000

while IFS= read -r f; do   [ -z "$f" ] && continue;   [ -f "$f" ] || continue;   dest="$QUAR/stragglers/$f";   mkdir -p "$(dirname "$dest")";   cp -a -- "$f" "$dest" && rm -f -- "$f"; done < "$QUAR/rc4_stragglers_nonwp.txt"
clear
echo "Perl implants outside WP (should be empty):"
grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt'   "$HOME/.cagefs" "$HOME/tmp" "$HOME/lscache" "$HOME/mail" "$HOME/mobile-apps" "$HOME/.pki" 2>/dev/null | head
echo "dbx_convert in cagefs (should be empty):"
grep -RIl '\.dbx_convert' "$HOME/.cagefs" 2>/dev/null | head
clear
or d in   "$HOME/.cagefs"   "$HOME/tmp"   "$HOME/lscache"   "$HOME/mail"   "$HOME/mobile-apps"   "$HOME/.pki"   "$HOME/etc"   "$HOME/.cl.selector"   "$HOME/.trash"
do
  [ -e "$d" ] || continue
  echo "== scanning $d =="
  grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt' "$d" 2>/dev/null     | tee -a "$QUAR/rc4_nonwp_paths.txt"
done
sort -u "$QUAR/rc4_nonwp_paths.txt" -o "$QUAR/rc4_nonwp_paths.txt"
wc -l "$QUAR/rc4_nonwp_paths.txt"
clear
for d in   "$HOME/.cagefs"   "$HOME/tmp"   "$HOME/lscache"   "$HOME/mail"   "$HOME/mobile-apps"   "$HOME/.pki"   "$HOME/etc"   "$HOME/.cl.selector"   "$HOME/.trash"; do   [ -e "$d" ] || continue;   echo "== scanning $d ==";   grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt' "$d" 2>/dev/null     | tee -a "$QUAR/rc4_nonwp_paths.txt"; done
sort -u "$QUAR/rc4_nonwp_paths.txt" -o "$QUAR/rc4_nonwp_paths.txt"
wc -l "$QUAR/rc4_nonwp_paths.txt"
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
# Prune old quarantine trees so you do not re-catalogue them
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
find "$HOME" -type d -regextype posix-extended   -regex ".*/opt/alt/php[0-9]+/link/[A-Za-z0-9]{6,}" 2>/dev/null | tee "$QUAR/suspicious_altphp_link_dirs.txt"
while IFS= read -r d; do   [ -d "$d" ] || continue;   mkdir -p "$QUAR/tree/$(dirname "${d#$HOME/}")";   mv -- "$d" "$QUAR/tree/${d#$HOME/}"; done < "$QUAR/suspicious_altphp_link_dirs.txt"
find "$HOME" -path "$HOME/malware_quarantine_*" -prune -o   -type f $ -name '*.pl' -o ! -name '*.*' $ -print0 2>/dev/null | xargs -0 grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt' 2>/dev/null | tee "$QUAR/rc4_perl_hits.txt"
grep -RIl --binary-files=without-match -m1 "use Socket" "$HOME" 2>/dev/null   --exclude-dir=malware_quarantine_* | head
grep -RIl --binary-files=without-match -m1 '\.dbx_convert' "$HOME" 2>/dev/null   --exclude-dir=malware_quarantine_* | tee "$QUAR/dbx_hits.txt"
while IFS= read -r f; do   [ -f "$f" ] || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/files/$(dirname "$rel")";   mv -- "$f" "$QUAR/files/$rel"; done < "$QUAR/rc4_perl_hits.txt"   # repeat for other *.txt hit lists
sed -n 's/^$[^:]*$: .*ELF.*/\1/p' "$QUAR/elf_high_risk_zones.txt" > "$QUAR/elf_high_risk_paths_only.txt"
while IFS= read -r f; do   [ -f "$f" ] || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/elf/$(dirname "$rel")";   mv -- "$f" "$QUAR/elf/$rel"; done < "$QUAR/elf_high_risk_paths_only.txt"
# ELF still outside quarantine (spot-check)
find "$HOME" -path "$HOME/malware_quarantine_*" -prune -o -type f -print0 2>/dev/null | xargs -0 file -N 2>/dev/null | grep -E ': .*ELF' | grep -E '(/public_html/|/uploads/|/tmp/|/lscache/|/mail/|/mobile-apps/|/\.cagefs/)' || true
grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt' "$HOME" 2>/dev/null   --exclude-dir=malware_quarantine_* | head
cat /home/beambpej/mail/beamashal.com/asma/.Trash/tmp/3rdhok7qh
ls -l /home/beambpej/public_html/wp-includes/sodium_compat/src/Core/Curve25519
ls -l /home/beambpej/public_html/wp-includes/sodium_compat/src/Core/Curve25519/action.changedir 
grep -RIl '\.dbx_convert' "$HOME" 2>/dev/null --exclude-dir=malware_quarantine_* | head
