacklisted.
 -> Checking 'lurm_safemod_on.cgi.pl' (FN: 81358043):
 --> Filetype blacklisted.
 --> Checking 'AUTHORS' (FN: b149d44b; FD: 5cc141c3):
 ---> No problems found.
 --> Checking 'COPYING' (FN: 619e8737; FD: 45aa1dcb):
 ---> No problems found.
 --> Checking 'ChangeLog' (FN: 72fee242; FD: 337c0c4d):
 ---> No problems found.
 --> Checking 'INSTALL' (FN: 108f4363; FD: 6bf535a6):
 ---> No problems found.
 --> Checking 'README' (FN: 77cd4175; FD: b4a3755c):
 ---> No problems found.
 --> Checking 'perlwebshell.cgi' (FN: 5d9b6afc):
 ---> Filetype blacklisted.
 --> Checking 'pps-v1.0.pl' (FN: 5f1d89a2):
 ---> Filetype blacklisted.
 --> Checking 'pps-v3.0.pl' (FN: 12d528a9):
 ---> Filetype blacklisted.
 --> Checking 'pps-v3.5.pl' (FN: 250bd89b):
 ---> Filetype blacklisted.
 --> Checking 'pps-v4.0.pl' (FN: 0fd01811):
 ---> Filetype blacklisted.
 -> Checking 'rcpexp.pl' (FN: 291c229a):
 --> Filetype blacklisted.
 -> Checking 'remot shell.pl' (FN: 778128bb):
 --> Filetype blacklisted.
 -> Checking 'telnet.cgi.pl' (FN: 4bf033bb):
 --> Filetype blacklisted.
 -> Checking 'telnet.pl' (FN: 41c2908a):
 --> Filetype blacklisted.
 -> Checking 'Phyton Shell.py' (FN: 50de0f8e; FD: b028dfd5):
 --> No problems found.
 -> Checking 'cgi-python.py' (FN: 3a2fde01; FD: 13c9d954):
 --> No problems found.
 -> Checking 'd00r_py3.py' (FN: dfeb1abb; FD: 807eb1b5):
 --> No problems found.
 -> Checking 'darkBC.py.txt' (FN: 690fbff3; FD: 473c817e):
 --> No problems found.
 -> Checking 'sctp_reverse.py.txt' (FN: 8c5f118d; FD: 8763d72a):
 --> No problems found.
 -> Checking 'smtpd.py' (FN: 448c70f7; FD: 5ea99f7c):
 --> No problems found.
 -> Checking 'xshock-0.1.tar.gz' (FN: e4a7c4f8; FD: 31634155):
 --> No problems found.
 --> Reading 'xshock-0.1.tar.gz' (GZIP):
 ---> Success! Proceeding to check contents.
 ---> Checking 'xshock-0.1.tar.gz' > 'xshock-0.1.tar' (FN: e4a7c4f8; FD: 12cd097b):
 ----> No problems found.
 ---> Checking 'xshock-0.1.tar.gz' > 'README' (FN: 77cd4175; FD: 26851160):
 ----> No problems found.
 ---> Checking 'xshock-0.1.tar.gz' > 'xshock.py' (FN: c8d6fa06; FD: 0f5a2fb5):
 ----> No problems found.
 ---> Checking 'xshock-0.1.tar.gz' > '' (FN: 00000000; FD: 00000000):
 ----> Missing filename!
 --> Checking '3fexe.txt' (FN: 2b870b0c; FD: 4eb24d80):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'ASpy.txt' (FN: ce533f15; FD: fb078b42):
 ---> No problems found.
 --> Checking 'EFSO.txt' (FN: d0a6b838; FD: 216bd4ae):
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected ZBB-HTML.Defacement.D3BX-01!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'ELMALISEKER Backd00r.asp' (FN: ee089981; FD: 4861c9b6):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'NTDaddy.v1.9.txt' (FN: b0c322d0; FD: 6cc36e46):
 ---> No problems found.
 --> Checking 'RHTools.v1.5-BETA.txt' (FN: be2557c9; FD: f6e27b0c):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'RemExp.asp' (FN: 560e582c; FD: 50042a42):
 ---> No problems found.
 --> Checking 'Server Variables.asp' (FN: b09e3120; FD: 83b9fcfd):
 ---> No problems found.
 --> Checking 'aspSH.v1.txt' (FN: 952f90f8; FD: 1bf05935):
 ---> No problems found.
 --> Checking 'aspxSH.txt' (FN: 2654c07f; FD: 9c9d4586):
 ---> Detected phpMussel-ASP.Shell.ASPXSpy-00!
 --> Checking 'aspxshell.aspx.txt' (FN: 47ec2eba; FD: 7975fa86):
 ---> No problems found.
 --> Checking 'aspydrv.asp' (FN: b6717ca1; FD: fefbc84d):
 ---> No problems found.
 --> Checking 'aspydrv.txt' (FN: 480500e8; FD: 7b96092c):
 ---> No problems found.
 --> Checking 'cmd.asp' (FN: a205661c; FD: e9206ce3):
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'cmd.aspx' (FN: 987f4faa; FD: 06cd60eb):
 ---> No problems found.
 --> Checking 'cmdexec.aspx' (FN: 83c70028; FD: d9c91048):
 ---> No problems found.
 --> Checking 'elmaliseker.asp' (FN: d306110c; FD: fe8f7a0f):
 ---> No problems found.
 --> Checking 'filesystembrowser.aspx' (FN: 4470645c; FD: 379e1b3a):
 ---> No problems found.
 --> Checking 'fileupload.aspx' (FN: 1f1d7c43; FD: 0fabaad2):
 ---> No problems found.
 --> Checking 'list.asp' (FN: 204378d8; FD: 6ad91d08):
 ---> No problems found.
 --> Checking 'ntdaddy.asp' (FN: cef8dcaa; FD: 3d382aa2):
 ---> No problems found.
 --> Checking 'spexec.aspx' (FN: 1e9c070c; FD: 94b75593):
 ---> No problems found.
 --> Checking 'sql.aspx' (FN: a8e90a56; FD: a9d7e2f5):
 ---> No problems found.
 --> Checking 'tool.asp' (FN: c84979df; FD: 543727f9):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'toolaspshell.txt' (FN: 0ee5d7a9; FD: f6a3f8c0):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'up.asp' (FN: 4e10ff0d; FD: 750d0c74):
 ---> No problems found.
 --> Checking 'zehir.asp' (FN: 52d03e96; FD: 65ae2250):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'zehir.txt' (FN: aca442df; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'zehir4.asp' (FN: 46919b6b; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'zehir4.txt' (FN: b8e5e722; FD: 7709f5b1):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'JspWebshell 1.2.jsp' (FN: bd1511fd; FD: 6100a46c):
 ---> No problems found.
 --> Checking 'browser.jsp' (FN: e3dd374e; FD: 59e58a7c):
 ---> No problems found.
 --> Checking 'cmd.jsp' (FN: ae5089fd; FD: c72ab082):
 ---> No problems found.
 --> Checking 'cmd_win32.jsp' (FN: 2af8d4a8; FD: a4a3b9e4):
 ---> No problems found.
 --> Checking 'jspShell.jsp' (FN: cb28ce0c; FD: 7051fdb4):
 ---> No problems found.
 --> Checking 'jspbd.jsp' (FN: 99c7ebe2; FD: e082dda9):
 ---> No problems found.
 --> Checking 'list.jsp' (FN: 2c169739; FD: de8fa945):
 ---> No problems found.
 --> Checking 'up.jsp' (FN: 424510ec; FD: 764bd2bf):
 ---> No problems found.
 --> Checking 'up_win32.jsp' (FN: f95bce9e; FD: 605295af):
 ---> No problems found.
 --> Checking 'cmd.c' (FN: 419e8f6c; FD: 45db0248):
 ---> No problems found.
 --> Checking 'cmd.cfm' (FN: f53238bf; FD: 25f81a26):
 ---> No problems found.
 --> Checking '150.php' (FN: 8fd37fce):
 ---> Filetype blacklisted.
 --> Checking '27.9.txt' (FN: fd02f05e; FD: 1a615e7b):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking '2mv2.txt' (FN: edaafd2c; FD: 779444c3):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking '404.php' (FN: 78a6671a):
 ---> Filetype blacklisted.
 --> Checking '404.txt' (FN: 3200198e; FD: 48b4cf13):
 ---> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Ajax_PHP Command Shell.txt' (FN: 5f817131; FD: 27d29060):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Ajax_PHP Command Shell.txt.1' (FN: fa5f0270):
 ---> Filetype blacklisted.
 --> Checking 'Ani-Shell.php' (FN: 64a0413b):
 ---> Filetype blacklisted.
 --> Checking 'AntiSecShell.v0.5.txt' (FN: ca966103; FD: 192a6c95):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-X.Backdoor.shell_exec!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'Antichat Shell v1.3.php' (FN: 3dd970d7):
 ---> Filetype blacklisted.
 --> Checking 'Antichat Shell v1.3.txt' (FN: 777f0e43; FD: 27153bfa):
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Ayyildiz Tim  -AYT- Shell v 2.1 Biz.txt' (FN: 5e6a3b57; FD: bbad76ec):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'Backdoor.PHP.Agent.php' (FN: bc8f16f5):
 ---> Filetype blacklisted.
 --> Checking 'Crystal.txt' (FN: 8c98948b; FD: bbfac551):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'CrystalShell v.1.txt' (FN: 77a27645; FD: 740da771):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'Cyber Shell (v 1.0).php' (FN: 2c216143):
 ---> Filetype blacklisted.
 --> Checking 'DTool Pro.txt' (FN: 301a0a92; FD: 5807c6ad):
 ---> Detected ClamAV-PHP.Defash.A!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Dive Shell 1.0 - Emperor Hacking Team.php' (FN: 1df2b088):
 ---> Filetype blacklisted.
 --> Checking 'Dive Shell 1.0 - Emperor Hacking Team.txt' (FN: 5754ce1c; FD: 040bb035):
 ---> No problems found.
 --> Checking 'Dx.txt' (FN: 4f321c8d; FD: 06f51a98):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'DxShell.1.0.txt' (FN: 598701ef; FD: 70919953):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'FaTaLisTiCz_Fx.txt' (FN: 2845d69e; FD: 87e26da2):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'Fx29Sh.3.2.12.08.txt' (FN: b67c42ff; FD: a2f49891):
 ---> Detected phpMussel-FN.Generic-12!
 ---> Detected ClamAV-PHP.Fx29!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected ZBB-PHP.Defacement.D3BX-08!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-02!
 ---> Detected ZBB-HTML.Defacement.D3BX-08!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'G5.php' (FN: 23638c4f):
 ---> Filetype blacklisted.
 --> Checking 'GFS web-shell ver 3.1.7 - PRiV8.txt' (FN: 6802ec14; FD: 811667b1):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'GNY.Shell.v1.1.txt' (FN: 525410fc; FD: 57d3a2a4):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-09!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-22!
 ---> Detected phpMussel-PHP.Shell.Indonesia-23!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-27!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'KAdot Universal Shell v0.1.6.php' (FN: 9c486a39):
 ---> Filetype blacklisted.
 --> Checking 'KAdot Universal Shell v0.1.6.txt' (FN: d6ee14ad; FD: 2b930d27):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php' (FN: c44a37fe):
 ---> Filetype blacklisted.
 --> Checking 'Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.txt' (FN: 8eec496a; FD: c97bb4ce):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Macker's Private PHPShell.php' (FN: f158fcdf):
 ---> Filetype blacklisted.
 --> Checking 'Moroccan Spamers Ma-EditioN By GhOsT.txt' (FN: d5e3d825; FD: 2e03197c):
 ---> No problems found.
 --> Checking 'MySQL Web Interface Version 0.8.php' (FN: 5eb11708):
 ---> Filetype blacklisted.
 --> Checking 'MySQL Web Interface Version 0.8.txt' (FN: 1417699c; FD: 8711b37a):
 ---> No problems found.
 --> Checking 'Mysql interface v1.0.txt' (FN: fb62f9e3; FD: c919cdea):
 ---> No problems found.
 --> Checking 'NCC-Shell.txt' (FN: ebdbe7df; FD: 0d3c694b):
 ---> Detected phpMussel-Defacement.X-000!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php' (FN: 44bc3e11):
 ---> Filetype blacklisted.
 --> Checking 'NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.txt' (FN: 0e1a4085; FD: 345a14bc):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'NetworkFileManagerPHP.txt' (FN: ea25dca7; FD: cb317ab1):
 ---> No problems found.
 --> Checking 'PH Vayv.txt' (FN: 5b090313; FD: be834afa):
 ---> No problems found.
 --> Checking 'PHANTASMA.txt' (FN: 0a5e56f3; FD: b74ceafc):
 ---> Detected ClamAV-PHP.Exploit.E!
 --> Checking 'PHP Shell.txt' (FN: 1642c0c1; FD: eae134b1):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'PHPJackal.txt' (FN: 618bc8f9; FD: dc54c0f5):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-Exploit.Plesk-06!
 --> Checking 'PHPRemoteView.txt' (FN: 240507c4; FD: c53fc9de):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'PHPSPY.php' (FN: a87fca4e):
 ---> Filetype blacklisted.
 --> Checking 'Php_Backdoor.txt' (FN: 345059fe; FD: d740f922):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'Private-i3lue.php' (FN: c6423b0a):
