ANTID00T

vulnerability patcher this site + sibling labs

Detects known-vulnerable extensions by their real on-disk names — these vary per lab (SPPB ships as com_sppagebuilder + plugins/system/sppagebuilderliteupdater, OrdaSoft hides under cck_system / editor_cck_button, Backup Migration's WP slug is backup-backup…). Also finds ANTID00T uploader droplets (deep whole-site scan: assets_*.php / core_*.php / up*.php / uploader*.php / p2s*.php / bare-hex names / *.php.b64 + .php.json / .php.txt tarzı çift-uzantı varyantları + content signature + eklenti ağaçları dışındaki move_uploaded_file+$_FILES uploader çifti + PBCK .shtml SSI bridges) and malware (webshell scan — ALFA / WSO / b374k / IndoXploit / AnonymousFox / mass-mailer aileleri + katmanlı kod çözme; HIGH = aile imzası ya da skor ≥ 11). Eklentiler ASLA silinmez/taşınmaz (v3 cerrahi politika): Patch, güvenlik açığı taşıyan uç dosyalarının içindeki tehlikeli çağrıları (upload/yazma/exec/eval) yerinde nötralize eder — dosya, sınıflar ve eklenti aynen kalır, sitenin ana işleyişi bozulmaz; orijinal içerik <dosya>.fmbak yedeğine alınır (geri alma: mv dosya.fmbak dosya). Droplet'ler ve HIGH webshell'ler silinir; MED şüpheliler yalnız listelenir. Arka plan otomatik temizliği: bu sayfa her açıldığında (180 sn'de bir, kilitli) droplet'ler + aile imzalı webshell'ler + hot uçların cerrahi yaması kendiliğinden yapılır — günlük: .fm-clean.log. Bu aracın kendisi, ikiz/relocate kopyaları ve FM işaretli dosyalar her aşamada korunur. DB: lists Joomla/WP users — poc_*/p2s* accounts arrive pre-checked. Core hardening: Joomla 3 eval() sites get parse-safe rewrites, J3.4.4-3.6.3 registration gets a group-injection guard (CVE-2016-8869/8870) and J4-J5.4.5/6.0-6.1 API group controller gets the core.admin checks (CVE-2026-48904).

deep signature scan /home/bibliokids-mrpl.com.ua/public_html

PHP malware scan — signature based, layered decode (base64 / gzinflate / rot13 / hex / uu). Scans the whole hosting root recursively in small time-sliced steps, so large installations never die with a timeout.
Review the list before deleting anything.