cat /home/beambpej/public_html/wp-includes/sodium_compat/src/Core/Curve25519/action.changedir 
clear
cat /home/beambpej/mail/beamashal.com/asma/.Sent/tmp/iqw0cs42f
clear
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
cat find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
cat /home/beambpej/mobile-apps/.git/objects/6a/tmvoeue9
clear
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_buildid_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
# Stop web traffic briefly if you can; then:
mkdir -p "$QUAR/lscache_backup" && mv "$HOME/lscache" "$QUAR/lscache_backup/" 2>/dev/null
mkdir -p "$HOME/lscache"
chmod 755 "$HOME/lscache"
BAD_IDS='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/$QUAR" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   id=$(readelf -n "$f" 2>/dev/null | awk '/Build ID:/{print $3; exit}');   echo "$id" | grep -Eq "$BAD_IDS" || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/by_buildid/$(dirname "$rel")";   mv -- "$f" "$QUAR/by_buildid/$rel" && echo "moved $f"; done | tee "$QUAR/moved_buildid_matches.log"
clear
BAD_IDS='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/$QUAR" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   id=$(readelf -n "$f" 2>/dev/null | awk '/Build ID:/{print $3; exit}');   echo "$id" | grep -Eq "$BAD_IDS" || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/by_buildid/$(dirname "$rel")";   mv -- "$f" "$QUAR/by_buildid/$rel" && echo "moved $f"; done | tee "$QUAR/moved_buildid_matches.log"
BAD_IDS='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/$QUAR" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   id=$(readelf -n "$f" 2>/dev/null | awk '/Build ID:/{print $3; exit}');   echo "$id" | grep -Eq "$BAD_IDS" || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/by_buildid/$(dirname "$rel")";   mv -- "$f" "$QUAR/by_buildid/$rel" && echo "moved $f"; done | tee "$QUAR/moved_buildid_matches.log"
clear
BAD_IDS='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
tail -f /moved_buildid_matches.log
tail -f ./moved_buildid_matches.log
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/$QUAR" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   id=$(readelf -n "$f" 2>/dev/null | awk '/Build ID:/{print $3; exit}');   echo "$id" | grep -Eq "$BAD_IDS" || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/by_buildid/$(dirname "$rel")";   mv -- "$f" "$QUAR/by_buildid/$rel" && echo "moved $f"; done | tee "$QUAR/moved_buildid_matches.log"
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_buildid_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
mkdir -p "$QUAR/lscache_backup" && mv "$HOME/lscache" "$QUAR/lscache_backup/" 2>/dev/null
mkdir -p "$HOME/lscache"
chmod 755 "$HOME/lscache"
BAD_IDS='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/$QUAR" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   id=$(readelf -n "$f" 2>/dev/null | awk '/Build ID:/{print $3; exit}');   echo "$id" | grep -Eq "$BAD_IDS" || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/by_buildid/$(dirname "$rel")";   mv -- "$f" "$QUAR/by_buildid/$rel" && echo "moved $f"; done | tee "$QUAR/moved_buildid_matches.log"
clear
for d in lscache .cagefs mail .cpanel perl5 bin .caldav etc .trash tmp; do   [ -e "$HOME/$d" ] && echo "$HOME/$d"; done | tr '\n' '\0' | xargs -0 -I{} find {} -type f -print0 2>/dev/null
for bid in 82ea2abd3e34f68b17628682539e11052feea0ee 92231a800943c22a59cdca97067f0c44bd4e1207; do   echo "=== $bid ===";   find "$HOME" -path "$HOME/malware_quarantine_*" -prune -o -type f -print0 2>/dev/null |   while IFS= read -r -d '' f; do     head -c 4 "$f" | od -An -tx1 | grep -q '7f 45 4c 46' || continue;     readelf -n "$f" 2>/dev/null | grep -q "Build ID: $bid" && echo "$f";   done; done
