<?php
include "core.php";
head();
?>
				<section role="main" class="content-body">
					<header class="page-header">
						<h2>Malware Scanner</h2>
					
						<div class="right-wrapper pull-right">
							<ol class="breadcrumbs">
								<li>
									<a href="dashboard">
										<i class="fa fa-home"></i>
									</a>
								</li>
                                <li><span>Malware Scanner &nbsp;&nbsp;&nbsp;</span></li>
							</ol>
						</div>
					</header>

					<!-- start: page -->
					<div class="row">
						<div class="col-md-12">
							<section class="panel">
								<header class="panel-heading">
									<div class="panel-actions">
										<a href="#" class="fa fa-caret-down"></a>
										<a href="#" class="fa fa-times"></a>
									</div>

									<h2 class="panel-title">Malware Scanner</h2>
									<p class="panel-subtitle">Scanning your site for anything that shouldn’t be there - Malware, Harmful Code, etc. </p>
								</header>
								<div class="panel-body">

<div class="col-md-12">
<div class="alert alert-info">
    <button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button>
    <i class="fa fa-info-circle"></i><strong> Information</strong>
    <hr class="message-inner-separator">
<p>
    There is a chance of false-positive results, please analyze the results and verify them. Sometimes the scanning process could take more time according to the files on your host.
</p>
</div>
</div>
                                    
                                    
					<center>
					<a href="malware-scanner" class="btn btn-primary" title="The normal scan scans all files with the simple scan engine"><i class="fa fa-search"></i> Run Normal Scan</a> 
					<a href="?deep_scan=1" class="btn btn-danger" title="The deep scan scans all files with the heaviest scan engine, but could show many false-positive threats."><i class="fa fa-search"></i> Run Deep Scan</a> 
                    <a href="#settings" class="mb-xs mt-xs mr-xs modal-with-zoom-anim btn btn-default"><i class="fa fa-cogs"></i> Settings</a>
					</center><br />
                                    
<div id="settings" class="zoom-anim-dialog modal-block modal-header-color modal-block-danger mfp-hide">
                                 <form class="form-horizontal form-bordered" action="" method="post">
										<section class="panel">
											<header class="panel-heading">
												<h2 class="panel-title">Details</h2>
											</header>
											<div class="panel-body">
<?php
$table = $prefix . 'malwarescanner-settings';
$query = mysqli_query($connect, "SELECT * FROM `$table`");
$srow  = mysqli_fetch_array($query);
?>
                                                        <label class="col-sm-3 control-label">Scan Directory: </label>
														<div class="col-sm-9">
															<input type="text" name="scandir" class="form-control" value="<?php
echo $srow['scan-dir'];
?>" /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label">File Extensions Scanned:</label>
														<div class="col-sm-9">
                                                            <textarea class="form-control" name="extensions"><?php
echo $srow['file-extensions'];
?></textarea>
                                                            (Separate the file extensions with <b>"|"</b>)<br /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label">Ignored directories and files: </label>
														<div class="col-sm-9">
															<textarea class="form-control" name="ignored"><?php
echo $srow['ignored-dirs'];
?></textarea>
                                                            (Separate the ignored directories and files with <b>"|"</b>)<br /><br />
														</div>
                                                
<?php
if (isset($_POST['save-settings'])) {
    $scandir    = $_POST['scandir'];
    $extensions = $_POST['extensions'];
    $ignored    = $_POST['ignored'];
    $table      = $prefix . 'malwarescanner-settings';
    $update     = mysqli_query($connect, "UPDATE `$table` SET `scan-dir`='$scandir', `file-extensions`='$extensions', `ignored-dirs`='$ignored'");
    echo '<meta http-equiv="refresh" content="0;url=malware-scanner">';
}
?>
											</div>
											<footer class="panel-footer">
												<div class="row">
													<div class="row">
													<div class="col-md-8 text-left">
												        &nbsp;&nbsp; <input type="submit" name="save-settings" class="btn btn-primary" value="Save">
													</div>
                                                    <div class="col-md-4 text-right">
														<button class="btn btn-default modal-dismiss">Close</button> &nbsp;&nbsp;
													</div>
												</div>
												</div>
											</footer>
										</section>
                                </form>
				         </div>