 ---> Filetype blacklisted.
 --> Checking 'Private-i3lue.txt' (FN: 8ce4459e; FD: 4405c3df):
 ---> No problems found.
 --> Checking 'RedhatC99 [login=redhat-pass=root]' (FN: cef94e37; FD: 322133b9):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> PHP chameleon attack detected!
 --> Checking 'Rootshell.v.1.0.txt' (FN: 9c445714; FD: 6a5fc64b):
 ---> No problems found.
 --> Checking 'Safe mode breaker.php' (FN: e789296e):
 ---> Filetype blacklisted.
 --> Checking 'Safe0ver Shell -Safe Mod Bypass By Evilc0der.txt' (FN: 02b8714c; FD: ee7c2c88):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php' (FN: 37918495):
 ---> Filetype blacklisted.
 --> Checking 'Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.txt' (FN: 7d37fa01; FD: 46cf0591):
 ---> No problems found.
 --> Checking 'Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.txt' (FN: 094e5a39; FD: 1e3a6acf):
 ---> No problems found.
 --> Checking 'SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php' (FN: cc59a7c0):
 ---> Filetype blacklisted.
 --> Checking 'SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.txt' (FN: 86ffd954; FD: 2dfa4daa):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Iran-00!
 ---> Detected phpMussel-PHP.Shell.Iran-02!
 --> Checking 'SimShell 1.0 - Simorgh Security MGZ.php' (FN: da15255b):
 ---> Filetype blacklisted.
 --> Checking 'SimShell 1.0 - Simorgh Security MGZ.txt' (FN: 90b35bcf; FD: 336fdc06):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'SnIpEr_SA Shell.txt' (FN: e4ada39c; FD: 317148b0):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'Sst-Sheller.php' (FN: ee367291):
 ---> Filetype blacklisted.
 --> Checking 'SyRiAn.Sh3ll.v7.txt' (FN: fcf65100; FD: f202c8b2):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-X.Backdoor.shell_exec!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-27!
 ---> Detected phpMussel-Exploit.Plesk-06!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking 'WinX Shell.php' (FN: 0dce98d7):
 ---> Filetype blacklisted.
 --> Checking 'WinX Shell.txt' (FN: 4768e643; FD: 983f014b):
 ---> No problems found.
 --> Checking 'Worse Linux Shell.php' (FN: cece5020):
 ---> Filetype blacklisted.
 --> Checking 'Worse Linux Shell.txt' (FN: 84682eb4; FD: a8955655):
 ---> Detected ClamAV-PHP.Remoteadmin-2!
 --> Checking 'a.php' (FN: 8b4d892e):
 ---> Filetype blacklisted.
 --> Checking 'aZRaiLPhp v1.0.php' (FN: 157c59ac):
 ---> Filetype blacklisted.
 --> Checking 'aZRaiLPhp v1.0.txt' (FN: 5fda2738; FD: c3f185f2):
 ---> No problems found.
 --> Checking 'accept_language.txt' (FN: b6ce6f6b; FD: c2f3a402):
 ---> No problems found.
 --> Checking 'acid.php' (FN: 694986e5):
 ---> Filetype blacklisted.
 --> Checking 'antichat.php' (FN: 051856cf):
 ---> Filetype blacklisted.
 --> Checking 'arabicspy.php' (FN: 35d13227):
 ---> Filetype blacklisted.
 --> Checking 'b37.php' (FN: f997b3e9):
 ---> Filetype blacklisted.
 --> Checking 'b374k.v1.txt' (FN: 0764cee6; FD: 39cde5b6):
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 ---> Detected phpMussel-PHP.Defacement.X-004!
 ---> Detected phpMussel-PHP.Shell.b374k-00!
 ---> Detected phpMussel-HTML.Defacement.X-004!
 --> Checking 'backupsql.txt' (FN: c6dec180; FD: 72ae47d6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'bdotw44shell.txt' (FN: 00a4b030; FD: b0187eb5):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'bug (1).php' (FN: a4b390ba):
 ---> Filetype blacklisted.
 --> Checking 'bug.php' (FN: 18859553):
 ---> Filetype blacklisted.
 --> Checking 'bypass.txt' (FN: 7b56a45e; FD: 4ca6554c):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php' (FN: 7d472ef8):
 ---> Filetype blacklisted.
 --> Checking 'c100.txt' (FN: 339237a6; FD: 54d11d47):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c37.php' (FN: 5fe0b85d):
 ---> Filetype blacklisted.
 --> Checking 'c66.php' (FN: 324d005e):
 ---> Filetype blacklisted.
 --> Checking 'c99-bd.txt' (FN: e5359000; FD: 98f10d19):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99-shadows-mod.php' (FN: 65395f46):
 ---> Filetype blacklisted.
 --> Checking 'c99.php' (FN: 414b255a):
 ---> Filetype blacklisted.
 --> Checking 'c99.txt' (FN: 0bed5bce; FD: 0f2b8d5e):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c993.txt' (FN: 60d252d9; FD: cbcc48af):
 ---> Detected ClamAV-PHP.C99!
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'c99_2.txt' (FN: a13c0e86; FD: 2a82049b):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99_PSych0.php' (FN: 941c23c2):
 ---> Filetype blacklisted.
 --> Checking 'c99_locus7s.txt' (FN: 6d79f542; FD: 03b87cf3):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99_madnet.txt' (FN: d4f414e7; FD: 308d89e4):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'c99_w4cking.txt' (FN: b5244396; FD: 97e28da9):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'c99madshell.php' (FN: 2730a2a5):
 ---> Filetype blacklisted.
 --> Checking 'c99shell.php' (FN: 3abff603):
 ---> Filetype blacklisted.
 --> Checking 'c99ud.txt' (FN: b05812bd; FD: 1145ee73):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.Script.Packed-10!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'c99unlimited.txt' (FN: bf5c1ccb; FD: 8131948a):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99v2.php' (FN: cb3924ec):
 ---> Filetype blacklisted.
 --> Checking 'cbfphpsh.txt' (FN: 68f29610; FD: be9738c4):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-Exploit.Plesk-06!
 --> Checking 'cihshell_fix.php' (FN: 65915adc):
 ---> Filetype blacklisted.
 --> Checking 'cmd.php' (FN: 16d764c1):
 ---> Filetype blacklisted.
 --> Checking 'cmd.txt' (FN: 5c711a55; FD: e8e5ed85):
 ---> No problems found.
 --> Checking 'co.php' (FN: cdfd1c05):
 ---> Filetype blacklisted.
 --> Checking 'connect-back.php.txt' (FN: 7329bfbf; FD: 8f7b2bdd):
 ---> No problems found.
 --> Checking 'cpanel.txt' (FN: 4951d9b2; FD: faf8137e):
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 --> Checking 'cpg_143_incl_xpl.php' (FN: 47a2f7ee):
 ---> Filetype blacklisted.
 --> Checking 'ctt_sh.txt' (FN: 0efd5e51; FD: d2e72264):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'cybershell.txt' (FN: 98f1147a; FD: 5e34a23b):
 ---> No problems found.
 --> Checking 'dC3 Security Crew Shell PRiV.txt' (FN: 4d136c07; FD: 22c48899):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 --> Checking 'dC3.Security.Crew.Shell.priv8.txt' (FN: d5679cb1; FD: 22c48899):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 --> Checking 'egy.txt' (FN: 064a5f3a; FD: 64b9c3ef):
 ---> Detected phpMussel-HTML.Defacement.DZ-01!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-23!
 ---> Detected phpMussel-PHP.Shell.Indonesia-33!
 ---> Detected phpMussel-PHP.Shell.R57-00!
 ---> Detected phpMussel-PHP.Shell.R57-01!
 ---> Detected phpMussel-PHP.Shell.R57-02!
 --> Checking 'erne.txt' (FN: 466978f9; FD: c687cfe1):
 ---> Detected ClamAV-PHP.Bypassshell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'ex0shell.txt' (FN: 74f7c092; FD: c1e448fc):
 ---> Detected ClamAV-Riskware.PHP.Blackshell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Indonesia-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-33!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'fx.txt' (FN: 0556b8b0; FD: 3534f479):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'g00nshell-v1.3.txt' (FN: 8a6a7170; FD: 06271343):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'g00nv13.php' (FN: dee911b5):
 ---> Filetype blacklisted.
 --> Checking 'gfs_sh.txt' (FN: 8fe59dc5; FD: f0d64122):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'h4ntu shell [powered by tsoi].php' (FN: f4cb95eb):
 ---> Filetype blacklisted.
 --> Checking 'h4ntu shell [powered by tsoi].txt' (FN: be6deb7f; FD: a0672c2b):
 ---> No problems found.
 --> Checking 'hkrkoz.php' (FN: 3bb5d856):
 ---> Filetype blacklisted.
 --> Checking 'iMHaPFtp.txt' (FN: ad80546a; FD: 60090f0e):
 ---> No problems found.
 --> Checking 'ironshell.txt' (FN: d1a0f309; FD: af75d42e):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'isko.txt' (FN: adccef10; FD: b07e55a5):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'iskorpitx.txt' (FN: 107e42c7; FD: b07e55a5):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'itsecteam.v2.1.txt' (FN: 7ab7b578; FD: b58ff4d3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-Exploit.Plesk-06!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking 'itsecteam_shell.php' (FN: d3a2464d):
 ---> Filetype blacklisted.
 --> Checking 'jHn.php' (FN: 9e9ead36):
 ---> Filetype blacklisted.
 --> Checking 'knullsh.txt' (FN: 21559c15; FD: 56db779e):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'kolang-bypass.txt' (FN: d33987dd; FD: e638e13e):
 ---> No problems found.
 --> Checking 'kral.txt' (FN: afa5ba6f; FD: 4134bc94):
 ---> No problems found.
 --> Checking 'lamashell.txt' (FN: 1e6e9d5a; FD: 6fd82037):
 ---> No problems found.
 --> Checking 'list.php' (FN: 94917a05):
 ---> Filetype blacklisted.
 --> Checking 'load_shell.txt' (FN: d6345cdb; FD: 890dbaf6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'locus.txt' (FN: a9cdda46; FD: 2143498a):
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'log.txt' (FN: a051b167; FD: 64bc7024):
 ---> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'lolipop.txt' (FN: 2bd5f0ff; FD: 5c493ba6):
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 --> Checking 'lostDC.txt' (FN: b972940f; FD: 2d12b43e):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'ly0kha.txt' (FN: 9b433ff4; FD: 9d58f8f5):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'matamu.txt' (FN: af93870b; FD: 000e017d):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'megabor.txt' (FN: 2648e419; FD: f7266b94):
 ---> Detected ClamAV-Riskware.PHP.Blackshell!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Indonesia-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-33!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'metaslsoft.php' (FN: 8c9c7059):
 ---> Filetype blacklisted.
 --> Checking 'mini.j0s_ali.j0e.v27.9.txt' (FN: 694605a9; FD: 1a615e7b):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'myshell.txt' (FN: 695ae8ea; FD: 7de9d1be):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql.txt' (FN: 1a9d2822; FD: 16292d9c):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql_tool.txt' (FN: 8eaa9e48; FD: 77491489):
 ---> No problems found.
 --> Checking 'mysqlwebsh.php' (FN: ad77f432):
 ---> Filetype blacklisted.
 --> Checking 'newsh.php' (FN: 0ea56dcf):
 ---> Filetype blacklisted.
 --> Checking 'nshell.txt' (FN: bf6570de; FD: 0593b6ba):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'nst.txt' (FN: 649a8ffc; FD: df60d40a):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'nstview.txt' (FN: 1d55cddd; FD: 990eb15d):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'p0isoN.sh3ll.txt' (FN: 86673bab; FD: a150f721):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'pHpINJ.txt' (FN: 89c09865; FD: 763ed0ca):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'php-backdoor.txt' (FN: e1f630b4; FD: f567a36b):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'php-include-w-shell.txt' (FN: 35a9b70f; FD: 9cd714fe):
