[KuJoe]

I currently own and manage a free web hosting site and we take a proactive approach to dealing with illegal content. We are looking for a less intrusive and less time consuming method to do this and so far our best option is to have a shell script to scan our servers /home/ directory looking in only the user's public_html directory within .php and .htm* files. Here is the current code that was provided from a user at Web Hosting Talk - The largest, most influential web hosting community on the Internet

Code:

#!/bin/bash
FINDBIN=/usr/bin/find
EGREPBIN=/bin/egrep
BADWORDS="shell_exec|nulled|ddos|phish|warez|divx"
$FINDBIN /home/ -iname \*.php -o -iname \*.htm -o -iname \*.htm* -type f -exec $EGREPBIN -i -H $BADWORDS {} \;

This script works great, except that certain keywords are returning a lot of results from user's /tmp/ directories and such. It would be an added bonus if the results could be somewhat formatted and sent via e-mail so that we could run this as a daily cron, but that is not required.

Payment for your help is possible based on the code and timeframe. Future projects my also be available.

[wirehopper]

You could pipe the $FINDBIN through mail, like so:

set $FINDPARMS to the parameters you want to send to find

$FINDBIN $FINDPARMS | mail -s "FINDBIN OUTPUT" email@domain.com

To exclude some directories, you may be able to use -regex. I haven't worked with this, but it looks promising.

-regex pattern
File name matches regular expression pattern. This is a match on the whole path, not a search. For example, to match a file named './fubar3', you can use the regular expression '.*bar.' or '.*b.*3', but not 'f.*r3'. The regular expressions understood by find are by default Emacs Regular Expressions, but this can be changed with the -regextype option.

-regex "^/tmp"

Formatting opportunities could be achieved with the following commands:

sort, cut, awk and sed

Great resource bash commands - Linux MAN Pages

This the line I use to see what files have been created or modified on my server in the past 24 hours. Maybe it can help you as well.

find $HOME/public_html -mtime 0

Good luck.