<?php
@set_time_limit(360);
ini_set('memory_limit', '256M');

$fileExt    = $srow['file-extensions']; // File extensions
$ignoreDirs = 'php-encoder.php|site-info.php|whois.php|security-check.php|functions.inc.php|step1.php|step4.php|' . $srow['ignored-dirs']; // Directories & Files to ignore
$directory  = $srow['scan-dir']; // Directory to scan

$count         = 0;
$total_results = 0;

function HumanReadableFilesize($file)
{
    $size  = filesize($file);
    $mod   = 1024;
    $units = explode(' ', 'B KB MB GB TB PB');
    for ($i = 0; $size > $mod; $i++) {
        $size /= $mod;
    }
    return round($size, 2) . ' ' . $units[$i];
}

$Strings = 'r0nin|m0rtix|iskorpitx|upl0ad|r57shell|c99shell|shellbot|phpshell|void\.ru|';
$Strings .= 'phpremoteview|directmail|bash_history|multiviews|cwings|vandal|bitchx|';
$Strings .= 'eggdrop|guardservices|psybnc|dalnet|undernet|vulnscan|spymeta|raslan58|';
$Strings .= 'Webshell|str_rot13|FilesMan|FilesTools|Web Shell|ifrm|bckdrprm|';
$Strings .= 'hackmeplz|wrgggthhd|WSOsetcookie|Hmei7|Inbox Mass Mailer|HackTeam|Hackeado|';
$Strings .= 'Janissaries|Miyachung|ccteam|Adminer|OOO000000|$GLOBALS|findsysfolder|';
$Strings .= 'makeret\.ru|c0d3d by|C0de For|Perl Auto Rooter Perl Script|curl_multi_exec|curl_exec|';
$Strings .= 'create_function|b374k';

$DeepSearchStrings = 'eval|base64_decode|gzdecode|gzdeflate|';
$DeepSearchStrings .= 'gzuncompress|gzcompress|readgzfile|zlib_decode|zlib_encode|';
$DeepSearchStrings .= 'gzfile|gzget|gzpassthru|iframe|strrev|lzw_decompress|strtr|';
$DeepSearchStrings .= 'exec|passthru|shell_exec|system|proc_|popen|proc_open|bruteforce|brute force|';
$DeepSearchStrings .= 'system|edoced_46esab';

