#1786306328
W=$HOME/public_html
#1786306328
echo "=== 1. DROP-INS (cargan antes que todo) ==="
#1786306328
ls -la $W/wp-content/advanced-cache.php $W/wp-content/object-cache.php $W/wp-content/db.php 2>&1
#1786306328
echo; echo "=== 2. MU-PLUGINS (no salen en el panel) ==="
#1786306328
ls -laR $W/wp-content/mu-plugins/ 2>&1 | head -25
#1786306328
echo; echo "=== 3. PHP DENTRO DE UPLOADS (no debe haber NINGUNO) ==="
#1786306328
find $W/wp-content/uploads -name "*.php*" -printf '%TY-%Tm-%Td  %p\n' 2>/dev/null | head -25
#1786306328
echo "(fin de la lista)"
#1786306328
echo; echo "=== 4. PATRONES DE CODIGO MALICIOSO ==="
#1786306328
grep -rlE "eval[[:space:]]*\(|base64_decode|gzinflate|str_rot13|create_function|assert[[:space:]]*\(|shell_exec|passthru"   $W --include="*.php" 2>/dev/null | grep -vE "/wp-includes/|/wp-admin/|/atalaya/vendor/|/atalaya/database/" | head -40
#1786306330
echo; echo "=== 5. wp-config.php: lineas anomalas ==="
#1786306330
grep -nE "eval|base64|gzinflate|WP_CACHE|auto_prepend|\\\$_(GET|POST|REQUEST|COOKIE)" $W/wp-config.php
#1786306330
echo "(si no sale nada, esta limpio)"
#1786306330
echo; echo "=== 6. TAREAS CRON DEL SISTEMA ==="
#1786306330
crontab -l 2>&1 | head -20