# WordPress Malware Cleaner for XAMPP
# This script removes the mobile redirect malware

param(
    [string]$XamppPath = "C:\xampp",
    [switch]$DryRun = $false
)

Write-Host "=== WordPress Malware Cleaner ===" -ForegroundColor Cyan
Write-Host "Target: $XamppPath" -ForegroundColor Gray
Write-Host ""

# Malware patterns to search for
$MalwarePatterns = @(
    "ushort\.dev",
    "window\.location\.replace.*ushort",
    "isMobile.*matchMedia.*Android.*iPhone"
)

# File extensions to scan
$Extensions = @("*.php", "*.html", "*.htm", "*.js")

$InfectedFiles = @()
$CleanedCount = 0

Write-Host "[1/4] Scanning for infected files..." -ForegroundColor Yellow

# Find all potentially infected files
foreach ($ext in $Extensions) {
    $files = Get-ChildItem -Path $XamppPath -Recurse -Include $ext -ErrorAction SilentlyContinue
    foreach ($file in $files) {
        try {
            $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match "ushort\.dev|window\.location\.replace.*//[a-z0-9]+\.[a-z]+/") {
                $InfectedFiles += $file
                Write-Host "  FOUND: $($file.FullName)" -ForegroundColor Red
            }
        } catch {
            # Skip files that can't be read
        }
    }
}

Write-Host ""
Write-Host "Found $($InfectedFiles.Count) infected file(s)" -ForegroundColor $(if ($InfectedFiles.Count -gt 0) { "Red" } else { "Green" })
Write-Host ""

if ($InfectedFiles.Count -eq 0) {
    Write-Host "No malware found! Your system appears clean." -ForegroundColor Green
    exit 0
}

if ($DryRun) {
    Write-Host "DRY RUN MODE - No changes will be made" -ForegroundColor Magenta
    Write-Host "Run without -DryRun to clean the files" -ForegroundColor Magenta
    exit 0
}

Write-Host "[2/4] Cleaning infected files..." -ForegroundColor Yellow

foreach ($file in $InfectedFiles) {
    Write-Host "  Processing: $($file.FullName)" -ForegroundColor Cyan
    
    try {
        $content = Get-Content -Path $file.FullName -Raw
        $originalContent = $content
        
        # Pattern 1: Remove the entire mobile redirect script block
        $pattern1 = '(?s)<script>\s*const isMobile = window\.matchMedia\("\(max-width: 768px\)"\)\.matches\s*\|\| /Android\|iPhone\|iPad\|iPod\|Opera Mini\|IEMobile/i\.test\(navigator\.userAgent\);\s*if \(isMobile\) \{\s*window\.location\.replace\("//[^"]+"\);\s*\}\s*</script>'
        $content = $content -replace $pattern1, ""
        
        # Pattern 2: Remove any script containing ushort.dev
        $pattern2 = '(?s)<script[^>]*>.*?ushort\.dev.*?</script>'
        $content = $content -replace $pattern2, ""
        
        # Pattern 3: Remove any script with window.location.replace to suspicious domains
        $pattern3 = '(?s)<script[^>]*>.*?window\.location\.replace\(["\x27]*//[a-z0-9]+\.[a-z]+/[^"\x27]*["\x27]*\).*?</script>'
        $content = $content -replace $pattern3, ""
        
        # Pattern 4: Remove the fake WordPress maintenance div if present
        $pattern4 = '(?s)<div class="box">\s*<h1 class="logo">WordPress</h1>\s*<div class="text">\s*Briefly unavailable for scheduled maintenance\.<br>\s*Check back in a some hours\.\s*</div>\s*<div class="loader"></div>\s*</div>'
        $content = $content -replace $pattern4, ""
        
        if ($content -ne $originalContent) {
            # Backup the original file
            $backupPath = "$($file.FullName).backup.$(Get-Date -Format 'yyyyMMdd_HHmmss')"
            Copy-Item -Path $file.FullName -Destination $backupPath -Force
            
            # Write cleaned content
            Set-Content -Path $file.FullName -Value $content -NoNewline
            $CleanedCount++
            Write-Host "    ✓ Cleaned (backup: $backupPath)" -ForegroundColor Green
        } else {
            Write-Host "    ⚠ No changes made (pattern not matched)" -ForegroundColor Yellow
        }
    } catch {
        Write-Host "    ✗ Error: $_" -ForegroundColor Red
    }
}

Write-Host ""
Write-Host "[3/4] Summary" -ForegroundColor Yellow
Write-Host "  Files scanned: $($Extensions -join ', ')" -ForegroundColor Gray
Write-Host "  Infected files found: $($InfectedFiles.Count)" -ForegroundColor $(if ($InfectedFiles.Count -gt 0) { "Red" } else { "Green" })
Write-Host "  Files cleaned: $CleanedCount" -ForegroundColor Green
Write-Host ""

Write-Host "[4/4] Security Recommendations" -ForegroundColor Yellow
Write-Host "  1. Change all WordPress admin passwords" -ForegroundColor White
Write-Host "  2. Update WordPress, themes, and plugins to latest versions" -ForegroundColor White
Write-Host "  3. Check for unknown admin users in WordPress" -ForegroundColor White
Write-Host "  4. Review wp-config.php for suspicious code" -ForegroundColor White
Write-Host "  5. Check .htaccess files for redirect rules" -ForegroundColor White
Write-Host "  6. Scan wp-content/uploads for PHP files (shouldn't be there)" -ForegroundColor White
Write-Host "  7. Consider installing Wordfence or Sucuri security plugin" -ForegroundColor White
Write-Host ""

Write-Host "Cleaning complete!" -ForegroundColor Green
Write-Host "Backups created with .backup. timestamp extension" -ForegroundColor Gray