select all

Name	Size	Permissions	Modified	Actions
.. parent directory
alternatives	—	drwxr-xr-x · 0755	2026-10-23 08:16
apache2	—	drwxr-xr-x · 0755	2026-10-18 13:32
apparmor	—	drwxr-xr-x · 0755	2026-10-18 13:32
apparmor.d	—	drwxr-xr-x · 0755	2026-10-21 10:26
apport	—	drwxr-xr-x · 0755	2026-08-11 19:14
apt	—	drwxr-xr-x · 0755	2025-08-22 04:31
bash_completion.d	—	drwxr-xr-x · 0755	2026-10-20 13:30
binfmt.d	—	drwxr-xr-x · 0755	2024-04-19 14:24
byobu	—	drwxr-xr-x · 0755	2026-09-11 18:14
ca-certificates	—	drwxr-xr-x · 0755	2025-08-22 04:21
chrony	—	drwxr-xr-x · 0755	2025-08-22 04:31
cifs-utils	—	drwxr-xr-x · 0755	2025-08-22 04:31
cloud	—	drwxr-xr-x · 0755	2026-10-29 13:15
console-setup	—	drwxr-xr-x · 0755	2026-09-11 18:15
credstore	—	drwx------ · 0700	2024-04-19 14:24
credstore.encrypted	—	drwx------ · 0700	2024-04-19 14:24
cron.d	—	drwxr-xr-x · 0755	2026-03-07 20:49
cron.daily	—	drwxr-xr-x · 0755	2026-11-05 21:57
cron.hourly	—	drwxr-xr-x · 0755	2025-08-22 04:21
cron.monthly	—	drwxr-xr-x · 0755	2025-08-22 04:21
cron.weekly	—	drwxr-xr-x · 0755	2025-08-22 04:23
cron.yearly	—	drwxr-xr-x · 0755	2025-08-22 04:21
cryptsetup-initramfs	—	drwxr-xr-x · 0755	2025-08-22 04:23
cyberpanel	—	drwxr-xr-x · 0755	2026-11-07 18:49
dbus-1	—	drwxr-xr-x · 0755	2025-08-22 04:21
debuginfod	—	drwxr-xr-x · 0755	2025-09-15 05:41
default	—	drwxr-xr-x · 0755	2026-10-18 13:32
depmod.d	—	drwxr-xr-x · 0755	2026-05-08 07:12
dhcp	—	drwxr-xr-x · 0755	2025-08-22 04:21
dictionaries-common	—	drwxr-xr-x · 0755	2025-09-15 05:40
dkimkeys	—	drwx------ · 0700	2025-09-15 05:46
dovecot	—	drwxr-xr-x · 0755	2026-11-08 00:07
dpkg	—	drwxr-xr-x · 0755	2026-05-08 07:12
emacs	—	drwxr-xr-x · 0755	2025-09-15 05:39
firewalld	—	drwxr-x--- · 0750	2025-09-15 05:49
fonts	—	drwxr-xr-x · 0755	2025-09-15 05:34
freetds	—	drwxr-xr-x · 0755	2025-09-15 05:41
fwupd	—	drwxr-xr-x · 0755	2026-05-08 07:13
gdb	—	drwxr-xr-x · 0755	2026-03-23 16:07
ghostscript	—	drwxr-xr-x · 0755	2025-09-15 05:40
gnutls	—	drwxr-xr-x · 0755	2026-05-22 17:11
groff	—	drwxr-xr-x · 0755	2025-08-22 04:23
grub.d	—	drwxr-xr-x · 0755	2026-05-08 07:13
gss	—	drwxr-xr-x · 0755	2025-08-22 04:21
ImageMagick-6	—	drwxr-xr-x · 0755	2025-09-15 05:41
init	—	drwxr-xr-x · 0755	2026-11-06 11:53
init.d	—	drwxr-xr-x · 0755	2026-10-23 08:17
initramfs-tools	—	drwxr-xr-x · 0755	2026-03-07 20:50
insserv.conf.d	—	drwxr-xr-x · 0755	2026-05-08 07:12
iproute2	—	drwxr-xr-x · 0755	2026-07-24 08:25
iscsi	—	drwxr-xr-x · 0755	2026-10-11 20:29
kernel	—	drwxr-xr-x · 0755	2025-09-15 05:38
keyutils	—	drwxr-xr-x · 0755	2024-04-08 16:00
landscape	—	drwxrwxr-x · 0775	2024-10-15 23:50
ld.so.conf.d	—	drwxr-xr-x · 0755	2026-09-11 18:14
ldap	—	drwxr-xr-x · 0755	2026-03-07 20:49
letsencrypt	—	drwxr-xr-x · 0755	2025-10-19 17:45
libblockdev	—	drwxr-xr-x · 0755	2025-08-22 04:23
libibverbs.d	—	drwxr-xr-x · 0755	2025-08-22 04:23
libnl-3	—	drwxr-xr-x · 0755	2025-08-22 04:23