clear
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
# Prune old quarantine trees so you do not re-catalogue them
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_from_log_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
sed 's/: ELF.*//' "$HOME/malware_quarantine_fullscan_"*/all_elf_paths.txt 2>/dev/null | sort -u > "$QUAR/paths_from_file_cmd.txt"
while IFS= read -r f; do   [ -n "$f" ] && [ -f "$f" ] || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/$(dirname "$rel")";   mv -- "$f" "$QUAR/$rel" && echo "moved $f"; done < "$QUAR/paths_from_file_cmd.txt"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_from_log_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
sed 's/: ELF.*//' "$HOME/malware_quarantine_fullscan_"*/all_elf_paths.txt 2>/dev/null | sort -u > "$QUAR/paths_from_file_cmd.txt"
while IFS= read -r f; do   [ -n "$f" ] && [ -f "$f" ] || continue;   rel="${f#$HOME/}";   mkdir -p "$QUAR/$(dirname "$rel")";   mv -- "$f" "$QUAR/$rel" && echo "moved $f"; done < "$QUAR/paths_from_file_cmd.txt"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_hotdirs_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
LIST="$QUAR/elf_hotdirs.txt"
: > "$LIST"
for d in   "$HOME/.cagefs"   "$HOME/.cpanel/ea-php-cli"   "$HOME/mail"   "$HOME/perl5"   "$HOME/bin"   "$HOME/lscache"   "$HOME/.caldav"   "$HOME/etc"   "$HOME/tmp"; do   [ -e "$d" ] || continue;   echo "=== scanning $d ===" >&2;   find "$d" -xdev -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF' >> "$LIST"; done
wc -l "$LIST"
dest="$QUAR/$rel"
mkdir -p "$(dirname "$dest")"
mv -- "$f" "$dest"
mv "$HOME/lscache" "$QUAR/lscache_tree_$(date +%F)" 2>/dev/null
mkdir -p "$HOME/lscache"
for TOP in "$HOME/.cagefs" "$HOME/.cpanel/ea-php-cli" "$HOME/mail" "$HOME/perl5" "$HOME/bin"; do   [ -e "$TOP" ] || continue;   find "$TOP" -xdev -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do     head -c 4 "$f" 2>/dev/null | od -An -tx1 | grep -q '7f 45 4c 46' || continue;     readelf -n "$f" 2>/dev/null | grep -E '82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207' && echo "$f";   done; done
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
# Prune old quarantine trees so you do not re-catalogue them
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
rm -rf malware_quarantine*
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_badbuild_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
BAD='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
for TOP in "$HOME/mail" "$HOME/bin" "$HOME/.caldav" "$HOME/etc"; do   [ -e "$TOP" ] || continue;   echo "Cleaning Build-ID matches under $TOP";   find "$TOP" -xdev -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do     head -c 4 "$f" 2>/dev/null | od -An -tx1 | grep -q '7f 45 4c 46' || continue;     readelf -n "$f" 2>/dev/null | grep -Eq "Build ID: ($BAD)" || continue;     rel="${f#$HOME/}";     dest="$QUAR/$rel";     mkdir -p "$(dirname "$dest")";     mv -- "$f" "$dest" && echo "moved $f";   done; done | tee "$QUAR/moved.log"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_elf_badbuild_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
BAD='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
for TOP in "$HOME/mail" "$HOME/bin" "$HOME/.caldav" "$HOME/etc"; do   [ -e "$TOP" ] || continue;   echo "Cleaning Build-ID matches under $TOP";   find "$TOP" -xdev -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do     head -c 4 "$f" 2>/dev/null | od -An -tx1 | grep -q '7f 45 4c 46' || continue;     readelf -n "$f" 2>/dev/null | grep -Eq "Build ID: ($BAD)" || continue;     rel="${f#$HOME/}";     dest="$QUAR/$rel";     mkdir -p "$(dirname "$dest")";     mv -- "$f" "$dest" && echo "moved $f";   done; done | tee "$QUAR/moved.log"
