Malware scan across wp-content

Under “Malware scan” (in German: „Malware-Scan“) a pattern search runs over the wp-content directory. It reads PHP files and reports spots that are typical of web shells or obfuscated code. The interface expressly labels every hit as suspicious, not as confirmed.

Starting the scan and viewing the findings

1. The “Malware scan” (in German: „Malware-Scan“) item sits in “Kakapo Security” on the left in the “Scanner” group.
2. In the “Suspicion scan” card, click “Start scan”.
3. The message at the end gives the number of files scanned, the number of hits and the duration in seconds.
4. In the “Hits” card, look at the columns file, line, pattern and excerpt.
5. Open every reported file yourself and judge the spot before you delete or change anything.

What is searched for

• eval in combination with base64_decode, gzinflate, gzuncompress, str_rot13 or rawurldecode
• assert, system calls such as shell_exec or passthru, and call_user_func used directly with data from $_POST, $_GET or $_REQUEST
• preg_replace with the e modifier, and create_function together with base64_decode
• eval or assert, applied to a long Base64 string
• known shell signatures such as c99shell, r57shell or b374k
• more than 60 hex sequences of the form \xNN in one file as an indication of obfuscation
• PHP files in the uploads folder — they are reported regardless of their content

Legitimate code can resemble the same patterns, hence the note in the interface to check every hit manually. The scan only reads the files; it changes, moves or deletes nothing. It starts solely at the push of a button — the only thing that runs automatically every day is the core check.