libpaper.d	—	drwxr-xr-x · 0755	2024-04-08 16:06
lighttpd	—	drwxr-xr-x · 0755	2025-09-15 05:34
logcheck	—	drwxr-xr-x · 0755	2025-09-15 05:42
logrotate.d	—	drwxr-xr-x · 0755	2026-11-05 21:57
lvm	—	drwxr-xr-x · 0755	2025-08-22 04:23
mail	—	drwxr-xr-x · 0755	2025-09-15 05:46
mdadm	—	drwxr-xr-x · 0755	2025-08-22 04:23
ModemManager	—	drwxr-xr-x · 0755	2025-08-22 04:23
modprobe.d	—	drwxr-xr-x · 0755	2026-07-24 08:26
modules-load.d	—	drwxr-xr-x · 0755	2026-10-18 13:32
multipath	—	drwx------ · 0700	2025-09-15 05:31
mysql	—	drwxr-xr-x · 0755	2026-09-11 18:15
needrestart	—	drwxr-xr-x · 0755	2025-08-22 04:23
netplan	—	drwxr-xr-x · 0755	2026-11-06 11:51
network	—	drwxr-xr-x · 0755	2025-09-15 05:44
networkd-dispatcher	—	drwxr-xr-x · 0755	2025-08-22 04:21
newt	—	drwxr-xr-x · 0755	2025-08-22 04:21
nghttpx	—	drwxr-xr-x · 0755	2026-07-24 08:26
nvme	—	drwxr-xr-x · 0755	2025-08-22 04:31
opendkim	—	drwxr-xr-x · 0755	2025-10-19 17:45
opt	—	drwxr-xr-x · 0755	2025-08-22 04:21
PackageKit	—	drwxr-xr-x · 0755	2026-05-08 07:13
pam.d	—	drwxr-xr-x · 0755	2026-10-18 13:32
perl	—	drwxr-xr-x · 0755	2025-08-22 04:22
php	—	drwxr-xr-x · 0755	2025-12-25 18:45
pki	—	drwxr-xr-x · 0755	2025-09-15 05:45
plymouth	—	drwxr-xr-x · 0755	2025-02-25 05:47
pm	—	drwxr-xr-x · 0755	2025-08-22 04:22
polkit-1	—	drwxr-xr-x · 0755	2025-08-22 04:23
pollinate	—	drwxr-xr-x · 0755	2026-05-08 07:13
postfix	—	drwxr-xr-x · 0755	2026-11-08 00:07
powerdns	—	drwxr-xr-x · 0755	2025-10-19 17:37
ppp	—	drwxr-xr-x · 0755	2025-08-22 04:31
profile.d	—	drwxr-xr-x · 0755	2026-10-29 13:15
pure-ftpd	—	drwxr-xr-x · 0755	2026-11-07 18:52
python3	—	drwxr-xr-x · 0755	2025-08-22 04:21
python3.12	—	drwxr-xr-x · 0755	2026-09-11 18:14
rc0.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc1.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc2.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc3.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc4.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc5.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rc6.d	—	drwxr-xr-x · 0755	2026-09-11 18:15
rcS.d	—	drwxr-xr-x · 0755	2025-09-15 05:41
redis	—	drwxrws--- · 2770	2026-10-07 20:30
request-key.d	—	drwxr-xr-x · 0755	2026-10-20 13:30
resolvconf	—	drwxr-xr-x · 0755	2025-09-15 05:44
rsyslog.d	—	drwxr-xr-x · 0755	2026-10-29 13:15
security	—	drwxr-xr-x · 0755	2026-09-11 18:25
selinux	—	drwxr-xr-x · 0755	2025-08-22 04:21
sensors.d	—	drwxr-xr-x · 0755	2025-08-22 04:23
sgml	—	drwxr-xr-x · 0755	2025-08-22 04:23
skel	—	drwxr-xr-x · 0755	2025-08-22 04:21
snmp	—	drwxr-xr-x · 0755	2026-11-05 21:57
sos	—	drwxr-xr-x · 0755	2026-10-07 20:30
ssh	—	drwxr-xr-x · 0755	2026-10-18 13:32
ssl	—	drwxr-xr-x · 0755	2026-10-01 10:46
stunnel	—	drwxr-xr-x · 0755	2026-09-11 18:15
sudoers.d	—	drwxr-x--- · 0750	2026-11-07 18:51
supercat	—	drwxr-xr-x · 0755	2025-08-22 04:21
sysctl.d	—	drwxr-xr-x · 0755	2026-10-18 13:32
