<?php
// Malware cleanup script - removes ushort.observer redirects
// Run via PHP CLI only

$root = 'C:/xampp/htdocs';
$pattern = 'ushort.observer';
$fixed = [];
$errors = [];

function scan_and_clean($dir, $pattern, &$fixed, &$errors) {
    $items = scandir($dir);
    foreach ($items as $item) {
        if ($item === '.' || $item === '..') continue;
        $path = $dir . '/' . $item;
        if (is_dir($path)) {
            scan_and_clean($path, $pattern, $fixed, $errors);
        } elseif (preg_match('/\.(php|js)$/i', $item)) {
            $content = @file_get_contents($path);
            if ($content === false) {
                $errors[] = $path . ' (read error)';
                continue;
            }
            if (strpos($content, $pattern) === false) continue;

            // Remove lines containing the pattern
            $lines = preg_split('/\r?\n/', $content);
            $cleaned_lines = array_filter($lines, function($line) use ($pattern) {
                return strpos($line, $pattern) === false;
            });
            $cleaned = implode("\n", $cleaned_lines);

            // Remove isMobile script block
            $cleaned = preg_replace(
                '/<script>\s*const isMobile\s*=.*?window\.location\.replace\([^)]+\);?\s*\}\s*<\/script>\s*/s',
                '',
                $cleaned
            );

            if (@file_put_contents($path, $cleaned) !== false) {
                $fixed[] = $path;
            } else {
                $errors[] = $path . ' (write error)';
            }
        }
    }
}

scan_and_clean($root, $pattern, $fixed, $errors);

echo "=== MALWARE CLEANUP COMPLETE ===\n\n";
echo "FIXED (" . count($fixed) . " files):\n";
foreach ($fixed as $f) echo "  OK: $f\n";
echo "\nERRORS (" . count($errors) . " files):\n";
foreach ($errors as $e) echo "  ERR: $e\n";
echo "\nTotal fixed: " . count($fixed) . ", errors: " . count($errors) . "\n";