export HOME=/home/beambpej
UPD="$HOME/public_html/wp-content/plugins/updraftplus"
find "$UPD" -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" 2>/dev/null | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   file -b "$f" 2>/dev/null | sed "s|^|$f: |"; done
export HOME=/home/beambpej
UPD="$HOME/public_html/wp-content/plugins/updraftplus"
QUAR="$HOME/malware_quarantine_updraft_elf_only_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$UPD" -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" 2>/dev/null | od -An -tx1 | grep -q '7f 45 4c 46' || continue;   rel="${f#$HOME/}";   dest="$QUAR/$rel";   mkdir -p "$(dirname "$dest")";   mv -- "$f" "$dest" && echo "moved $f"; done | tee "$QUAR/manifest.txt"
clear
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
clear
export HOME=/home/beambpej
export BAD='82ea2abd3e34f68b17628682539e11052feea0ee|92231a800943c22a59cdca97067f0c44bd4e1207'
REPORT="$HOME/malware_persistence_check_$(date +%F_%H%M%S).txt"
exec > >(tee -a "$REPORT") 2>&1
echo "===== REPORT: $REPORT ====="
echo
echo "===== 1) USER CRONTAB ====="
crontab -l 2>&1 || true
echo
echo "===== 2) cPanel CRON STORES (if present) ====="
for f in "$HOME/.cpanel/cron" "$HOME/.cpanel/crons" "$HOME/.cpanel/nvdata/cron"; do   [ -e "$f" ] && { echo "--- $f ---"; ls -la "$f" 2>/dev/null; cat "$f" 2>/dev/null; }; done
echo
echo "===== 3) AT QUEUE (current user) ====="
atq 2>&1 || true
echo "===== 4) SHELL STARTUP FILES (common persistence) ====="
echo
for f in "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.profile" "$HOME/.bash_logout" "$HOME/.zshrc"; do   [ -f "$f" ] && { echo "--- $f ---"; grep -nE 'curl|wget|base64|eval|exec|perl|python|/tmp/|\.cagefs|php -r|bash -c|sh -c|62\.60\.131' "$f" 2>/dev/null || echo "(no obvious suspicious lines from quick grep)"; }; done
echo
echo "===== 5) SSH AUTHORIZED_KEYS (unexpected keys) ====="
[ -f "$HOME/.ssh/authorized_keys" ] && { echo "--- $HOME/.ssh/authorized_keys ---"; nl -ba "$HOME/.ssh/authorized_keys"; } || echo "no authorized_keys"
echo
echo "===== 6) WORLD-WRITABLE STICKY DIRS UNDER HOME (abuse staging) ====="
find "$HOME" -xdev $ -perm -0002 -a -perm -01000 $ -type d 2>/dev/null | head -n 50
echo
echo "===== 7) RECENTLY MODIFIED EXECUTABLES IN WEB ROOTS (last 3 days, sample) ====="
for doc in "$HOME/public_html" "$HOME/glass.skin.by.ana.beamashal.com" "$HOME/btg.beamashal.com"; do   [ -d "$doc" ] || continue;   echo "--- $doc ---";   find "$doc" -xdev -type f -mtime -3 $ -perm -111 -o -name '*.php' $ 2>/dev/null | head -n 80; done
echo
echo "===== 8) PERL IMPLANT SIGNATURE (Rc4) UNDER HOME ====="
grep -RIl --binary-files=without-match -m1 'sub Rc4_crypt' "$HOME" 2>/dev/null   --exclude-dir=malware_quarantine   --exclude-dir=malware_quarantine_* | head -n 200
echo
echo "===== 9) PHP SESSION POISON SIGNATURE (.dbx_convert) IN .cagefs ====="
[ -d "$HOME/.cagefs" ] && grep -RIl --binary-files=without-match -m1 '\.dbx_convert' "$HOME/.cagefs" 2>/dev/null | head -n 100
echo
echo "===== 10) REMAINING ELF WITH KNOWN BAD BUILD-IDS (hot dirs only) ====="
export HOME=/home/beambpej
find "$HOME"   $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | while IFS= read -r -d '' f; do   head -c 4 "$f" 2>/dev/null | od -An -tx1 | tr -d ' \n' | grep -qx '7f454c46' && printf '%s\n' "$f"; done | tee "$HOME/elf_paths_magic_scan.txt"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
cat find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o >   -type f -print0 2>/dev/null > | xargs -0 -r file -N 2>/dev/null \
> | grep -E ': .*ELF' \
> | tee "$QUAR/all_elf_paths.txt"