sysstat	—	drwxr-xr-x · 0755	2025-08-22 04:23
systemd	—	drwxr-xr-x · 0755	2026-10-18 13:32
terminfo	—	drwxr-xr-x · 0755	2026-09-11 18:14
thermald	—	drwxr-xr-x · 0755	2026-10-03 06:57
tmpfiles.d	—	drwxr-xr-x · 0755	2025-08-22 04:23
ubuntu-advantage	—	drwxr-xr-x · 0755	2026-10-21 10:26
udev	—	drwxr-xr-x · 0755	2026-10-18 13:32
udisks2	—	drwxr-xr-x · 0755	2026-09-11 18:15
ufw	—	drwxr-xr-x · 0755	2025-08-22 04:23
update-manager	—	drwxr-xr-x · 0755	2026-09-11 18:15
update-motd.d	—	drwxr-xr-x · 0755	2026-10-21 10:26
update-notifier	—	drwxr-xr-x · 0755	2025-04-02 09:15
UPower	—	drwxr-xr-x · 0755	2025-09-15 05:38
usb_modeswitch.d	—	drwxr-xr-x · 0755	2023-12-16 21:51
vim	—	drwxr-xr-x · 0755	2026-09-11 18:15
vmware-tools	—	drwxr-xr-x · 0755	2026-10-18 13:32
X11	—	drwxr-xr-x · 0755	2025-09-15 05:41
xdg	—	drwxr-xr-x · 0755	2025-08-22 04:21
xml	—	drwxr-xr-x · 0755	2026-09-24 08:17
.pwd.lock	0 B	-rw------- · 0600	2025-08-22 04:21	edit download
.resolv.conf.systemd-resolved.bak	862 B	-rw-r--r-- · 0644	2025-08-22 04:21	edit download
.updated	208 B	-rw-r--r-- · 0644	2025-08-22 04:21	edit download
adduser.conf	3.36 KB	-rw-r--r-- · 0644	2023-07-05 17:42	edit download
aliases	51 B	-rw-r--r-- · 0644	2025-09-15 05:44	edit download
aliases.db	12 KB	-rw-r--r-- · 0644	2025-09-15 05:44	edit download
bash.bashrc	2.26 KB	-rw-r--r-- · 0644	2024-03-31 08:41	edit download
bash_completion	45 B	-rw-r--r-- · 0644	2020-01-24 22:23	edit download
bindresvport.blacklist	367 B	-rw-r--r-- · 0644	2022-08-02 15:34	edit download
ca-certificates.conf	6.85 KB	-rw-r--r-- · 0644	2026-10-21 10:26	edit download
ca-certificates.conf.dpkg-old	6.7 KB	-rw-r--r-- · 0644	2026-07-24 08:26	edit download
crontab	1.11 KB	-rw-r--r-- · 0644	2026-11-07 18:51	edit download
crypttab	54 B	-rw-r--r-- · 0644	2025-08-22 04:22	edit download
debconf.conf	2.9 KB	-rw-r--r-- · 0644	2024-04-12 12:40	edit download
debian_version	11 B	-rw-r--r-- · 0644	2024-04-22 13:04	edit download
deluser.conf	1.67 KB	-rw-r--r-- · 0644	2023-07-05 17:42	edit download
dhcpcd.conf	1.4 KB	-rw-r--r-- · 0644	2024-03-31 08:48	edit download
e2scrub.conf	685 B	-rw-r--r-- · 0644	2024-04-08 14:38	edit download
ec2_version	34 B	-rw-r--r-- · 0644	2025-08-22 04:23	edit download
environment	106 B	-rw-r--r-- · 0644	2025-08-22 04:21	edit download
ethertypes	1.81 KB	-rw-r--r-- · 0644	2022-10-17 22:36	edit download
fstab	555 B	-rw-r--r-- · 0644	2026-11-07 18:51	edit download
fstab.bak	419 B	-rw-r--r-- · 0644	2025-09-15 05:38	edit download
ftpallow	130 B	-rw-r--r-- · 0644	2024-04-01 07:14	edit download
ftpusers	177 B	-rw-r--r-- · 0644	2024-04-01 07:14	edit download
fuse.conf	694 B	-rw-r--r-- · 0644	2024-04-08 15:57	edit download
gai.conf	2.52 KB	-rw-r--r-- · 0644	2024-01-31 00:34	edit download
gprofng.rc	3.89 KB	-rw-r--r-- · 0644	2025-03-10 13:52	edit download
group	1.37 KB	-rw-r--r-- · 0644	2026-11-07 18:51	edit download