$Patterns = array(
    array(
        'preg_replace\s*\(\s*[\"\']\s*(\W)(?-s).*\1[imsxADSUXJu\s]*e[imsxADSUXJu\s]*[\"\'].*\)', // [0] = RegEx search pattern
        'PHP: preg_replace Eval', // [1] = Name / Title
        'Detected preg_replace function that evaluates (executes) matched code. ' . 'This means if PHP code is passed it will be executed.', // [2] = description
        'Part example code from http://sucuri.net/malware/backdoor-phppreg_replaceeval'
    ), // [3] = More Information link
    array(
        'c999*sh_surl',
        'Backdoor: PHP:C99',
        'Detected the "C99 Shell"? Backdoor that allows attackers to manage (and ' . 'reinfect) your site remotely. It is often used as part of a ' . 'compromise to maintain access to the hacked sites.',
        'http://sucuri.net/malware/backdoor-phpc99045'
    ),
    array(
        'preg_match\s*\(\s*\"\s*/\s*bot\s*/\s*\"',
        'Backdoor: PHP:R57',
        'Detected the "R57 Shell"? Backdoor that allows attackers to access, modify and ' . 'reinfect your site. It is often hidden in the filesystem and hard to ' . 'find without access to the server or logs.',
        'http://sucuri.net/malware/backdoor-phpr5701'
    ),
    array(
        'eval[\s/\*\#]*\(stripslashes[\s/\*\#]*\([\s/\*\#]*\$_(REQUEST|POST|GET)\s*\[\s*\\\s*[\'\"]\s*asc\s*\\\s*[\'\"]',
        'Backdoor: PHP:GENERIC',
        'Detected a generic backdoor that allows attackers to upload files, delete ' . 'files, access, modify and/or reinfect your site. It is often hidden ' . 'in the filesystem and hard to find without access to the server or ' . 'logs. It also includes uploadify scripts and similars that offer ' . 'upload options without security. ',
        'http://sucuri.net/malware/backdoor-phpgeneric07'
    ),
    /*array('https?\S{1,63}\.ru',
    'Russian URL',
    'Detected a .RU domain link, as there are many attacks leading the innocent visitors to .RU pages. Maybe it\'s valid link, but leave it to you to check this out.',
    ),*/
    array(
        'preg_replace\s*\(\s*[\"\'\”]\s*/\s*\.\s*\*\s*/\s*e\s*[\"\'\”]\s*,\s*[\"\'\”]\s*\\x65\\x76\\x61\\x6c',
        'Backdoor: PHP:Filesman:02',
        'Detected the “Filesman Shell”? Backdoor that allows attackers to access, modify ' . 'and reinfect your site. It is often hidden in the filesystem and hard ' . 'to find without access to the server or logs.',
        'http://sucuri.net/malware/backdoor-phpfilesman02'
    ),
    array(
        '(include|require)(_once)*\s*[\"\'][\w\W\s/\*]*php://input[\w\W\s/\*]*[\"\']',
        'PHP:\input include',
        'Detected the method of reading input through PHP protocol handler in ' . 'include/require statements.'
    ),
    array(
        'data:;base64',
        'data:;base64 include',
        'Detected the method of executing base64 data in include.'
    ),
    array(
        'RewriteCond\s*%\{HTTP_REFERER\}',
        '.HTACCESS RewriteCond-Referer',
        'Your .htaccess file has a conditional redirection based on "HTTP Referer".' . 'This means it redirects according to site/url from where your visitors ' . 'came to your site. Such technique has been used for unwanted redirections ' . 'after coming from Google or other search engines, so check this directive ' . 'carefully.'
    ),
    /*array('brute\s*force',
    '"Brute Force" words',
    '11',
    'Detected the "Brute Force" words mentioned in code. <u>Sometimes it\'s '
    . 'a "false positive"</u> because several developers like to mention it '
    . 'in they code, but it\'s worth double-checking if this file is untouched '
    . '(eg. compare it with one in original extension package).'),*/
    array(
        'GIF89a.*[\r\n]*.*<\?php',
        'PHP file desguised as GIF image',
        'Detected a PHP file that was most probably uploaded as an image via webform that loosely only checks file headers.'
    ),
    array(
        '\$ip[\w\W\s/\*]*=[\w\W\s/\*]*getenv\(["\']REMOTE_ADDR["\']\);[\w\W\s/\*]*[\r\n]\$message',
        'Probably malicious PHP script that "calls home"',
        'Detected script variations often used to inform the attackers about found vulnerable website.'
    ),
    array(