 ---> Detected ClamAV-PHP.Exploit.E!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'phpjackal1.3.txt' (FN: 899b2773; FD: f930566b):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'phpshell.php' (FN: 9aa6e781):
 ---> Filetype blacklisted.
 --> Checking 'priv8-2012-bypass-shell.txt' (FN: c29ebe35; FD: 39e61d46):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-X.Backdoor.shell_exec!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-Exploit.Plesk-06!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking 'pws.txt' (FN: 7acaf669; FD: ec7d61f2):
 ---> No problems found.
 --> Checking 'r57-bd.txt' (FN: dee79bf0; FD: d5c304a8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-00!
 ---> Detected phpMussel-PHP.Shell.R57-01!
 ---> Detected phpMussel-PHP.Shell.R57-02!
 --> Checking 'r57.1.4.0.php' (FN: f5b37a1f):
 ---> Filetype blacklisted.
 --> Checking 'r57.mod-bizzz.shell.txt' (FN: 4ef32c86; FD: 2d055253):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'r57.php' (FN: 4810cc3a):
 ---> Filetype blacklisted.
 --> Checking 'r57.txt' (FN: 02b6b2ae; FD: 30430cdc):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'r57142.php' (FN: 59bbc25f):
 ---> Filetype blacklisted.
 --> Checking 'r57_Mohajer22.txt' (FN: bb338b3e; FD: 4b4151e9):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r57_iFX.txt' (FN: e99265c4; FD: 8618f9ea):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r57_kartal.txt' (FN: e3a7b626; FD: fafdf035):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'r57shell1.40.txt' (FN: b79d38cc; FD: 31f0ddbf):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected ClamAV-PUA.Script.Packed-10!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Packer-01!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-00!
 ---> Detected phpMussel-PHP.Shell.R57-01!
 ---> Detected phpMussel-PHP.Shell.R57-02!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 --> Checking 'r57shell2.0.txt' (FN: 9f88b39c; FD: c72fc99d):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 --> Checking 'redcod.php' (FN: 95104dcd):
 ---> Filetype blacklisted.
 --> Checking 'remview_fix.php' (FN: 104e93d8):
 ---> Filetype blacklisted.
 --> Checking 'rootshell.txt' (FN: 20551743; FD: 3bee5a6d):
 ---> No problems found.
 --> Checking 'ru24_post_sh.txt' (FN: 2f399246; FD: 4d1dc410):
 ---> No problems found.
 --> Checking 's72 Shell v1.1 Coding.php' (FN: 6ec1878b):
 ---> Filetype blacklisted.
 --> Checking 's72 Shell v1.1 Coding.txt' (FN: 2467f91f; FD: a4cd39ee):
 ---> No problems found.
 --> Checking 'safe0ver.txt' (FN: 0193a93f; FD: cf8cce65):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'shellzx.txt' (FN: d3514de7; FD: cfbef7a1):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected ClamAV-PUA.Script.Obfus!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.R57-06!
 --> Checking 'simattacker.txt' (FN: 4d750433; FD: 9941cb8f):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Iran-00!
 ---> Detected phpMussel-PHP.Shell.Iran-02!
 --> Checking 'simple-backdoor.txt' (FN: 1a2386d2; FD: a394f81f):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'simple_cmd.txt' (FN: 163804ae; FD: 5fecb588):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'small.txt' (FN: c96712b2; FD: 79fd88d7):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'sniper.txt' (FN: 3129147c; FD: 2681c53f):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 --> Checking 'soldierofallah.txt' (FN: 087b345e; FD: 64dc447f):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'sosyete.txt' (FN: edee25ba; FD: 90f1db01):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'spygrup.txt' (FN: 06713f4f; FD: e735536b):
 ---> No problems found.
 --> Checking 'sql.php' (FN: 356d712e):
 ---> Filetype blacklisted.
 --> Checking 'stres.txt' (FN: 391aef7a; FD: e537178d):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'ugdevil.v2.0.txt' (FN: 1dcf994c; FD: 993754d4):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Devil-04!
 ---> Detected phpMussel-PHP.Shell.Devil-05!
 ---> Detected phpMussel-PHP.Shell.Devil-06!
 ---> Detected phpMussel-PHP.Shell.Devil-00!
 ---> Detected phpMussel-PHP.Shell.Devil-01!
 ---> Detected phpMussel-PHP.Shell.Devil-03!
 --> Checking 'up.php' (FN: fac2fdd0):
 ---> Filetype blacklisted.
 --> Checking 'uploader.txt' (FN: 6a17733c; FD: 31109a6b):
 ---> No problems found.
 --> Checking 'wso.v2.5.txt' (FN: 8427bdac; FD: 69f40e06):
 ---> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'wso2.5.php' (FN: b55c7c95):
 ---> Filetype blacklisted.
 --> Checking 'wso2.php' (FN: d549fbf1):
 ---> Filetype blacklisted.
 --> Checking 'x0rg.byp4ss.txt' (FN: 0e69b3d9; FD: 1fb959d6):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-21!
 ---> Detected phpMussel-PHP.Shell.Indonesia-22!
 ---> Detected phpMussel-PHP.Shell.Indonesia-23!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-27!
 ---> Detected phpMussel-PHP.Shell.Indonesia-28!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-Exploit.Plesk-06!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Backdoor.SymLink-00!
 --> Checking 'zacosmall.txt' (FN: fa9cd59f; FD: 0e0a8caa):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 -> Checking 'PHP.7z' (FN: 0cc6e682; FD: a499f20f):
 --> No problems found.
 --> Checking 'Perl Web Shell by RST-GHC.pl' (FN: 7b955339):
 ---> Filetype blacklisted.
 --> Checking 'cgitelnet.txt' (FN: 897538d1; FD: 7e4edbb6):
 ---> No problems found.
 --> Checking 'cmd.pl' (FN: b3ac3090):
 ---> Filetype blacklisted.
 --> Checking 'dc.pl' (FN: daeb4112):
 ---> Filetype blacklisted.
 --> Checking 'list.pl' (FN: fd4635c6):
 ---> Filetype blacklisted.
 --> Checking 'up.pl' (FN: c5c70751):
 ---> Filetype blacklisted.
 -> Checking 'README.md' (FN: 099368d6; FD: 1f1b41d8):
 --> No problems found.
 -> Checking 'DOC_ZIBSZXBIEG.php' (FN: e3917c3f):
 --> Filetype blacklisted.
 -> Checking 'README.md' (FN: 099368d6; FD: a276a3cb):
 --> No problems found.
 -> Checking 'UnKnown Ú½ÿþ¦ºVipÚÿ¦ÕêáµöÂÞ¦¦þëê (1).asp' (FN: 50ce569e; FD: 88242178):
 --> No problems found.
 -> Checking 'UnKnown Ú½ÿþ¦ºVipÚÿ¦ÕêáµöÂÞ¦¦þëê.asp' (FN: 17c66350; FD: 1b7ba6e4):
 --> No problems found.
 -> Checking 'aspmuma.asp' (FN: af692fd6; FD: 191045cc):
 --> No problems found.
 -> Checking 'aspxþ ÅÕà©ÕñºÚ®¼.aspx' (FN: 441e8415; FD: 0205e935):
 --> No problems found.
 -> Checking 'aspÕ¦ÅÚ®¼.asp' (FN: c95a5905; FD: fb0886f2):
 --> No problems found.
 -> Checking 'µ£Çµû¦Þ çÕ«ëÕà¿þïù- ÕàìµØÇPHPÕñºÚ®¼ -.php' (FN: 24aa4918):
 --> Filetype blacklisted.
 -> Checking 'µ¦òÕàïÕâÁÕ¦©ÕñºÚ®¼ (1).asp' (FN: 4522fe1e; FD: dbe7fab4):
 --> PHP chameleon attack detected!
 -> Checking 'µ¦òÕàïÕâÁÕ¦©ÕñºÚ®¼.asp' (FN: 6bc98f20; FD: d41ae4f0):
 --> PHP chameleon attack detected!
 -> Checking 'µï þ½ÖÕ¦ÅÕè®µëï-þ ÅÕà©AspÕ¦ÅÚ®¼.asp' (FN: 0108c6c8; FD: 3d08f35c):
 --> No problems found.
 -> Checking 'µÿƒÕñûÞÖÜµïƒµ£¦µÅÉµØâõ©ôþö¿aspÕñºÚ®¼ (1).asp' (FN: 43d0d8b9; FD: e439e86f):
 --> PHP chameleon attack detected!
 -> Checking 'µÿƒÕñûÞÖÜµïƒµ£¦µÅÉµØâõ©ôþö¿aspÕñºÚ®¼ (1)_ÚçìÕæ¢ÕÉì_2014-10-23-14-54-16.asp' (FN: 98adc7a0; FD: 809b8c9d):
 --> PHP chameleon attack detected!
 -> Checking 'µÿƒÕñûÞÖÜµïƒµ£¦µÅÉµØâõ©ôþö¿aspÕñºÚ®¼.asp' (FN: 36e2fbce; FD: e2ce4257):
 --> PHP chameleon attack detected!
 -> Checking 'ÒÇÉµë¦ÚçÅõ©ïÞ¢¢ÒÇæÚôÂµ¦¦Þê¦ÚÿƒÕñºÚ®¼_2014þëêþ¡ë.zip' (FN: 3a3f8c6e; FD: 4fa7b02e):
 --> Detected phpMussel-PHP.Exploit.eval-0!
 --> Detected phpMussel-PHP.Exploit.eval-1!
 --> Detected phpMussel-PHP.Packer-00!
 --> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Detected phpMussel-PHP.Shell.Commondos-01!
 --> Detected phpMussel-PHP.Shell.Indonesia-16!
 --> Detected phpMussel-PHP.Shell.Indonesia-17!
 --> Detected phpMussel-PHP.Shell.Indonesia-18!
 --> Detected phpMussel-PHP.Shell.Indonesia-30!
 --> Detected phpMussel-PHP.Shell.Indonesia-31!
 --> Detected phpMussel-PHP.Shell.Indonesia-32!
 --> Detected phpMussel-PHP.Shell.Iran-02!
 --> Detected phpMussel-PHP.Shell.PacketStorm-00!
 --> Detected phpMussel-PHP.Shell.PacketStorm-02!
 --> Detected phpMussel-PHP.Shell.Indonesia-19!
 --> Detected phpMussel-PHP.Shell.Indonesia-20!
 --> Detected phpMussel-PHP.Obfuscation.X-03!
 -> Checking 'Õ£ƒÕÅ©µÉ×Õƒ¦aspÕñºÚ®¼ (1).asp' (FN: 67f99caf; FD: 43acfb6f):
 --> PHP chameleon attack detected!
 -> Checking 'Õ£ƒÕÅ©µÉ×Õƒ¦aspÕñºÚ®¼ (1)_ÚçìÕæ¢ÕÉì_2014-10-23-14-54-16.asp' (FN: a7d1662e; FD: 12fff9e9):
 --> PHP chameleon attack detected!
 -> Checking 'Õ£ƒÕÅ©µÉ×Õƒ¦aspÕñºÚ®¼.asp' (FN: c5fa5608; FD: f4153830):
 --> PHP chameleon attack detected!
 -> Checking 'ÕàìµØÇphpÕñºÚ®¼.php' (FN: 4f800a69):
 --> Filetype blacklisted.
 -> Checking 'Õø¢ÕñûÕàìµØÇPHPÕñºÚ®¼_µ£¬þ  Þ»æ.php' (FN: 04e21f13):
 --> Filetype blacklisted.
 -> Checking 'Õø¢ÕñûÕàìµØÇphpÕñºÚ®¼.php' (FN: c46bfe72):
 --> Filetype blacklisted.
 -> Checking 'ÚØ×Õ©©þëøÚÇ þÜäJspÕñºÚ®¼.jsp' (FN: f2e07820; FD: e11cf774):
 --> No problems found.
 -> Checking 'ÚôÂµ¦¦Þê¦ÚÿƒÕñºÚ®¼_2012þëê.asp' (FN: 47e5387b; FD: 48cb37a6):
 --> No problems found.
 -> Checking 'ÚôÂµ¦¦Þê¦ÚÿƒÕñºÚ®¼_2014þëê.asp' (FN: 818a31fc; FD: 5d121749):
 --> No problems found.
 -> Checking 'õ áÞ»¦õ©¡þÜäÞìëµ¦ÑÚ®¼4.0 (1).asp' (FN: 6297ffcb; FD: bfdc4901):
 --> No problems found.
 -> Checking 'õ áÞ»¦õ©¡þÜäÞìëµ¦ÑÚ®¼4.0.asp' (FN: dcb7f58b; FD: 2ed44a4f):
 --> No problems found.
 -> Checking 'õ©ìþü¡õ¦ïÚ¡é2013µö¦Þ øþëêµ£¼.asp' (FN: 8fe23b89; FD: 2a0a91ce):
 --> No problems found.
 -> Checking 'õ©ìþü¡õ¦ïÚ¡é2014µö¦Þ øþëêµ£¼.asp' (FN: af7047c2; FD: 10f4aba9):
 --> No problems found.
 -> Checking 'þëøÚÇ ÕàìµØÇµÅÉµØâÚÜÉÞùÅÕñºÚ®¼ (1).asp' (FN: 088b7ea5; FD: c9cadc88):
 --> PHP chameleon attack detected!
 -> Checking 'þëøÚÇ ÕàìµØÇµÅÉµØâÚÜÉÞùÅÕñºÚ®¼ (1)_ÚçìÕæ¢ÕÉì_2014-10-23-14-54-16.asp' (FN: 21b3f1fc; FD: 21d0682d):
 --> PHP chameleon attack detected!
 -> Checking 'þëøÚÇ ÕàìµØÇµÅÉµØâÚÜÉÞùÅÕñºÚ®¼.asp' (FN: 907d18ad; FD: 05bee80a):
 --> PHP chameleon attack detected!
 -> Checking 'þü½þïÉNEW WebShell (1).asp' (FN: 58e1dc22; FD: c8f08e7a):
 --> PHP chameleon attack detected!
 -> Checking 'þü½þïÉNEW WebShell (1)_ÚçìÕæ¢ÕÉì_2014-10-23-14-54-16.asp' (FN: f14c9189; FD: 122da921):
 --> PHP chameleon attack detected!
 -> Checking 'þü½þïÉNEW WebShell.asp' (FN: d7b08f5c; FD: 20b705dc):
 --> PHP chameleon attack detected!
 --> Checking 'Ajan.asp.txt' (FN: de2e30fb; FD: b9336af6):
 ---> No problems found.
 --> Checking 'CMD.asp.txt' (FN: dad5e6d6; FD: e9206ce3):
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'CmdAsp.asp.txt' (FN: 62318b14; FD: 18531dd8):
 ---> Detected phpMussel-FN.Generic-04.B!
 ---> Detected ClamAV-ASP.Ace.C!
 --> Checking 'CyberSpy5.Asp.txt' (FN: ff029060; FD: cfe97edf):
 ---> No problems found.
 --> Checking 'EFSO_2.asp.txt' (FN: 598608a6; FD: 64e33942):
 ---> No problems found.
 --> Checking 'Elmali Seker.asp.txt' (FN: 95970d41; FD: fe8f7a0f):
 ---> No problems found.
 --> Checking 'NT Addy.asp.txt' (FN: a48756f2; FD: 6cc36e46):
 ---> No problems found.
 --> Checking 'Rader.asp.txt' (FN: ca01d3cd; FD: 8c480e8f):
 ---> No problems found.