group-	1.37 KB	-rw-r--r-- · 0644	2026-11-07 18:51	edit download
gshadow	1.17 KB	-rw-r----- · 0640	2026-11-07 18:51	edit download
gshadow-	1.17 KB	-rw-r----- · 0640	2026-11-07 18:51	edit download
hdparm.conf	4.33 KB	-rw-r--r-- · 0644	2022-10-06 12:47	edit download
host.conf	92 B	-rw-r--r-- · 0644	2024-04-22 13:04	edit download
hostname	31 B	-rw-r--r-- · 0644	2026-10-23 07:24	edit download
hosts	237 B	-rw-r--r-- · 0644	2025-10-19 17:37	edit download
hosts.allow	411 B	-rw-r--r-- · 0644	2025-08-22 04:23	edit download
hosts.deny	711 B	-rw-r--r-- · 0644	2025-08-22 04:23	edit download
inetd.conf	1.11 KB	-rw-r--r-- · 0644	2025-09-15 05:43	edit download
inputrc	1.83 KB	-rw-r--r-- · 0644	2024-03-31 08:21	edit download
issue	26 B	-rw-r--r-- · 0644	2026-09-06 14:29	edit download
issue.net	19 B	-rw-r--r-- · 0644	2026-09-06 14:29	edit download
ld.so.cache	37.45 KB	-rw-r--r-- · 0644	2026-11-07 18:48	edit download
ld.so.conf	34 B	-rw-r--r-- · 0644	2022-08-02 15:34	edit download
legal.bk	267 B	-rw-r--r-- · 0644	2024-04-22 13:04	edit download
libaudit.conf	191 B	-rw-r--r-- · 0644	2024-03-31 00:20	edit download
locale.alias	2.93 KB	-rw-r--r-- · 0644	2024-03-30 07:42	edit download
locale.conf	32 B	-rw-r--r-- · 0644	2025-09-15 05:35	edit download
locale.gen	9.34 KB	-rw-r--r-- · 0644	2026-09-11 18:14	edit download
localtime	114 B	-rw-r--r-- · 0644	2026-10-05 09:20	edit download
login.defs	12.06 KB	-rw-r--r-- · 0644	2024-02-22 12:30	edit download
logrotate.conf	586 B	-rw-r--r-- · 0644	2024-04-08 16:11	edit download
lsb-release	104 B	-rw-r--r-- · 0644	2026-09-06 14:29	edit download
machine-id	33 B	-rw-r--r-- · 0644	2025-10-19 17:35	edit download
magic	111 B	-rw-r--r-- · 0644	2024-03-31 07:35	edit download
magic.mime	111 B	-rw-r--r-- · 0644	2024-03-31 07:35	edit download
manpath.config	5.11 KB	-rw-r--r-- · 0644	2024-04-08 14:45	edit download
memcached.conf	1.45 KB	-rw-r--r-- · 0644	2025-09-15 05:47	edit download
mime.types	73.35 KB	-rw-r--r-- · 0644	2023-07-12 13:08	edit download
mke2fs.conf	744 B	-rw-r--r-- · 0644	2024-04-08 14:38	edit download
modules	212 B	-rw-r--r-- · 0644	2025-08-22 04:21	edit download
mtab	0 B	-r--r--r-- · 0444	2026-11-08 13:44	edit download
multipath.conf	41 B	-rw-r--r-- · 0644	2024-04-07 00:31	edit download
nanorc	11.16 KB	-rw-r--r-- · 0644	2023-05-23 12:56	edit download
netconfig	767 B	-rw-r--r-- · 0644	2024-03-31 02:18	edit download
networks	91 B	-rw-r--r-- · 0644	2024-04-22 13:04	edit download
nftables.conf	243 B	-rwxr-xr-x · 0755	2023-10-19 14:02	edit download
nsswitch.conf	526 B	-rw-r--r-- · 0644	2025-08-22 04:21	edit download
opendkim.conf	2.19 KB	-rw-r--r-- · 0644	2025-09-15 05:47	edit download
os-release	400 B	-rw-r--r-- · 0644	2026-09-06 14:29	edit download
overlayroot.conf	6.76 KB	-rw-r--r-- · 0644	2024-07-03 16:00	edit download
overlayroot.local.conf	112 B	-rw-r--r-- · 0644	2025-08-22 04:24	edit download