        '(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|preg_replace|str_replace|assert|unpack)[\s\/\*\w\W\(]*){2,};',
        'Multiple encoded, most probably obfuscated code found',
        'This pattern could be used in highly encoded, malicious code hidden under ' . 'a loop of code obfuscation function calls. In most cases the decoded ' . 'hacker code goes through an eval call to execute it. This pattern is ' . 'also often used for legitimate purposes, e.g. storing configuration ' . 'information or serialised object data. '
    ),
    array(
        '<\s*iframe',
        'IFRAME Element',
        'Found IFRAME element in code. It\'s mostly benevolent, but often used ' . 'for bad stuff, so please check if it\'s a valid code.'
    ),
    array(
        'strrev[\s/\*\#]*\([\s/\*\#]*[\'"]\s*tressa\s*[\'"]\s*\)',
        'Reversed string "assert"',
        'Assert function name is being hidden behind strrev().'
    ),
    array(
        'is_writable[\s/\*\#]*\([\s/\*\#]*getcwd',
        'Is the current DIR Writable?',
        'This could be harmless, but used in some malware'
    ),
    /*array('(?:\\\\x[0-9A-Fa-f]{1,2}|\\\\[0-7]{1,3}){2,}',
    'At least two characters in hexadecimal or octal notation',
    'Found at least two characters in hexadecimal or octal notation. It '
    . 'doesn\'t mean it is malicious, but it could be code hidding behind '
    . 'such notation.'),*/
    array(
        '\$_F\s*=\s*__FILE__\s*;\s*\$_X\s*=',
        'SourceCop encoded code',
        'Found the SourceCop encoded code. It is often used for malicious code
            hidding, so go and check the code with some online SourceCop decoders'
    ),
    array(
        '(?:exec|passthru|shell_exec|proc_|popen)[\w\W\s/\*]*\([\s/\*\#\'\"\w\W\-\_]*(?:\$_GET|\$_POST|\$_REQUEST)',
        'Shell command execution from POST/GET variables',
        'Found direct shell command execution getting variables from POST/GET,
            which is highly dangerous security flaw or a part of malicious webrootkit'
    ),
    /*array('\$\w[\w\W\s/\*]*=[\w\W\s/\*]*`.*`',
    'PHP execution operator: backticks (``)',
    'PHP execution operator found. Note that these are not single-quotes!
    PHP will attempt to execute the contents of the backticks as a shell
    command, which might indicate a part of a webrootkit'),*/
    array(
        'fsockopen\s*\(\s*[ \'\"](?:localhost|127\.0\.0\.1)[ \'\"]',
        'Opening socket to localhost',
        'Found code opening socket to localhost, it\'s worth investigating more'
    ),
    array(
        'fsockopen\s*\(.*,\s*[ \'\"](?:25|587|465|475|2525)[ \'\"]',
        'Opening socket to known SMTP ports, possible SPAM script',
        'Found opening socket to known SMTP ports, possible SPAM script'
    ),
    array(
        '(?:readfile|popen)\s*\(\s*[ \'\"]*\s*(?:file|http[s]*|ftp[s]*|php|zlib|data|glob|phar|ssh2|rar|ogg|expect|\$POST|\$GET|\$REQUEST)',
        'Reading streams or superglobal variables with fopen wrappers present',
        'Found functions reading data from streams/wrappers - please analyze the code'
    ),
    array(
        'array_(?:diff_ukey|diff_uassoc|intersect_uassoc|udiff_uassoc|udiff_assoc|uintersect_assoc|uintersect_uassoc)\s*\(.*(?:\$_REQUEST|\$_POST|\$_GET).*;',
        'Callback function comming from REQUEST/POST/GET variable possible',
        'Found possible local execution enabling-script receiving data from POST or GET requests'
    ),
    array(
        '^(((.*)(=|;)(\s*)?)|((@|\s)*))extract\s*\(',
        'Extract Function',
        'PHP extract function found. Extract creates variables from an array (eg $_POST, $_GET or $_REQUEST). It can be legit, but if there is some strange code execution like $extracted_variable_1($extracted_variable_2) it should be malicious.'
    ),
    array(
        '^(((.*)(=|;)(\s*)?)|((@|\s)*))(include|require)(_once)?\s*\(?("|\')https?://',
        'Remote Include',
        'Include or require which includes a remote file. It should be malicious, and vulnerable as well.'
    ),
    array(
        '\\\\x([abcdef0-9]{2}){3,}',
        'Hex Encoded String',
        'Code which is hex encoded. It can be legit, but not a usual thing. Malicious users can hide their functions in hex encoded expressions.'
    )
);

