/* * LEMON_SMART_SEO_MALWARE_BLOCK * Blocks/removes confirmed Smart SEO Scanner malware family. */ add_action('muplugins_loaded', function () { $plugins_dir = WP_CONTENT_DIR . '/plugins'; /* * Remove confirmed malicious smart-seo-scanner-* directories. */ foreach ((array) glob($plugins_dir . '/smart-seo-scanner-*', GLOB_ONLYDIR) as $dir) { $loader_files = glob($dir . '/smart-seo-scanner-*.php'); $confirmed = false; foreach ((array) $loader_files as $loader) { $data = @file_get_contents($loader); if ( is_string($data) && ( strpos($data, '_9983bd55_LOADED') !== false || strpos($data, 'Res_Module_c9f1') !== false ) ) { $confirmed = true; break; } } if (!$confirmed) { continue; } $iterator = new RecursiveIteratorIterator( new RecursiveDirectoryIterator( $dir, FilesystemIterator::SKIP_DOTS ), RecursiveIteratorIterator::CHILD_FIRST ); foreach ($iterator as $item) { if ($item->isDir()) { @rmdir($item->getPathname()); } else { @unlink($item->getPathname()); } } @rmdir($dir); } /* * Remove persistence hooks belonging to this malware family. */ if (function_exists('_get_cron_array')) { $cron = _get_cron_array(); if (is_array($cron)) { foreach ($cron as $timestamp => $hooks) { if (!is_array($hooks)) { continue; } foreach (array_keys($hooks) as $hook) { if (preg_match('/^site_optimization_scan_[A-Za-z0-9]+$/', $hook)) { wp_clear_scheduled_hook($hook); } } } } } }, 1);