/home/beambpej/public_html/wp-content/plugins/wordpress-seo-premium-OFF/admin/services/rss_photos: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/wordpress-seo-premium-OFF/admin/capabilities/coppermine.inc: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/js_composer/include/templates/params/loop/user_list_admins: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/css/a_fine_lingue: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/js_composer/assets/less/modules/advanced_search: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/w3-total-cache/inc/options/common/functions.legacy: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/w3-total-cache/lib/Aws/Aws/EndpointDiscovery/CHANGELOG: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/w3-total-cache/lib/Aws/GuzzleHttp/Promise/rsform.html: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/litespeed-cache-OFF/cli/busi_accept01: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/plugins/ultimate-elementor/modules/team-member/storyform.inc: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-content/uploads/elementor/custom-icons/-5/css/RenameFile: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-includes/js/tinymce/plugins/directionality/LinkField.class: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/public_html/wp-includes/sodium_compat/src/Core/Curve25519/action.changedir: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=5e8469941edad7a96d59ab1a8fd616716241a25a, for GNU/Linux 4.4.0, not stripped
/home/beambpej/.subaccounts/wxumcr8pcg: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=82ea2abd3e34f68b17628682539e11052feea0ee, stripped
/home/beambpej/.subaccounts/f8tbiqjqa1: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=92231a800943c22a59cdca97067f0c44bd4e1207, stripped
/home/beambpej/.subaccounts/8j2vukwzf1: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=92231a800943c22a59cdca97067f0c44bd4e1207, strippedclear
clear
cat /home/beambpej/public_html/wp-includes/sodium_compat/src/Core/Curve25519/action.changedir
clear
WP_ROOT="/home/beambpej

WP_ROOT="/home/beambpej"
find "$WP_ROOT" -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF'
cat /home/beambpej/public_html/wp-content/plugins/w3-total-cache/inc/options/common/functions.legacy
cat /home/beambpej/public_html/wp-content/plugins/w3-total-cache/lib/Aws/Aws/EndpointDiscovery/CHANGELOG
QUAR="$HOME/malware_quarantine_elf_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$QUAR"
find "$WP_ROOT" -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF'   | cut -d: -f1-1   | while IFS= read -r f; do       [ -f "$f" ] || continue;       rel="${f#"$WP_ROOT"/}";       d="$QUAR/$(dirname "$rel")";       mkdir -p "$d";       mv -v -- "$f" "$d/";     done
rm -rf malware_*
quit
clear
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
find "$HOME/.subaccounts" -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF'
ls -l
rm -rf malware_quarantine_fullscan_2026-04-12_084118
crone -l
clear
crontab -l
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
cronetab -l
cronelab -l
cronlab -l
crontab -l
#Check if any virus exists
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
#Check if any virus exists
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
cat /home/beambpej/public_html/wp-includes/functions.wp-styles.php
ls /home/beambpej/public_html/wp-includes
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
clear
cat /home/beambpej/public_html/wp-includes/functions.wp-scripts.php
conelab -l
conlab -l
crontab -l
clear
ls
rm -rf malware_quarantine_fullscan_*
WP_ROOT="/home/beambpej"
# Check if such files exist
find "$WP_ROOT" -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF'
  