 --> Checking 'Reader.asp.txt' (FN: a8a108cf; FD: 8c480e8f):
 ---> No problems found.
 --> Checking 'RemExp.asp.txt' (FN: 161f3787; FD: 50042a42):
 ---> No problems found.
 --> Checking 'Server Variables.asp.txt' (FN: 23e7b5c7; FD: 83b9fcfd):
 ---> No problems found.
 --> Checking 'Tool.asp.txt' (FN: 0bfd1e60; FD: f6e27b0c):
 ---> Detected ClamAV-ASP.Ace.C!
 ---> Detected phpMussel-VBS.Shell.Pouya-01!
 --> Checking 'Zehir 4.asp.txt' (FN: 5b3cabde; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'aspydrv.asp.txt' (FN: 3ec5301c; FD: 47866494):
 ---> No problems found.
 --> Checking 'cmd-asp-5.1.asp.txt' (FN: 6eaac3c0; FD: de470ec3):
 ---> Detected phpMussel-FN.Generic-04.B!
 --> Checking 'elmaliseker.asp.txt' (FN: 9c6dd351; FD: fe8f7a0f):
 ---> No problems found.
 --> Checking 'indexer.asp.txt' (FN: 61da410c; FD: 26874d43):
 ---> No problems found.
 --> Checking 'kacak.asp.txt' (FN: 6a5e75d9; FD: 429ad574):
 ---> Detected phpMussel-HTML.Defacement.Turkey-10!
 ---> Detected phpMussel-HTML.Defacement.Turkey-11!
 ---> Detected phpMussel-HTML.Defacement.Turkey-12!
 ---> Detected phpMussel-HTML.Defacement.Turkey-13!
 --> Checking 'klasvayv.asp.txt' (FN: 5b0cf053; FD: c9f88ec8):
 ---> Detected phpMussel-HTML.Defacement.Turkey-10!
 ---> Detected phpMussel-HTML.Defacement.Turkey-11!
 ---> Detected phpMussel-HTML.Defacement.Turkey-12!
 ---> Detected phpMussel-HTML.Defacement.Turkey-13!
 --> Checking 'ntdaddy.asp.txt' (FN: 84233071; FD: 6cc36e46):
 ---> No problems found.
 --> Checking 'zehir4.asp.txt' (FN: 685bf9ab; FD: 5f41974d):
 ---> Detected phpMussel-VBS.Shell.Zehir-00!
 ---> Detected phpMussel-VBS.Shell.Zehir-01!
 ---> Detected phpMussel-VBS.Shell.Zehir-02!
 ---> Detected phpMussel-VBS.Shell.Zehir-03!
 --> Checking 'WebShell.cgi.txt' (FN: 7bea744d; FD: fbb4f46d):
 ---> No problems found.
 --> Checking 'go-shell.cgi.txt' (FN: 49ae444a; FD: 6ddfe34b):
 ---> No problems found.
 --> Checking 'lurm_safemod_on.cgi.txt' (FN: 4399008b; FD: fd73ea58):
 ---> No problems found.
 --> Checking 'telnet.cgi.txt' (FN: f035bf16; FD: 4143775e):
 ---> No problems found.
 --> Checking 'Java Shell.js.txt' (FN: 378d21bb; FD: 66b88133):
 ---> No problems found.
 --> Checking 'JspWebshell 1.2.jsp.txt' (FN: 6952af5e; FD: 6100a46c):
 ---> No problems found.
 --> Checking 'cmdjsp.jsp.txt' (FN: 08efafa5; FD: df3a5fdc):
 ---> Detected phpMussel-FN.Generic-04.B!
 --> Checking 'jsp-reverse.jsp.txt' (FN: 20fb7715; FD: 74c163ed):
 ---> Detected phpMussel-FN.Generic-19!
 --> Checking 'jspshall.jsp.txt' (FN: 01740851; FD: d9947380):
 ---> No problems found.
 --> Checking 'Asmodeus v0.1.pl.txt' (FN: de16f39c; FD: e269a6f4):
 ---> No problems found.
 --> Checking 'connectback2.pl.txt' (FN: cee8ee8d; FD: 699bd48b):
 ---> No problems found.
 --> Checking 'perlbot.pl.txt' (FN: af9c361f; FD: 8ac9c460):
 ---> Detected ClamAV-Perl.Shellbot-1!
 --> Checking 'shellbot.pl.txt' (FN: 0e17e052; FD: f00055ed):
 ---> Detected ClamAV-Perl.Shellbot-1!
 --> Checking 'telnet.pl.txt' (FN: 053fab23; FD: ce00a360):
 ---> No problems found.
 --> Checking 'telnetd.pl.txt' (FN: bb87c8d9; FD: 77e027e0):
 ---> No problems found.
 --> Checking '1.txt' (FN: f9f83871; FD: 5154a565):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-09!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-23!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking '2008.php.php.txt' (FN: 23c3be5b; FD: 3fea33ea):
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.ShellExec!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-00!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Angel-03!
 ---> Detected phpMussel-PHP.Shell.Angel-04!
 --> Checking 'Ajax_PHP Command Shell.php.txt' (FN: 442e79c2; FD: 27d29060):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Antichat Shell v1.3.php.txt' (FN: 653f5a71; FD: 27153bfa):
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Antichat Socks5 Server.php.php.txt' (FN: abfbf945; FD: 6a6909bb):
 ---> No problems found.
 --> Checking 'Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt' (FN: 3d777c1f; FD: bbad76ec):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 --> Checking 'Casus15.php.php.txt' (FN: 16bb2325; FD: 7cc3c849):
 ---> No problems found.
 --> Checking 'Crystal.php.txt' (FN: 1d12ef01; FD: bbfac551):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'DTool Pro.php.txt' (FN: 0cec6780; FD: 5807c6ad):
 ---> Detected ClamAV-PHP.Defash.A!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Dive Shell 1.0 - Emperor Hacking Team.php.txt' (FN: 2ae00e64; FD: 040bb035):
 ---> No problems found.
 --> Checking 'Dx.php.php.txt' (FN: ea92e06d; FD: 06f51a98):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'DxShell.php.php.txt' (FN: 339d6f44; FD: 5579b1f3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'Fatalshell.php.php.txt' (FN: 97797710; FD: 48944c22):
 ---> Detected ClamAV-PHP.ShellExec!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'GFS web-shell ver 3.1.7 - PRiV8.php.txt' (FN: 8e1a63ea; FD: 811667b1):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'KA_uShell.php.php.txt' (FN: 181d5159; FD: 2b930d27):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'KAdot Universal Shell v0.1.6.html.txt' (FN: d2c42a94; FD: 2b930d27):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'LOTFREE.php.php.txt' (FN: bfa7055e; FD: 915f4ea2):
 ---> No problems found.
 --> Checking 'Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt' (FN: 53ddb2e1; FD: c97bb4ce):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Moroccan Spamers Ma-EditioN By GhOsT.php.txt' (FN: 175abcfe; FD: 2e03197c):
 ---> No problems found.
 --> Checking 'MySQL Web Interface Version 0.8.php.txt' (FN: 2f0fff56; FD: 8711b37a):
 ---> No problems found.
 --> Checking 'Mysql interface v1.0.php.txt' (FN: 83bd8536; FD: c919cdea):
 ---> No problems found.
 --> Checking 'NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php.txt' (FN: 7d4e1d1b; FD: 345a14bc):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'NetworkFileManagerPHP.php.txt' (FN: 7cc53767; FD: cb317ab1):
 ---> No problems found.
 --> Checking 'Nshell (1).php.php.txt' (FN: d19a8abf; FD: a507e652):
 ---> No problems found.
 --> Checking 'PH Vayv.php.php.txt' (FN: bad36ca5; FD: be834afa):
 ---> No problems found.
 --> Checking 'PHANTASMA.php.txt' (FN: b8c97381; FD: b74ceafc):
 ---> Detected ClamAV-PHP.Exploit.E!
 --> Checking 'PHP Backdoor Connect.pl.php.txt' (FN: adab9c15; FD: fcbcd429):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'PHP Shell.php.php.txt' (FN: c6e2fe85; FD: eae134b1):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'PHPRemoteView.php.txt' (FN: 3dd27e4e; FD: fdb8ddb3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Private-i3lue.php.txt' (FN: 75142151; FD: 4405c3df):
 ---> No problems found.
 --> Checking 'Rem View.php.php.txt' (FN: 9c56e2c8; FD: fdb8ddb3):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Russian.php.php.txt' (FN: 4ea4db9b; FD: fc06a1c8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'STNC.php.php.txt' (FN: 0061a72f; FD: c5100238):
 ---> Detected ClamAV-PHP.Shell-5!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt' (FN: c625a170; FD: ee7c2c88):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt' (FN: 3e9a3dd8; FD: 46cf0591):
 ---> No problems found.
 --> Checking 'SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt' (FN: d10e4c23; FD: 2dfa4daa):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Iran-00!
 ---> Detected phpMussel-PHP.Shell.Iran-02!
 --> Checking 'SimShell 1.0 - Simorgh Security MGZ.php.txt' (FN: f1e65030; FD: 336fdc06):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'Sincap.php.php.txt' (FN: 698de540; FD: 325eb4b2):
 ---> No problems found.
 --> Checking 'SnIpEr_SA Shell.php.txt' (FN: 10a058ee; FD: 317148b0):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'SpecialShell_99.php.php.txt' (FN: 43d86145; FD: ffd935d2):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'SsEs.php.php.txt' (FN: 5be44069; FD: c9251a52):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-1!
 ---> Detected phpMussel-PHP.Packer-00!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-17!
 ---> Detected phpMussel-PHP.Shell.Indonesia-18!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'Test.php.php.txt' (FN: eee2fafb; FD: 0feeb9d1):
 ---> Detected phpMussel-Defacement.X-000!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 --> Checking 'WinX Shell.html.txt' (FN: e4ad516f; FD: 983f014b):
 ---> No problems found.
 --> Checking 'Worse Linux Shell.php.txt' (FN: 67f415bf; FD: a8955655):
 ---> Detected ClamAV-PHP.Remoteadmin-2!
 --> Checking 'aZRaiLPhp v1.0.php.txt' (FN: 0858e0d5; FD: c3f185f2):
 ---> No problems found.
 --> Checking 'a_gedit.php.php.txt' (FN: 0717289d; FD: 7a4957af):
 ---> Detected ClamAV-PHP.ShellExec!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'accept_language.php.txt' (FN: 58111168; FD: c2f3a402):
 ---> No problems found.
 --> Checking 'ak74shell.php.php.txt' (FN: 1a5bff7d; FD: f1ec20f5):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'antichat.php.php.txt' (FN: 1fbeca14; FD: 9a1f00f1):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'backdoor1.php.txt' (FN: 4b9582aa; FD: a878f328):
 ---> Detected phpMussel-FN.PHP.X-02!
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'backdoorfr.php.txt' (FN: 01a83120; FD: c2223ed1):
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'backup.php.php.txt' (FN: aaf7c5be; FD: 12cbb53d):
 ---> No problems found.
 --> Checking 'backupsql.php.php.txt' (FN: 66f39e23; FD: 72ae47d6):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'c100.php.txt' (FN: 35453d4c; FD: 03b87cf3):
 ---> Detected phpMussel-FN.PHP.X-01!
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-Defacement.X-001!
 ---> Detected phpMussel-PHP.Defacement.X-003!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-01!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-08!
 ---> Detected phpMussel-PHP.Shell.Indonesia-11!
 ---> Detected phpMussel-PHP.Shell.Indonesia-12!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-HTML.Defacement.X-003!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c2007.php.php.txt' (FN: 0198dd0c; FD: 34700caf):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-16!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Obfuscation.X-03!
 --> Checking 'c99madshell_v2.0.php.php.txt' (FN: 215e2a2a; FD: 4687a6bf):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'c99madshell_v2.1.php.php.txt' (FN: fcc8f3af; FD: c0f84c17):
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 --> Checking 'c99php.txt' (FN: 93cc0a53; FD: 1307c9fa):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'c99shell_v1.0.php.php.txt' (FN: 8ae65b1e; FD: 74c49251):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'crystal.txt' (FN: 0a041b5c; FD: bbfac551):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'csh.php.php.txt' (FN: c5a5fd79; FD: a872835a):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'ctt_sh.php.php.txt' (FN: ed993af6; FD: d2e72264):