$FileNames = array(
    'Probably an OpenFlashChart library demo file that has known input ' . 'validation error (CVE-2009-4140)' => 'ofc_upload_image.php',
    'Probably an R57 shell' => 'r57.php',
    'Probably a C99 shell' => 'c99.php',
    'Probably a C100 shell' => 'c100.php',
    'PhpInfo() file? It is advisable to remove such file, as it could reveal too
        much info to potential attackers' => 'phpinfo.php',
    'PerlInfo() file? It is advisable to remove such file, as it could reveal too
        much info to potential attackers' => 'perlinfo.php'
);

// check if DeepScan should be done
if (isset($_GET['deepscan'])) {
    $patterns = array_merge($Patterns, explode('|', $Strings), explode('|', $DeepSearchStrings));
} else {
    $patterns = array_merge($Patterns, explode('|', $Strings));
}
$ext = explode('|', $fileExt);

function get_filelist($dir)
{
    global $ignoreDirs;
    $ignoreArr = explode('|', $ignoreDirs);
    
    $path      = '';
    $toResolve = array(
        $dir
    );
    while ($toResolve) {
        $thisDir = array_pop($toResolve);
        if (@$dirContent = scandir($thisDir)) {
            foreach ($dirContent As $content) {
                if (!in_array($content, $ignoreArr)) {
                    $thisFile = "$thisDir/$content";
                    if (is_file(@$thisFile)) {
                        scan_file($thisFile);
                    } else {
                        $toResolve[] = $thisFile;
                    }
                }
            }
        }
    }
    
}

function scan_file($path)
{
    global $ext, $patterns, $count, $total_results, $FileNames;
    $dateformat = "d F Y - H:i:s ";
    
    if (in_array(pathinfo($path, PATHINFO_EXTENSION), $ext) && filesize($path) && !stripos($path, 'malware-scanner.php')) {
        
        if ($malic_file_descr = array_search(pathinfo($path, PATHINFO_BASENAME), $FileNames))
            echo '<tr>
                    <td>' . basename($path) . '</td>
                    <td>Suspicious FileName</td>
                    <td> - </td>
                    <td>' . substr(sprintf('%o', fileperms($path)), -4) . '</td>
                    <td><a href="#details-' . pathinfo($path, PATHINFO_FILENAME) . '" class="mb-xs mt-xs mr-xs modal-with-zoom-anim btn btn-success"><i class="fa fa-file-text"></i> Details</a></td>
                    <div id="details-' . pathinfo($path, PATHINFO_FILENAME) . '" class="zoom-anim-dialog modal-block modal-header-color modal-block-danger mfp-hide">
										<section class="panel">
											<header class="panel-heading">
												<h2 class="panel-title">Details</h2>
											</header>
											<div class="panel-body">
                                            
														<label class="col-sm-3 control-label"><i class="fa fa-file-text"></i> File Name: </label>
														<div class="col-sm-9">
															<input type="text" name="name" class="form-control" value="' . basename($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-flag"></i> Path:</label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . $path . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-lock"></i> Permission: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . substr(sprintf('%o', fileperms($path)), -4) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-key"></i> Last Accessed: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, fileatime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-pencil-square-o"></i> Last Modified: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, filemtime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-folder"></i> File Size: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . HumanReadableFilesize($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-cog"></i> MD5 Hash: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . md5_file($path) . '" readonly /><br />
														</div>
											</div>
											<footer class="panel-footer">
												<div class="row">
													<div class="row">
													<div class="col-md-8 text-left">
													</div>
                                                    <div class="col-md-4 text-right">
														<button class="btn btn-default modal-dismiss">Close</button> &nbsp;&nbsp;
													</div>
												</div>
												</div>
											</footer>
										</section>
				         </div>
                    </tr>
                    ';
        
        if (!($content = file_get_contents($path))) {
            $error = 'Could not check ' . $path;
        } else {
            
            foreach ($patterns As $pattern) {
                if (is_array($pattern)) {
                    preg_match_all('#' . $pattern[0] . '#isS', $content, $found, PREG_OFFSET_CAPTURE);
                } else {
                    preg_match_all('#' . $pattern . '#isS', $content, $found, PREG_OFFSET_CAPTURE);
                }
                $all_results   = $found[0];
                $results_count = count($all_results);
                $total_results += $results_count;
                if (!empty($all_results)) {
                    $count++;
                    if (is_array($pattern)) {
                        echo '<tr>
                         <td>' . basename($path) . '</td>
                         <td><font color="red"><i>' . $pattern[1] . '</i></font></td>
                         <td>' . $results_count . '</td>
                         <td>' . substr(sprintf('%o', fileperms($path)), -4) . '</td>
                         <td><a href="#details-' . $count . '" class="mb-xs mt-xs mr-xs modal-with-zoom-anim btn btn-success"><i class="fa fa-file-text"></i> Details</a></td>
                        