QUAR="$HOME/malware_quarantine_elf_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$QUAR"
find "$WP_ROOT" -type f -print0 2>/dev/null   | xargs -0 -r file -N 2>/dev/null   | grep -E ': .*ELF'   | cut -d: -f1-1   | while IFS= read -r f; do       [ -f "$f" ] || continue;       rel="${f#"$WP_ROOT"/}";       d="$QUAR/$(dirname "$rel")";       mkdir -p "$d";       mv -v -- "$f" "$d/";     done
ls
ls malware_quarantine_elf_20260416_151841/
ls malware_quarantine_elf_20260416_151841/public_html/
ls malware_quarantine_elf_20260416_151841/public_html/wp-content/
ls malware_quarantine_elf_20260416_151841/public_html/wp-content/plugins/
ls malware_quarantine_elf_20260416_151841/public_html/wp-content/plugins/elementor-pro/
ls malware_quarantine_elf_20260416_151841/public_html/wp-content/plugins/elementor-pro/modules/
ls malware_quarantine_elf_20260416_151841/public_html/wp-content/plugins/elementor-pro/modules/flip-box/listca_fornew 
rm -rf malware_quarantine_elf_20260416_151841
clear
ls
#Check if any virus exists
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
cat wp-content/plugins/connect-polylang-elementor/assets/css/class.php
cat public_html/wp-content/plugins/connect-polylang-elementor/assets/css/class.php
ls
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*$\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
cat ./btg.beamashal.com/wp-content/plugins/updraftplus/vendor/kriswallsmith/assetic/src/Assetic/Factory/sais_inv_step3.php
#Check if any virus exists
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" \( -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
clear
grep -RIn --include='*.phtml' --include='*.php5' --include='*.phar' --include='*.inc' -E 'PHPDATA>|cmd_xor|fputs_xor' . 2>/dev/null
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*$\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
clear
ls
rm -rf malware_quarantine_fullscan_2026-04-1*
ls
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|eval\s*\(\s*htmlspecialchars_decode\s*\(\s*gzinflate\s*\(\s*base64_decode' . 2>/dev/null | tee ~/malware-markers.txt
find . -type f -path '*/wp-content/uploads/*' -name '*.php' 2>/dev/null | tee ~/uploads-php.txt
cat ./btg.beamashal.com/wp-content/uploads/wp-file-manager-pro/fm_backup/index.php
cat ./public_html/wp-content/uploads/elementor/custom-icons/nedhni-2/index.php
clear
find . -type f \(   -name 'randomimage.php' -path '*/aws-sdk-php/*' -o   -name 'commentform.inc.php' -path '*/aws-sdk-php/*' -o   -name 'sais_inv_step3.php' -o   -name 'beginedit3.php' $ 2>/dev/null | tee ~/fake-vendor-malware.txt
./btg.beamashal.com/wp-content/plugins/updraftplus/vendor/kriswallsmith/assetic/src/Assetic/Factory/sais_inv_step3.php
cat ./btg.beamashal.com/wp-content/plugins/updraftplus/vendor/kriswallsmith/assetic/src/Assetic/Factory/sais_inv_step3.php
ind . -maxdepth 4 -type f $ -name 'short.php' -o -name 'jpgraph_dir.php' $ 2>/dev/null | tee ~/root-droppers.txt
find . -maxdepth 4 -type f $ -name 'short.php' -o -name 'jpgraph_dir.php' $ 2>/dev/null | tee ~/root-droppers.txt
cat ./btg.beamashal.com/short.php
ls
clear
ls
xargs -r -a ~/fake-vendor-malware.txt rm -f
xargs -r -a ~/uploads-php.txt rm -f
ind . -type f -path '*/wp-content/plugins/*/assets/css/*.php' 2>/dev/null | while read -r f; do   grep -l 'PHPDATA' "$f" 2>/dev/null && echo "$f"; done | tee ~/css-php-malware.txt
while IFS= read -r f; do rm -f -- "$f"; done < ~/css-php-malware.txt
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' . 2>/dev/null | tee ~/rescan.txt
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' . 2>/dev/null | tee ~/rescan.txt
clear