 ---> Detected ClamAV-PHP.C99-2!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Indonesia-32!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 --> Checking 'cyberlords_sql.php.php.txt' (FN: 7599794a; FD: 6ea9c505):
 ---> No problems found.
 --> Checking 'cybershell.php.php.txt' (FN: 807a7c0a; FD: 5e34a23b):
 ---> No problems found.
 --> Checking 'dC3 Security Crew Shell PRiV.php.txt' (FN: 355e774c; FD: 22c48899):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 --> Checking 'framer.zip' (FN: 319cc30d; FD: 75f5020f):
 ---> Detected phpMussel-PHP.Backdoor.ZeroZero-01!
 --> Checking 'fuckphpshell.php.txt' (FN: 563f30b2; FD: 0a53a7bb):
 ---> Detected phpMussel-FN.Shell.Generic-1!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'gfs_sh.php.php.txt' (FN: d8a51c3f; FD: 2ef8c7eb):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'h4ntu shell [powered by tsoi].txt' (FN: be6deb7f; FD: a0672c2b):
 ---> No problems found.
 --> Checking 'hidshell.php.php.txt' (FN: 59c9eaca; FD: 931383d2):
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 --> Checking 'iMHaPFtp.php.php.txt' (FN: 1175d1ca; FD: 60090f0e):
 ---> No problems found.
 --> Checking 'img.php.php.txt' (FN: 28f33cb6; FD: 0adfbd2a):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 ---> Detected phpMussel-Graphics.Code.Embed-002.3!
 ---> Detected phpMussel-Graphics.Code.Embed-005.2!
 ---> Detected phpMussel-Graphics.Code.Embed-005.3!
 ---> Detected phpMussel-Graphics.Code.Embed-006.3!
 ---> Detected phpMussel-Graphics.Code.Embed-013.4!
 ---> Detected phpMussel-Graphics.Code.Embed-014!
 ---> Detected phpMussel-Graphics.Code.Embed-015.4!
 ---> Detected phpMussel-Graphics.Code.Embed-017!
 ---> Detected phpMussel-Graphics.Code.Embed-019!
 ---> Detected phpMussel-Graphics.Code.Embed-021!
 ---> Detected phpMussel-Graphics.Code.Embed-022!
 ---> Detected phpMussel-Graphics.Code.Embed-028!
 ---> Detected phpMussel-Graphics.HTML.Embed-02!
 ---> Detected phpMussel-Graphics.HTML.Embed-07!
 ---> Detected phpMussel-Graphics.HTML.Embed-08!
 ---> Detected phpMussel-Graphics.HTML.Embed-11!
 ---> Detected phpMussel-Graphics.JS.Event-11!
 ---> Detected phpMussel-Graphics.PHP.Embed-03!
 ---> Detected phpMussel-Graphics.PHP.Embed-04!
 ---> Detected phpMussel-Graphics.PHP.Embed-05!
 ---> Detected phpMussel-Graphics.PHP.Embed-07!
 ---> Detected phpMussel-Graphics.PHP.Embed-08!
 ---> Detected phpMussel-Chameleon.Graphics.Shell.Webshell-01!
 ---> Detected phpMussel-Graphics.Defacement.Generic-000!
 --> Checking 'ironshell.php.txt' (FN: 159fdda6; FD: af75d42e):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'lamashell.php.txt' (FN: d0ccbe21; FD: 6fd82037):
 ---> No problems found.
 --> Checking 'load_shell.php.php.txt' (FN: 379fc929; FD: 0d8fa330):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'mailer3.php.php.txt' (FN: 41c67389; FD: 2e03197c):
 ---> No problems found.
 --> Checking 'matamu.php.txt' (FN: afb8ecaa; FD: 000e017d):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'myshell.php.php.txt' (FN: 0aab0096; FD: 0233d94d):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql.php.php.txt' (FN: dd6a778c; FD: e4cf57ac):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'mysql_shell.php.txt' (FN: 40a55ebf; FD: a57d9517):
 ---> No problems found.
 --> Checking 'mysql_tool.php.php.txt' (FN: e21d07a0; FD: 77491489):
 ---> No problems found.
 --> Checking 'network.php.php.txt' (FN: 64ad9460; FD: cb317ab1):
 ---> No problems found.
 --> Checking 'nfm.php.php.txt' (FN: c6956e67; FD: 460f8fd6):
 ---> No problems found.
 --> Checking 'ngh.php.php.txt' (FN: 46b53c02; FD: a48a2144):
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'nixrem.php.php.txt' (FN: 4b6b94e1; FD: ecfd7a55):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'nshell.php.php.txt' (FN: 24925acb; FD: 0593b6ba):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'nst.php.php.txt' (FN: 17169054; FD: a46cc43c):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'nstview.php.php.txt' (FN: e522b813; FD: 990eb15d):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'pHpINJ.php.php.txt' (FN: f8f1b531; FD: 763ed0ca):
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'php-backdoor.php.txt' (FN: a356a986; FD: f567a36b):
 ---> Detected phpMussel-FN.PHP.X-02!
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'php-include-w-shell.php.txt' (FN: 31c23a4e; FD: 9cd714fe):
 ---> Detected ClamAV-PHP.Exploit.E!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'phpbackdoor15.php.txt' (FN: 24503545; FD: 915f4ea2):
 ---> Detected phpMussel-FN.PHP.X-02!
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'phpjackal.php.txt' (FN: 7aeb8054; FD: 78042f09):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'phpshell17.php.txt' (FN: 5b144a8d; FD: 20b0adf9):
 ---> Detected phpMussel-FN.Shell.Generic-1!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'phvayv.php.php.txt' (FN: 9157a696; FD: 325eb4b2):
 ---> No problems found.
 --> Checking 'phvayvv.php.php.txt' (FN: fdacb3a8; FD: be834afa):
 ---> No problems found.
 --> Checking 'predator.php.php.txt' (FN: 5792a164; FD: 43bc83d7):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'pws.php.php.txt' (FN: dad89e2d; FD: ec7d61f2):
 ---> No problems found.
 --> Checking 'r57 Shell.php.php.txt' (FN: edcf96c2; FD: 4218ba71):
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r57.php.php.txt' (FN: afbde7dd; FD: d969ae9c):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.R57-04!
 --> Checking 'r577.php.php.txt' (FN: 7c8789df; FD: 2d055253):
 ---> Detected phpMussel-FN.Backdoor.ErrorHandler!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'r57shell.php.php.txt' (FN: 2e31d78e; FD: bf648652):
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'rootshell.php.txt' (FN: ecaccaf1; FD: 73c2f1d1):
 ---> No problems found.
 --> Checking 'rst_sql.php.php.txt' (FN: d350ae8a; FD: f7f511cf):
 ---> No problems found.
 --> Checking 'ru24_post_sh.php.php.txt' (FN: e682ad2d; FD: 4d1dc410):
 ---> No problems found.
 --> Checking 's.php.php.txt' (FN: 8b811861; FD: 867c7471):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 's72 Shell v1.1 Coding.html.txt' (FN: 54b84b35; FD: a4cd39ee):
 ---> No problems found.
 --> Checking 's72_shell.txt' (FN: c3238a30; FD: a4cd39ee):
 ---> No problems found.
 --> Checking 'sh.php.php.txt' (FN: 908ea8c3; FD: 328625a0):
 ---> No problems found.
 --> Checking 'shankar.php.php.txt' (FN: c8f165e9; FD: f1e2eb3f):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'shell.php.php.txt' (FN: 7480bee2; FD: 000e017d):
 ---> Detected ClamAV-PHP.Defash.B!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 --> Checking 'simple-backdoor.php.txt' (FN: aae89935; FD: a394f81f):
 ---> Detected phpMussel-FN.PHP.X-02!
 ---> Detected phpMussel-FN.Backdoor.Generic-0!
 --> Checking 'simple_cmd.html.txt' (FN: 87839917; FD: 5fecb588):
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 --> Checking 'small.php.php.txt' (FN: 84a50697; FD: 215986ad):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected phpMussel-PHP.Exploit.eval-3!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 --> Checking 'sniper_sa_shell.txt' (FN: 7f51d175; FD: 317148b0):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 ---> Detected phpMussel-PHP.Shell.Gaza-00!
 --> Checking 'spy.php.php.txt' (FN: 943738b2; FD: ff0b5c68):
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Angel-01!
 --> Checking 'sql.php.php.txt' (FN: a010cc0d; FD: 3d4be507):
 ---> No problems found.
 --> Checking 'uploader.php.php.txt' (FN: d3703ea9; FD: e886aed9):
 ---> No problems found.
 --> Checking 'w.php.php.txt' (FN: 4b3872f7; FD: 2346e516):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Backdoor.PHPShell!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-00!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 --> Checking 'w3d.php.php.txt' (FN: d0b8495f; FD: 1d20399e):
 ---> No problems found.
 --> Checking 'w4k.php.php.txt' (FN: 920536aa; FD: d5939c65):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'wacking.php.php.txt' (FN: 20c52d99; FD: d5939c65):
 ---> Detected ClamAV-PHP.C99-5!
 ---> Detected ClamAV-PHP.Shell!
 ---> Detected ClamAV-PHP.Shell-41!
 ---> Detected ClamAV-PHP.Shell-23!
 ---> Detected ClamAV-PHP.Trojan.C99Shell!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.C100-01!
 ---> Detected phpMussel-PHP.Shell.C99-02!
 ---> Detected phpMussel-PHP.Shell.Commondos-03!
 ---> Detected phpMussel-PHP.Shell.Indonesia-06!
 ---> Detected phpMussel-PHP.Shell.Indonesia-13!
 ---> Detected phpMussel-PHP.Shell.Indonesia-24!
 ---> Detected phpMussel-PHP.Shell.Indonesia-25!
 ---> Detected phpMussel-PHP.Shell.Indonesia-29!
 ---> Detected phpMussel-PHP.Shell.Indonesia-30!
 ---> Detected phpMussel-PHP.Shell.Indonesia-31!
 ---> Detected phpMussel-PHP.Shell.PacketStorm-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-00!
 ---> Detected phpMussel-PHP.Shell.Commondos-02!
 ---> Detected phpMussel-PHP.Shell.Indonesia-19!
 ---> Detected phpMussel-PHP.Shell.Indonesia-20!
 ---> Detected phpMussel-PHP.Backdoor.SSH-00!
 --> Checking 'webadmin.php.php.txt' (FN: 641c50ff; FD: 155637fb):
 ---> No problems found.
 --> Checking 'webshell.php.txt' (FN: 153b85b0; FD: 3f5d1006):
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'wso.txt' (FN: 81ecf072; FD: 132a0d6b):
 ---> Detected phpMussel-PHP.Backdoor.FilesMan-00!
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.shell_exec!
 ---> Detected phpMussel-PHP.Shell.Webshell-02!
 ---> Detected phpMussel-PHP.Shell.Webshell-03!
 --> Checking 'xinfo.php.php.txt' (FN: de6b2bc2; FD: 5d17e8b0):
 ---> No problems found.
 --> Checking 'zacosmall.php.txt' (FN: 6e3bd933; FD: 70897ec8):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 --> Checking 'Phyton Shell.py.txt' (FN: f0d5be16; FD: b028dfd5):
 ---> No problems found.
 --> Checking 'cgi-python.py.txt' (FN: 69641fc6; FD: 13c9d954):
 ---> No problems found.
 --> Checking 'smtpd.py.txt' (FN: 2b1895c6; FD: 5ea99f7c):
 ---> No problems found.
 --> Checking 'wh_bindshell.py.txt' (FN: e7b165f6; FD: ce8dbcd4):
 ---> No problems found.
 -> Checking 'README.md' (FN: 099368d6; FD: 51a8caf8):
 --> No problems found.
 --> Checking 'mod_joomla_shell.PNG' (FN: f8e3066f; FD: af68b579):
 ---> No problems found.
 --> Checking 'mod_joomla_shell.zip' (FN: af41d233; FD: 72a0afca):
 ---> No problems found.
 ---> Reading 'mod_joomla_shell.zip' (ZIP):
 ----> Success! Proceeding to check contents.
 ----> Checking 'mod_joomla_shell.zip' > 'mod_system.php' (FN: a82dd3ce; FD: 0899f4ed):
 ---> Detected phpMussel-PHP.Exploit.eval-0!
 ---> Detected phpMussel-PHP.Exploit.eval-2!
 ---> Detected ClamAV-PUA.HTML.Crypt-8!
 ---> Detected ClamAV-PUA.Trojan.PHP!
 ---> Detected phpMussel-PHP.Packer-01!
 ----> Checking 'mod_joomla_shell.zip' > 'mod_system.xml' (FN: cf482a7c; FD: a74d8b5e):
 -----> No problems found.
 ---> Checking 'DefaceKeeper_0.2.php.txt' (FN: b74c86c6; FD: b1e9839a):
 ----> Detected phpMussel-PHP.Exploit.eval-0!
 ----> Detected phpMussel-PHP.Exploit.eval-1!
 ----> Detected phpMussel-PHP.Packer-00!
 Wed, 29 Jul 2015 23:20:24 +0800 Finished.