                        <div id="details-' . $count . '" class="zoom-anim-dialog modal-block modal-header-color modal-block-danger mfp-hide">
										<section class="panel">
											<header class="panel-heading">
												<h2 class="panel-title">Details</h2>
											</header>
											<div class="panel-body">
                                            
														<label class="col-sm-3 control-label"><i class="fa fa-file-text"></i> File Name: </label>
														<div class="col-sm-9">
															<input type="text" name="name" class="form-control" value="' . basename($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-flag"></i> Path:</label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . $path . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-lock"></i> Permission: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . substr(sprintf('%o', fileperms($path)), -4) . '" readonly />
                                                            ';
                        $permissions = substr(sprintf('%o', fileperms($path)), -4);
                        if (intval($permissions) == 777) {
                            $permissions = '<font color="orange">(Please note: The file have full access permissions)</font><br /><br />';
                        } else {
                            echo '<br />';
                        }
                        echo '
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-key"></i> Last Accessed: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, fileatime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-pencil-square-o"></i> Last Modified: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, filemtime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-folder"></i> File Size: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . HumanReadableFilesize($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fa fa-cog"></i> MD5 Hash: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . md5_file($path) . '" readonly /><br />
														</div>
														
														<label class="col-sm-3 control-label"><i class="fa fa-folder"></i> Threat Description: </label>
														<div class="col-sm-9">
															<textarea type="text" class="form-control" rows="7" readonly />' . $pattern[2] . '</textarea><br />
														</div>
														
														';
                        foreach ($all_results as $match) {
                            echo '<span class="offset">Line #: ', calculate_line_number($match[1], $content), '</span>', "<pre>... " . htmlentities(substr($content, $match[1], 200), ENT_QUOTES) . " ...</pre>\n";
                        }
                        echo '
											</div>
											<footer class="panel-footer">
												<div class="row">
													<div class="row">
													<div class="col-md-8 text-left">
													</div>
                                                    <div class="col-md-4 text-right">
														<button class="btn btn-default modal-dismiss">Close</button> &nbsp;&nbsp;
													</div>
												</div>
												</div>
											</footer>
										</section>
				         </div>
                        ';
                    }
                    echo '
                    </tr>
                    ';
                }
            }
            unset($content);
        }
    }
}


function calculate_line_number($offset, $file_content)
{
    list($first_part) = str_split($file_content, $offset);
    $line_nr = strlen($first_part) - strlen(str_replace("\n", "", $first_part)) + 1;
    return $line_nr;
}
?>
                                    
                                    <table class="table table-bordered table-striped table-hover" id="datatable-default">
						            <thead> 
										<tr class="active">
										  <th>Infected File</th>
						                  <th>Malware Type</th>
										  <th>Occurences</th>
										  <th>File Permissions</th>
										  <th>Actions</th>
						                </tr>
									</thead>
                                   <tbody>
<?php
$before = microtime(true);
get_filelist($directory);
?>
						            </tbody>
									</table>
<?php
$after     = microtime(true);
$totaltime = mb_substr(($after - $before), 0, 4);
echo 'The scan found <b>', $total_results, ' suspicious malware code spots</b> in <u>', $count, ' different files</u>!<br/>';
echo 'Scanning time was <b>' . $totaltime . ' seconds</b> <br>';
?>
                                    
								</div>
							</section>

						</div>
					</div>
					<!-- end: page -->
				</section>
<?php
footer();
?>