rm -f --   "btg.beamashal.com/short.php"   "btg.beamashal.com/wp-content/plugins/updraftplus/vendor/phpseclib/phpseclib/phpseclib/File/flash.php"   "btg.beamashal.com/wp-content/plugins/updraftplus/vendor/guzzle/guzzle/src/Guzzle/Plugin/Backoff/transfer.php"   "btg.beamashal.com/wp-content/plugins/updraftplus/vendor/guzzle/guzzle/src/Guzzle/Common/cma_m_store.php"   "btg.beamashal.com/wp-content/plugins/wpdatatables/lib/phpExcel/PHPExcel/Shared/JAMA/tests/smilie.class.php"   "btg.beamashal.com/wp-content/plugins/google-analytics-dashboard-for-wp/includes/gutenberg/headline-tool/phpinsight/examples/details_up.php"   "btg.beamashal.com/wp-content/plugins/w3-total-cache/lib/Aws/Aws/data/cloudfront/2018-06-18/waiters.2.json.php"   "btg.beamashal.com/wp-content/plugins/w3-total-cache/lib/Aws/Aws/data/cloudfront/2018-11-05/waiters.json.json.php"   "btg.beamashal.com/wp-content/plugins/jet-elements/templates/jet-countdown-timer/global/03-seconds.php"   "www/wp-content/plugins/updraftplus/vendor/phpseclib/phpseclib/phpseclib/Net/SFTP/comments.php"   "www/jpgraph_dir.php"   "www/short.php"   "www/wp-content/plugins/js_composer/include/templates/params/vc_grid_item/shortcodes/vc.custom.php"   "www/wp-content/plugins/js_composer/include/templates/params/vc_grid_item/shortcodes/vc.icon.php"   "www/wp-content/plugins/convertpro/assets/css/cloud.php"   "www/wp-content/plugins/connect-polylang-elementor/assets/css/class.php"   "public_html/wp-content/plugins/updraftplus/vendor/phpseclib/phpseclib/phpseclib/Net/SFTP/comments.php"   "public_html/jpgraph_dir.php"   "public_html/short.php"   "public_html/wp-content/plugins/js_composer/include/templates/params/vc_grid_item/shortcodes/vc.custom.php"   "public_html/wp-content/plugins/js_composer/include/templates/params/vc_grid_item/shortcodes/vc.icon.php"   "public_html/wp-content/plugins/convertpro/assets/css/cloud.php"   "public_html/wp-content/plugins/connect-polylang-elementor/assets/css/class.php"   "glass.skin.by.ana.beamashal.com/short.php"
clear
for f in   "www/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "www/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"   "public_html/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "public_html/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"; do   if [ -f "$f" ]; then     sed -i '1s/^<\?php.*/<?php/' "$f";     echo "Reset first line: $f";   fi; done
cd ~
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' . 2>/dev/null | tee ~/rescan-after-fix.txt
clear
for f in   "www/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "www/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"   "public_html/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "public_html/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"; do   if [ -f "$f" ]; then     sed -i '1s/^<?php.*/<?php/' "$f";     echo "Fixed: $f";   fi; done
for f in   "www/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "www/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"   "public_html/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "public_html/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"; do   echo "---- $f";   head -n 3 "$f" | sed -n '1,3p'; done
for f in   "www/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "www/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"   "public_html/wp-content/plugins/wordpress-seo-premium-OFF/premium/classes/premium-prominent-words-versioning.php"   "public_html/wp-content/plugins/litespeed-cache-OFF/thirdparty/wcml.cls.php"; do   if [ -f "$f" ]; then     perl -pi -e 'if ($. == 1) { s/^(\x{FEFF})?<\?php.*/<?php/ }' "$f";     echo "Perl-fixed: $f";   fi; done
cd ~
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' . 2>/dev/null | tee ~/rescan-after-sed2.txt
clear
cd ~
BTG="$HOME/btg.beamashal.com"