simple deployment for testing environment

This issue is created as a reminder for me to create a script to automatically deploy the latest version of phpMussel from the repository.

This might be the first or an useful addition for a future installer.

For reference: #14 (comment)

suggestion: VirusTotal scan

if the uploaded file is not recognized by any ClamAV signature and a special constant in the settings of phpMussel is set, we could use the MD5 / Sha1 / SHA256 hash of the file and fetch some results from the VirusTotal API if there are any

https://www.virustotal.com/de/documentation/public-api/#getting-file-scans
http://stackoverflow.com/questions/5572043/php-hash-contents-of-uploaded-file

If this idea is a useful suggestion and addition, I would prepare this and test it.

Wish list: Certificate parsing.

ClamAV is able to read and parse the certificates of PE files and then check those certificates against its database to help ascertain whether or not a particular PE file should be trusted.

phpMussel hasn't yet been coded to do this, and thus, at this time, can't make use of that part of the ClamAV signatures database.

Not a high priority, but, something that nonetheless would be cool to amend.

add setting to block files which use steganography

copy /b image.ext + payload.ext image_payload.ext
cat image.ext payload.ext > image_payload.ext

decode_threshold=0 helps sometimes to detect appended files.

But we should add some setting to generally block files which have other files appended.
Because someone could append a (password protected) zip file to an image and extract this on the server.

Not all steganography methods can be (easily) detected, but some (like Stegdetect does) like appendx can be detected (and maybe added to the chameleon detection).

http://www.outguess.org/detection.php

I am currently evaluating what can be detected and solved. For example when we recreate/copy images using PHP (gdlib or imagemagick) it should remove (most) steganogryphic content.

We may also have to detect appended archive files (like it is used by sfx).
http://www.strchr.com/creating_self-extracting_executables
https://en.wikipedia.org/wiki/Template:Archive_formats

I can help you translate Simplified Chinese Documents

I see from the www.oschina.net you want to translate your documents into simplified Chinese, I think I can help you get the job done.

PHP7 Compatibility

In reference to this: https://github.com/php/php-src/blob/php-7.0.0alpha2/UPGRADING

Having read through that document, I can't see any potential problems for phpMussel (I don't think it's relying on anything that's been changed, depreciated, etc), but also, I haven't tested phpMussel on PHP7 to confirm whether there'll be any problems or not.

At some point, when there's time, phpMussel should be tested on PHP7 to confirm whether any changes will be required in order for it to be compatible.

suggestion: alternative setup

We can also use php.ini, user.ini or .htaccess with the auto_prepend_file directive of Apache

php_value auto_prepend_file absolute/path/to/phpmussel.php

I've tested it and it works without any problems. This could be added to the readme.

why message-> [phpMussel] Required variables aren't defined: Can't continue

composer.json and Packagist

I think it makes sense to create a simple composer.json file and publish the package on https://packagist.org/

{
    "name": "Maikuolan/phpMussel",
    "description": "PHP-based anti-virus anti-trojan anti-malware solution.",
    "require": {
        "php": ">=5.3.0"
    }
}

I am not sure on the required PHP version.

See here for more details on the required PHP versions: #8

RTL text in markdown.

I have someone working on the Arabic translations for phpMussel (both the documentation and the language data), and they're about halfway through finishing it all.

They're sending their work to me as they complete it as Microsoft Word files, and everything looks mostly okay in the Microsoft Word files.

However, trying to then translate this work into markdown format, so that I can upload it to the GitHub repository, is proving to be rather difficult (for me, at least).

I mostly edit markdown files using Notepad++, and after some tinkering (note that this is the first time I've ever needed to work with right-to-left text in Notepad++), I've discovered that I can change the document text direction by using Ctrl+Alt+R (for right-to-left) and Ctrl+Alt+L (for left-to-right). Yay!

This saves me from a lot of trouble, because the behaviour of RTL and LTR characters in Notepad++ seems very inconsistent to me (I read about how to use these characters from the Unicode website, so, I'm hoping this information in correct, but maybe I'm doing something wrong, something that Notepad++ doesn't like; anyhow, because I can just use Ctrl+Alt+R, this doesn't really matter).

So far, so good.

But then I try to preview my markdown using the GitHub in-built file editor:

Everything becomes messed up, and looks similar to how it looks in Notepad++ when using the incorrect document text direction.

I'm not sure how to fix this, and I'm seeking advice.

Is there not any way using markdown code to identify text direction or overall document text direction? I tried Googling for help, briefly looked on Stack Exchange, and I looked at the mastering markdown page here on GitHub, but I couldn't work it out.

inconsistent return values for phpMussel()

Shouldn't this output the same like the code below?

echo phpMussel("_testfiles/ascii_standard_testfile.txt",2);
Sun, 12 Jul 2015 17:25:49 +0200 Started. > Checking '_testfiles/ascii_standard_testfile.txt' (FN: b492df2f; FD: c4f668fa): -> No problems found. Sun, 12 Jul 2015 17:25:49 +0200 Finished.

echo phpMussel("_testfiles/ascii_standard_testfile.txt",1);
Sun, 12 Jul 2015 17:26:46 +0200 Started. > Checking '_testfiles/ascii_standard_testfile.txt' (FN: b492df2f; FD: c4f668fa): -> Detected phpMussel-FN.Illegal.Character-2F! -> Detected phpMussel-Testfile.ASCII.Standard! Sun, 12 Jul 2015 17:26:46 +0200 Finished.

stop scan when high load (DoS)

We can check the current load on Linux and others using sys_getloadavg(). Windows is much more complicated. I am still trying different solutions for Windows.

When I start multiple uploaders at once, phpMussel runs much slower and still processes all uploads.

We should add some options like max_execution_time, get_server_load and check memory usage (if possible?) and stop the further execution to prevent DoS.

If PHP_OS or php_uname() contains WIN use another solution
http://stackoverflow.com/a/1482271/753676

sys_getloadavg() for non-Windows
$load = sys_getloadavg()[0]; // last 1 minute

http://php.net/manual/de/function.sys-getloadavg.php

Edit: it seems this does not work on all Linux platform (for security reasons) but we need some protection for sure.

@Maikuolan Do you have some ideas, how a protection against this problem (too many uploads at once making the server slow) could look like?

This is still a problem, that we have to look at but I have not yet the ideal solution.

prefer client language for warning if set

I searched for $_SERVER['HTTP_ACCEPT_LANGUAGE'] in the code but did not find it.

We could add a setting to prefer the language of the client (language set in the browser) and use this for the warning shown to visitors/users to make it more flexible.

lang.inc suggestions

Should we move this to the phpmussel.ini file?
https://github.com/Maikuolan/phpMussel/blob/master/vault/lang.inc#L66

Also would it not be better to allow dynamic addition of additional langiages just by dropping the specific lang.inc file into the lang directory?
We can get the filenames and languages using something like glob() with some callback filter.

https://github.com/DanielRuf/phpMussel/blob/master/vault/lang.inc#L71
I also think that this big if-else statement can be minified into one line (or at least some switch-case statement) and that the language is used as a variable instead of the full filename for each language.
Because when we add more languages in the future, we have to keep this in mind and change multiple PHP files accordingly.

test cases for PHPUnit

I have started creating test cases for PHPUnit. This issue is for reference and contains a first example. Should we add unit tests to phpMussel?

phpMussel-tests.php
<?php
include 'phpMussel.php';
class MaliciousTest extends PHPUnit_Framework_TestCase
{

    public function testIsMalicious()
    {
        // Arrange
        $a = phpMussel("_testfiles/ascii_standard_testfile.txt");
        // Assert
        $this->assertEquals(2, $a);
    }

}

Detected phpMussel-FN.Illegal.Character-2F

After Upload a ZIP File (with directories):

Detected phpMussel-FN.Illegal.Character-2F (ConUpd3.2.20_3.2.21%2Fcontao%2Fpopup.php)! 
Detected phpMussel-PHP.Shell.Function-00 (ConUpd3.2.20_3.2.21%2Fcontao%2Fpopup.php)! 
and many many more...

2F is ASCII "/", is it here wrong detected the (linux) directory separator? See output %2F.

Wish list: Archive support.

Currently supported compression formats:

Currently supported archive formats:

Formerly supported archive formats:

~~PHAR~~ (support removed in v1.6.0; won't be added again).
- ~~Recursion Support~~

Not yet supported (but hope to be able to support in the future):

7z
- Recursion support
- Encryption/Decryption support

Wikipedia's List of archive formats: https://en.wikipedia.org/wiki/List_of_archive_formats

Serialised Data

DanielRuf Wrote:

@Maikuolan We could use some array and serialize / unserialize it (store it serialized, so we have just one line in the logfile and can extract it for showing in the frontend without any problem. Some elements/values could contain some id representing the result (detected x ...).

Or just one line as a string, not serialized array.
Should be better to read and analyze (think about delimiting the values with comma or tab or something else, so it can be easily inserted into spreadsheet software like Excel and easily analyzed).

But this could be another ticket/issue (custom log format).