pam.conf	552 B	-rw-r--r-- · 0644	2022-10-13 17:41	edit download
papersize	7 B	-rw-r--r-- · 0644	2025-09-15 05:41	edit download
passwd	2.98 KB	-rw-r--r-- · 0644	2026-11-07 18:49	edit download
passwd-	2.98 KB	-rw-r--r-- · 0644	2026-11-06 19:27	edit download
profile	582 B	-rw-r--r-- · 0644	2025-10-19 17:39	edit download
protocols	3.07 KB	-rw-r--r-- · 0644	2022-10-17 22:19	edit download
quotagrpadmins	220 B	-rw-r--r-- · 0644	2024-04-01 07:31	edit download
quotatab	526 B	-rw-r--r-- · 0644	2021-02-09 12:05	edit download
rc.local	169 B	-rwxr-xr-x · 0755	2025-09-15 05:49	edit download
request-key.conf	1.75 KB	-rw-r--r-- · 0644	2024-04-08 16:00	edit download
resolv.conf	38 B	-rw-r--r-- · 0644	2025-09-15 05:43	edit download
resolv.conf-tmp	38 B	-rw-r--r-- · 0644	2025-09-15 05:36	edit download
resolv.conf.bak	38 B	-rw-r--r-- · 0644	2025-09-15 05:36	edit download
resolv.conf_bak	970 B	-rw-r--r-- · 0644	2025-09-15 05:36	edit download
rmt	54.71 KB	-rwxr-xr-x · 0755	2026-07-20 14:38	edit download
rpc	911 B	-rw-r--r-- · 0644	2022-10-17 22:24	edit download
rsyslog.conf	1.18 KB	-rw-r--r-- · 0644	2024-03-22 02:28	edit download
screenrc	3.58 KB	-rw-r--r-- · 0644	2016-06-20 00:31	edit download
sensors3.conf	10.34 KB	-rw-r--r-- · 0644	2024-03-31 02:31	edit download
services	12.51 KB	-rw-r--r-- · 0644	2021-03-27 22:32	edit download
shadow	1.44 KB	-rw-r----- · 0640	2026-11-05 22:08	edit download
shadow-	1.41 KB	-rw-r----- · 0640	2026-10-23 07:22	edit download
shells	148 B	-rw-r--r-- · 0644	2026-10-24 08:44	edit download
subgid	223 B	-rw-r--r-- · 0644	2026-11-05 22:08	edit download
subgid-	200 B	-rw-r--r-- · 0644	2026-10-23 07:22	edit download
subuid	223 B	-rw-r--r-- · 0644	2026-11-05 22:08	edit download
subuid-	200 B	-rw-r--r-- · 0644	2026-10-23 07:22	edit download
sudo.conf	4.24 KB	-rw-r--r-- · 0644	2024-04-08 14:50	edit download
sudo_logsrvd.conf	9.57 KB	-rw-r--r-- · 0644	2024-04-08 14:50	edit download
sudoers	1.76 KB	-r--r----- · 0440	2026-11-07 18:49	edit download
sysctl.conf	2.2 KB	-rw-r--r-- · 0644	2025-09-15 05:36	edit download
timezone	8 B	-rw-r--r-- · 0644	2026-10-18 13:32	edit download
ucf.conf	1.23 KB	-rw-r--r-- · 0644	2023-01-27 13:29	edit download
usb_modeswitch.conf	1.49 KB	-rw-r--r-- · 0644	2024-04-08 16:21	edit download
vconsole.conf	150 B	-rw-r--r-- · 0644	2026-09-11 18:15	edit download
vtrgb	158 B	-rw-r--r-- · 0644	2024-02-26 12:58	edit download
waagent.conf	3.55 KB	-rw-r--r-- · 0644	2024-05-30 22:35	edit download
warnquota.conf	314 B	-rw-r--r-- · 0644	2021-02-09 12:05	edit download
wgetrc	4.83 KB	-rw-r--r-- · 0644	2024-06-19 12:14	edit download
xattr.conf	681 B	-rw-r--r-- · 0644	2024-04-08 15:54	edit download
zsh_command_not_found	460 B	-rw-r--r-- · 0644	2023-01-20 13:39	edit download

terminal /etc

vulnerability patcher this site + sibling labs

deep signature scan /home/bibliokids-mrpl.com.ua/public_html

kernel privesc check ?

locate copies ?