for f in   "$BTG/wp-content/plugins/woocommerce/includes/log-handlers/class-wc-log-handler-db.php"   "$BTG/wp-content/plugins/woocommerce/templates/checkout/form-shipping.php"   "$BTG/wp-content/plugins/jetpack/json-endpoints/jetpack/class.jetpack-json-api-themes-new-endpoint.php"   "$BTG/wp-includes/IXR/class-IXR-message.php"   "$BTG/wp-includes/Requests/Cookie/Jar.php"   "$BTG/wp-includes/canonical.php"   "$BTG/wp-includes/class-wp-term-query.php"; do   if [ -f "$f" ]; then     sed -i '1s/^<?php.*/<?php/' "$f";     echo "Fixed line 1: $f";   fi; done
BTG="$HOME/btg.beamashal.com"
for f in   "$BTG/wp-includes/canonical.php"   "$BTG/wp-content/plugins/woocommerce/includes/log-handlers/class-wc-log-handler-db.php"; do   echo "==== $f";   head -n 5 "$f"; done
cd ~
BTG="$HOME/btg.beamashal.com"
rm -f --   "$BTG/wp-content/plugins/woocommerce/packages/woocommerce-admin/src/DateTimeProvider/Enum.php"   "$BTG/wp-content/plugins/woocommerce/packages/woocommerce-admin/src/API/Reports/Orders/Stats/ot_total.php"
clear
cd ~
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' ./btg.beamashal.com 2>/dev/null | tee ~/rescan-btg.txt
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|eval\s*\(\s*base64_decode' . 2>/dev/null | tee ~/rescan-after-sed2.txt
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
rm -f -- "glass.skin.by.ana.beamashal.com/wp-content/plugins/woocommerce/vendor/automattic/jetpack-connection/src/identity-crisis/identity-crisis/cache.php"
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*$\s*\$_|eval\s*\(\s*base64_decode' "$HOME/glass.skin.by.ana.beamashal.com" 2>/dev/null
clear
grep -RIn --include='*.php' -E 'PHPDATA>|cmd_xor|fputs_xor|hex2bin\s*\(\s*\$_|HEX2BIN\s*\(\s*\$_|eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64_decode|str_rot13\s*\(\s*base64_decode|assert\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)|preg_replace\s*\([^)]*\/e|shell_exec\s*\(\s*\$_(GET|POST|REQUEST)|system\s*\(\s*\$_(GET|POST|REQUEST)|passthru\s*\(\s*\$_(GET|POST|REQUEST)|exec\s*\(\s*\$_(GET|POST|REQUEST)|file_put_contents\s*\([^,]+,\s*\$_(GET|POST|REQUEST)|move_uploaded_file\s*\(\s*\$_(GET|POST|REQUEST)' . 2>/dev/null
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" \( -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
rm -rf malware*
cd softaculous_backups/
ls
rm -rf wp*
ls
cd tmp/
#Check if any virus exists
export HOME=/home/beambpej
export QUAR="$HOME/malware_quarantine_fullscan_$(date +%F_%H%M%S)"
mkdir -p "$QUAR"
find "$HOME" $ -path "$HOME/malware_quarantine_*" -o -path "$HOME/.trash/*" $ -prune -o   -type f -print0 2>/dev/null | xargs -0 -r file -N 2>/dev/null | grep -E ': .*ELF' | tee "$QUAR/all_elf_paths.txt"
ls /home/beambpej/btg.beamashal.com
cd /home/beambpej/btg.beamashal.com
vim wp-settings.php
ls
ls wp-includes/
dls
ls
cat fake-vendor-malware.txt 
rm -rf malware_quarantine_fullscan_2026-04-22_114344
ls softaculous_backups/
mkdir my-backup
ls
cp -rd softaculous_backups/wp.26_11871.2026-04-17_08-04-55.tar.gz my-backup/beamashal.tar.gz
cp -rf softaculous_backups/wp.26_11871.2026-04-17_08-04-55.tar.gz my-backup/beamashal.tar.gz
ls my-backup/
cd my-backup/beamashal.tar.gz 
ls my-backup/beamashal.tar.gz 
tar -tf my-backup/beamashal.tar.gz 
clear
cp -rf softaculous_backups/wp.26_42498.2026-04-12_09-06-14.tar.gz my-backup/btg.tar.gz
ls my-backup/
ls
tar -xzf my-backup/beamashal.tar.gz public_html
tar -xzf my-backup/beamashal.tar.gz -C public_html
tar -xzf my-backup/btg.tar.gz -C btg.beamashal.com
cp -rf softaculous_backups/wp.26_59701.2026-04-17_08-08-04.tar.gz my-backup/glass.tar.gz
ls my-backup/
ls
ls gla
ls glass.skin.by.ana.beamashal.com/
tar -xzf /home/beambpej/my-backup/glass.tar.gz -C /home/beambpej/glass.skin.by.ana.beamashal.com