On that note.. I actually wonder if maybe an additional logfile, separate from the others, should be created for this sort of thing? I like the idea of serialising/unserialising data for easy storage and access, and serialised data (for the caching) would be much easier to work with in regards to issues like this one (displaying scan results in the correct language when languages change), as would something like maybe CSV values or similar, but, the current logfiles (scan_kills.txt, scan_log.txt) were intended to be human readable without the need of additional tools or programs (as so that someone could read them simply by opening them), and if I change the way that those two logfiles are formatted (such as to be serialised, for example), it could potentially break human readability.

Seeing as those two logfiles can be disabled by omitting the scan_log and scan_kills directives anyhow, maybe a third logfile directive should be added (like scan_serialized or something similar)?

greylist.csv file is created above vault directory

When we manually call phpMussel() and forget to set cleanup to 0, a greylist.csv file is created above the vault directory as there is a missing check for this.

PHP CompatInfo analysis (FYI)

>php phpcompatinfo-4.2.0.phar analyser:run .

Data Source Analysed

Directories                                          2
Files                                                4

Extensions Analysis

    Extension Matches REF      EXT min/Max PHP min/Max PHP all
    Core              Core                 4.0.0       5.4.0
    bz2               bz2      4.0.4       4.0.4
    date              date     4.0.0       4.0.0
    hash              hash     1.1         4.0.0
    lzf               lzf      0.1         4.0.0
    pcre              pcre     4.0.0       4.0.0
    standard          standard 4.0.0       4.0.0       5.5.0
    zip               zip      1.0         4.3.0
    zlib              zlib     4.0.4       4.0.4       5.4.0
    Total [9]                              4.3.0       5.5.0

Namespaces Analysis

    Namespace Matches REF  EXT min/Max PHP min/Max PHP all
    +global           Core             4.0.0       5.5.0
    Total [1]                          4.0.0       5.5.0

No interface found

No trait found

No class found

Functions Analysis

    Function              Matches REF      EXT min/Max PHP min/Max
    ReadUpdateFile        7       user                 4.0.0
    base64_decode         11      standard 4.0.0       4.0.0
    base64_encode         1       standard 4.0.0       4.0.0
 C  bin2hex               14      standard 4.0.0       4.0.0
 C  bzdecompress          2       bz2      4.0.4       4.0.4
    ceil                  2       standard 4.0.0       4.0.0
    chr                   2       standard 4.0.0       4.0.0
 C  cli_set_process_title 2       standard 5.5.0       5.5.0
    closedir              2       standard 4.0.0       4.0.0
    count                 168     standard 4.0.0       4.0.0
    date                  8       date     4.0.0       4.0.0
    dechex                2       standard 4.0.0       4.0.0
    define                4       Core     4.0.0       4.0.0
    defined               5       Core     4.0.0       4.0.0
    error_reporting       2       Core     4.0.0       4.0.0
    explode               279     standard 4.0.0       4.0.0
    fclose                18      standard 4.0.0       4.0.0
    fgets                 2       standard 4.0.0       4.0.0
    file                  125     standard 4.0.0       4.0.0
    file_exists           28      standard 4.0.0       4.0.0
    file_get_contents     1       standard 4.3.0       4.3.0
    filesize              4       standard 4.0.0       4.0.0
    fopen                 19      standard 4.0.0       4.0.0
    fread                 2       standard 4.0.0       4.0.0
    ftruncate             2       standard 4.0.0       4.0.0
    function_exists       26      Core     4.0.0       4.0.0
    fwrite                16      standard 4.0.0       4.0.0
 C  gzdecode              2       zlib     5.4.0       5.4.0
 C  gzdeflate             1       zlib     4.0.4       4.0.4
 C  gzinflate             8       zlib     4.0.4       4.0.4
    hash                  15      hash     1.1         4.0.0
    header                8       standard 4.0.0       4.0.0
 C  hex2bin               6       standard 5.4.0       5.4.0
    hexdec                3       standard 4.0.0       4.0.0
    html_entity_decode    1       standard 4.3.0       4.3.0
    implode               81      standard 4.0.0       4.0.0
 C  implode_md            19      user                 4.0.0
    ini_get               3       standard 4.0.0       4.0.0
    ini_set               6       standard 4.0.0       4.0.0
    is_array              132     standard 4.0.0       4.0.0
    is_dir                10      standard 4.0.0       4.0.0
    is_file               9       standard 4.0.0       4.0.0
    is_link               2       standard 4.0.0       4.0.0
    is_uploaded_file      7       standard 4.0.3       4.0.3
    key                   8       standard 4.0.0       4.0.0
 C  levenshtein           4       standard 4.0.1       4.0.1
 C  lv_match              3       user                 4.0.0
 C  lzf_decompress        1       lzf      0.1         4.0.0
    md5                   31      standard 4.0.0       4.0.0
    next                  5       standard 4.0.0       4.0.0
    opendir               2       standard 4.0.0       4.0.0
    ord                   2       standard 4.0.0       4.0.0
    pack                  1       standard 4.0.0       4.0.0
    parse_ini_file        1       standard 4.0.0       4.0.0
    parse_str             1       standard 4.0.0       4.0.0
    pclose                1       standard 4.0.0       4.0.0
    phpMussel             2       user                 4.0.0
    phpMusselD            3       user                 4.0.0       5.0.0
    phpMusselFile         7       user                 4.0.0
 C  phpMusselFork         6       user                 4.0.0
    phpMusselMemUse       3       user                 4.0.0
    phpMusselQ            4       user                 4.0.0       4.0.1
    phpMusselR            4       user                 4.0.0       4.3.0
    phpMussel_mail                user                 4.0.0
    php_sapi_name         1       standard 4.0.1       4.0.1
 C  plaintext_echo_die    24      user                 4.0.0
    popen                 1       standard 4.0.0       4.0.0
    preg_match            502     pcre     4.0.0       4.0.0
    preg_match_all        14      pcre     4.0.0       4.0.0
    preg_replace          3       pcre     4.0.0       4.0.0
    preg_split            76      pcre     4.0.0       4.0.0
    prescan_decode        6       user                 4.0.0       5.0.0
    prescan_normalise     4       user                 4.0.0       5.0.0
    prescan_xmlxdp        2       user                 4.0.0
    readdir               2       standard 4.0.0       4.0.0
    reset                 2       standard 4.0.0       4.0.0
    round                 1       standard 4.0.0       4.0.0
 C  scandir               6       standard 5.0.0       5.0.0
    sha1                  4       standard 4.3.0       4.3.0
    sleep                 1       standard 4.0.0       4.0.0
    split_nibble          3       user                 4.0.0
    str_ireplace          15      standard 5.0.0       5.0.0
    str_len               1       user                 4.0.0
    str_pad               2       standard 4.0.1       4.0.1
    str_repeat            1       standard 4.0.0       4.0.0
    str_replace           9       standard 4.0.0       4.0.0
    str_rot13             8       standard 4.2.0       4.2.0
 C  str_split                     standard 5.0.0       5.0.0
    stream_context_create 1       standard 4.3.0       4.3.0
    strlen                142     Core     4.0.0       4.0.0
    strpos                7       standard 4.0.0       4.0.0
    strrpos               2       standard 4.0.0       4.0.0
    strtolower            32      standard 4.0.0       4.0.0
    strtoupper            1       standard 4.0.0       4.0.0
    substr                787     standard 4.0.0       4.0.0
    substr_compare_hex    2       user                 4.0.0
    substr_count          671     standard 4.0.0       4.0.0
 C  substraf              76      user                 4.0.0
 C  substral              11      user                 4.0.0
 C  substrbf              14      user                 4.0.0
 C  substrbl              18      user                 4.0.0
    time                  23      date     4.0.0       4.0.0
    trim                  12      standard 4.0.0       4.0.0
    unlink                17      standard 4.0.0       4.0.0
    unpack                8       standard 4.0.0       4.0.0
    urldecode             1       standard 4.0.0       4.0.0
    urlencode             7       standard 4.0.0       4.0.0
    vn_shorthand          93      user                 4.0.0
    zip_entry_filesize    1       zip      1.0         4.3.0
    zip_entry_name        1       zip      1.0         4.3.0
    zip_entry_read        1       zip      1.0         4.3.0
 C  zip_open              1       zip      1.0         4.3.0
    zip_read              1       zip      1.0         4.3.0
    Total [113]                                        5.0.0

Constants Analysis

    Constant            Matches REF  EXT min/Max PHP min/Max
 C  PHP_BINARY          1       Core 5.4.0       5.4.0
    PHP_OS              1       Core 4.0.0       4.0.0
    PREG_SPLIT_NO_EMPTY 76      pcre 4.0.0       4.0.0
    false               190     Core 4.0.0       4.0.0
    mussel_os           3       user             4.0.0
    mussel_php          4       user             4.0.0
    mussel_sapi         3       user             4.0.0
 C  phpMussel                   user             4.0.0
    true                253     Core 4.0.0       4.0.0
    Total [9]                                    4.0.0

Conditions Analysis

    Condition                              Matches REF      EXT min/Max PHP min/
Max
    defined(PHP_BINARY)                    1       Core     5.4.0       5.4.0

    defined(phpMussel)                     4       user                 4.0.0

    function_exists(bin2hex)               1       standard 4.0.0       4.0.0

    function_exists(bzdecompress)          2       bz2      4.0.4       4.0.4

    function_exists(cli_set_process_title) 2       standard 5.5.0       5.5.0

    function_exists(gzdecode)              2       zlib     5.4.0       5.4.0

    function_exists(gzdeflate)             1       zlib     4.0.4       4.0.4

    function_exists(gzinflate)             2       zlib     4.0.4       4.0.4

    function_exists(hex2bin)               1       standard 5.4.0       5.4.0

    function_exists(implode_md)            1       user                 4.0.0

    function_exists(levenshtein)           1       standard 4.0.1       4.0.1

    function_exists(lv_match)              1       user                 4.0.0

    function_exists(lzf_decompress)        1       lzf      0.1         4.0.0

    function_exists(phpMusselFork)         3       user                 4.0.0

    function_exists(plaintext_echo_die)    1       user                 4.0.0

    function_exists(scandir)               1       standard 5.0.0       5.0.0

    function_exists(str_split)             1       standard 5.0.0       5.0.0

    function_exists(substraf)              1       user                 4.0.0

    function_exists(substral)              1       user                 4.0.0

    function_exists(substrbf)              1       user                 4.0.0

    function_exists(substrbl)              1       user                 4.0.0

    function_exists(zip_open)              1       zip      1.0         4.3.0

    Total [22]                                                          5.5.0


Requires PHP 4.3.0 (min), PHP 5.5.0 (all)

detect PGP encrypted strings

Just some idea. What if more webshells and malware use PGP and hide the actual payload with it, it would help to detect PGP encrypted strings and block the upload (if set).

Taken from https://de.wikipedia.org/wiki/Pretty_Good_Privacy#Aussehen_einer_verschl.C3.BCsselten_Nachricht

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.16 (GNU/Linux)

hQEMA1PUVhZb8UnsAQf+KS9PNvkWYFONnoStveMc4KwvGT7WlRFv/ZACvdyFsKDO
icurhL57uh56KCof1m5drfftwjDQWgNyMy0cixqV/2WzeQgjZILE0Z1FDg7cgAbs
UZvy2hmaJf0dhHEUziALotfUMhoSeHeObxmomzb7vovJv5tWDtQ9W+p2tbQ4tiin
LAsJtwQhEVPNltootBteC0dTgOdISe6kfqUSoN3A22SiSUihmjxMPiiO6iZB8gBS
hhfiSPa4khNwODncRe2BjqW+YQHf7L6CfLjx2S1BCSr+KWLmUnVdWSUonhHPF9mI
E/q7t2uoBWg0iQgCjQubgYeqSUYN/xWpqAUX9O71zdKUAbVjjLVT0qTjNLLvms2H
s4BDzHEqKeuGuMAWFzyfuW+VNofTxtcHhzrdjPuYi7sRL3YNUvqUpcGeKGyTApW2
k/fd7U32av7Pq63NoKK2g3RFcyBUiSdNlNhW8TYS1NdMSMXNw1R9dWVgFmsLj2vs
Rv89ufRiPbNLDXcx7CkRrTf13q0miy1850d6k5nt8qUFrnh4xQ==
=z6Xk
-----END PGP MESSAGE-----

If this is decoded, we can test / see if it is encrypted with PGP and therefore suspicious.
http://www.oktay.de/decode/base64.htm

Because some webshells use PGP

false positiv on normal php files (PHP.Shell.Function 00/01)

I upload a ZIP, in the ZP file is located the php file "popup.php", a file from the CMS Contao.
Result is:

Detected phpMussel-PHP.Shell.Function-00 (popup.php)! 
Detected phpMussel-PHP.Shell.Function-01 (popup.php)!

Log:

Tue, 17 Nov 2015 21:53:01 +0100 Started.
> Checking 'popup.php.zip' (FN: 11f74f6b; FD: dca3da56):
-> No problems found.
-> Reading 'popup.php.zip' (ZIP):
--> Success! Proceeding to check contents.
--> Checking 'popup.php.zip' > 'popup.php' (FN: b809e934; FD: 3194c5ca):
-> Detected phpMussel-PHP.Shell.Function-00!
-> Detected phpMussel-PHP.Shell.Function-01!
Tue, 17 Nov 2015 21:53:01 +0100 Finished.

When i rename the file in popup.php.txt, there is no error. Eh?

I can attach the zip here, if it helps you.

disable CLI mode for PHPUnit

change
https://github.com/Maikuolan/phpMussel/blob/39cb7c2358e8546b427b0c88dd3fa629afc4ce24/vault/phpmussel.inc#L12002
to

if(!$MusselConfig['general']['disable_cli']&&function_exists('phpMusselFork')&&strlen(mussel_php)>0&&mussel_os=='WIN'&&mussel_sapi=='cli')

and add disable_cli=1 (0 per default) in phpmussel.ini

so we can run the PHPUnit tests in CLI mode like in the normal mode from the command line.

phpMussel benchmarks

phpMussel version: 3ed887a

I have done a small benchmark with ab and JMeter.
ab is single threaded and JMeter multithreaded, so ab simulates one real user with multiple uploads.
JMeter simulates multiple real users and one upload per user.

Server: Apache/2.4.10 (Win32) OpenSSL/1.0.1i PHP/5.6.3 (Apache module)
CPU: Intel Core i7-4702MQ CPU @ 2.20GHz (1 core, 8 threads)
RAM: 8GB PC3-12800 (800 MHz)
OS: Windows 7 Home Premium

The used code is

<?php
error_reporting(0);
include 'phpmussel.php';
echo phpMussel("_testfiles/ascii_standard_testfile.txt");

100 requests, 10 concurrent

C:\xampp\apache\bin>ab.exe -n 100 -c 10 http://localhost/phpmussel-master/phpMus
sel-master/benchmark.php
This is ApacheBench, Version 2.3 <$Revision: 1604373 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking localhost (be patient).....done


Server Software:        Apache/2.4.10
Server Hostname:        localhost
Server Port:            80

Document Path:          /phpmussel-master/phpMussel-master/benchmark.php
Document Length:        0 bytes

Concurrency Level:      10
Time taken for tests:   9.030 seconds
Complete requests:      100
Failed requests:        94
   (Connect: 0, Receive: 0, Length: 94, Exceptions: 0)
Total transferred:      21594 bytes
HTML transferred:       94 bytes
Requests per second:    11.07 [#/sec] (mean)
Time per request:       902.952 [ms] (mean)
Time per request:       90.295 [ms] (mean, across all concurrent requests)
Transfer rate:          2.34 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    1   3.9      0      30
Processing:   510  871 118.3    875    1110
Waiting:      510  871 118.2    875    1110
Total:        540  872 117.6    875    1110

Percentage of the requests served within a certain time (ms)
  50%    875
  66%    925
  75%    955
  80%    980
  90%   1020
  95%   1035
  98%   1110
  99%   1110
 100%   1110 (longest request)

100 requests, 5 concurrent

C:\xampp\apache\bin>ab.exe -n 100 -c 5 http://localhost/phpmussel-master/phpMuss
el-master/benchmark.php
This is ApacheBench, Version 2.3 <$Revision: 1604373 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking localhost (be patient).....done


Server Software:        Apache/2.4.10
Server Hostname:        localhost
Server Port:            80

Document Path:          /phpmussel-master/phpMussel-master/benchmark.php
Document Length:        1 bytes

Concurrency Level:      5
Time taken for tests:   9.648 seconds
Complete requests:      100
Failed requests:        0
Total transferred:      21600 bytes
HTML transferred:       100 bytes
Requests per second:    10.37 [#/sec] (mean)
Time per request:       482.376 [ms] (mean)
Time per request:       96.475 [ms] (mean, across all concurrent requests)
Transfer rate:          2.19 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    1   3.4      0      10
Processing:   358  474  24.4    478     520
Waiting:      358  474  24.2    478     520
Total:        358  475  23.9    480     520

Percentage of the requests served within a certain time (ms)
  50%    480
  66%    488
  75%    490
  80%    490
  90%    500
  95%    503
  98%    520
  99%    520
 100%    520 (longest request)

100 requests, 1 concurrent

C:\xampp\apache\bin>ab.exe -n 100 -c 1 http://localhost/phpmussel-master/phpMuss
el-master/benchmark.php
This is ApacheBench, Version 2.3 <$Revision: 1604373 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking localhost (be patient).....done


Server Software:        Apache/2.4.10
Server Hostname:        localhost
Server Port:            80

Document Path:          /phpmussel-master/phpMussel-master/benchmark.php
Document Length:        1 bytes

Concurrency Level:      1
Time taken for tests:   27.508 seconds
Complete requests:      100
Failed requests:        0
Total transferred:      21600 bytes
HTML transferred:       100 bytes
Requests per second:    3.64 [#/sec] (mean)
Time per request:       275.079 [ms] (mean)
Time per request:       275.079 [ms] (mean, across all concurrent requests)
Transfer rate:          0.77 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    0   0.7      0       3
Processing:   265  275  11.0    273     328
Waiting:      265  274  11.0    273     328
Total:        265  275  11.3    273     330

Percentage of the requests served within a certain time (ms)
  50%    273
  66%    275
  75%    278
  80%    280
  90%    290
  95%    298
  98%    323
  99%    330
 100%    330 (longest request)

The failed requests of the test with 10 requests at once reflects the default max_uploads=10 setting.

JMeter 1 user

JMeter 5 users

JMeter 10 users

JMeter phpMussel Web Test Plan: https://gist.github.com/DanielRuf/34fa859eaf61afab2eaf

I will do some more benchmarks. This was just the first benchmark with the default options and cleanup=0

Documentation streamlining/clarity

This issue created for the purpose of tracking changes made to the documentation in relation to streamlining and improving clarity.

In reference to the discussion here.

(DR)

I am a bit confused.
Shouldn't be the two options before the texts like in the *.md file? ;-)

(CM)

Yeah, I think you're right. I started doing it one way, and then switched to the other way. We can fix the *.txt files, so that they're like the *.md files; That way, everything will be more consistent. I hadn't thought much on this before, but it could potentially create confusion, and the documentation, considering what it's for, shouldn't be structured in a way that could create confusion.

(DR)

Right, you can create an issue for this and we will look at this in the future. I will analyse then the files and see where changes might be needed to prevent confusion.

I will begin working on the aforementioned issue tonight and will reference this issue when finished.

Support multiple file upload

I tried phpMussel in the CMS Contao, but:

Unauthorised file upload manipulation detected (Array)

Contao uses a form with support for multiple file upload.

<input multiple="" name="files[]" type="file" />

Output of the variable $ _FILES when you select a single file in Contao:

Array
(
    [files] => Array
        (
            [name] => Array
                (
                    [0] => 4advent.jpg
                )
            [type] => Array
                (
                    [0] => image/jpeg
                )
            [tmp_name] => Array
                (
                    [0] => /tmp/phpVCuBLR
                )
            [error] => Array
                (
                    [0] => 0
                )
            [size] => Array
                (
                    [0] => 22706
                )
        )
)

For comparison, a form that support only to upload a single file has this output (example):

Array
(
    [files] => Array
        (
            [name] => 4advent.jpg
            [type] => image/jpeg
            [tmp_name] => /tmp/phpOX0RwZ
            [error] => 0
            [size] => 22706
        )

)

URL scanner

I'm thinking about maybe trying to build a URL scanner into phpMussel, to detect malicious URLs from within files and/or data scanned by phpMussel.

At present, phpMussel already supports Virus Total integration for scanning file hashes using the Virus Total API and already utilises data from PhishTank; If I built a proper URL scanner into phpMussel, I could optimise that data from PhishTank to run more quickly and more efficiently, such as by writing hash-based signatures (hashes of malicious URLs) for use instead of the current string-based signatures (string segments of malicious URLs), or, by way of leveraging the URL scanning capabilities of the Virus Total API (which already checks URLs against PhishTank as well as dozens of other engines), the data from PhishTank included with phpMussel could be rendered obsolete and removed altogether.

One of the downsides of using hash-based signatures instead of string-based signatures in this context is that any signatures written could only match something very specific (like a specific, precisely matching URL), whereas string-based signatures are able to match things more loosely (such as the domain component, query component or some specific section of a URL). The upside to this, though, is that hash-based signatures can be checked much more quickly and have a smaller footprint, meaning that I could potentially include many more of them for the same total cost of a smaller number of their string-based counterparts.

Of course, if I just rendered them obsolete and removed them altogether, the footprint or efficiency of them either way would become irrelevant.

I've thought of a few different ways that this could be done and a few different applications of it; URLs could be searched for for HTML files, Email/EML files, things like that, or, conforming with as things are currently, URLs could be searched for within whatever is thrown at the phpMussel_mail() function; In those instances, simply looking for instances of <a...>...</a>, href="..." and other variants thereof (hyperlink pseudo-code; would probably use regex or something similar and could refine this later, if we decided to proceed with this idea) should be sufficient.

There's no hurry with this idea, but, I thought I'd post about it now anyhow as so that it could be discussed.

@DanielRuf What are your thoughts on this?

CMS integration tracking

Following up from #55, where @bechtold has offered to contribute a Drupal module based on phpMussel, I think the idea of integrating phpMussel with various CMS is a great idea, if it could be done.

I haven't yet seen any offers from anybody else to integrate phpMussel elsewhere, though, if anybody reads this issue and thinks that they might be interested in helping out, I'd love to hear from them.

I'm creating this issue to track and cross-reference research and communications relating to possible future integration of phpMussel into various CMS.

Regarding phpBB, via a reply to a support request for phpMussel posted to Spambot Security (linked here), though as of yet, this hasn't been followed up:

I've been reading the documentation for creating plugins for phpBB (referred to as "extensions" for phpBB versions 3.1.x and referred to as "MODs" for phpBB versions 3.0.x; doesn't appear to be any documentation for phpBB versions lower than 3.x). It should be possible to create a plugin for phpBB, although, extensions and MODs aren't built and don't function in the same way as each other, and so, the two wouldn't be mutually compatible; Depending on which version of phpBB is used, one or the other may be required, or possibly both, depending on circumstances and intended usage. I'm also wondering about the likelihood of the phpBB team bringing out some other new system for plugins when they eventually reach version 3.2.x, and whether any such system would be mutually compatible with extensions (probably not); That might make things much more tedious in the future for maintaining any such plugins.

Alternatively, (snip) I might possibly be able to just add some new code and associated directive to phpMussel dealing specifically with phpBB compatibility for instructing phpMussel to return its Upload Denied message as a JSON response that could be interpreted by phpBB rather than as an actual HTML page. Something to look into, anyhow.

Regarding phpBB, interest for anti-virus integration for uploads seems to be mixed; Reading their support forums, I've seen this subject discussed numerous times in the past, although there doesn't seem to have been much progress in regards to the subject. I've seen a number of users suggest that they think the idea is silly and unneeded, but at the same time, over the years, it seems many users have actually made requests for either this specific functionality or solutions similar to this functionality.

Searching their forum for terms such as "virus", "malware", "shell" and etc, can reveal this. For example - https://www.phpbb.com/search/?q=virus

A few months ago, I attempted to reply to one such support request, as a means to test the waters for something like this: https://www.phpbb.com/community/viewtopic.php?f=64&t=2312951

There were only two responses - one for, one against - this indicates what I mean by mixed interest. Nonetheless, I think this is definitely something that should be done.

Regarding Wordpress, posted via their support forum (linked here), though unfortunately, at this point in time, there hasn't been any replies:

Firstly, it has been suggested to me that WordPress leverages AJAX for its file upload process; Is that true?

Secondly, if the above is true, what would be the appropriate action/hook to use in order to trigger the primary function of the plugin upon a user attempting to upload a file via WordPress?

Thirdly, and assuming again the above to be true, what response would be expected from the request and how would WordPress handle that response?

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.