Home / server / Questions / 538469
In Process
garconcn
Asked: 2013-09-13 09:38:01 +0800 CST

How to remove malware code from javascript file using sed

  • 772

I found the following two different pattern in some hacked javascript files.

<!--2d3965-->  some code  <!--/2d3965-->

/*2d3965*/ some code /*/2d3965*/

I am able to remove the first pattern from the file using this command:

sed -i 's/<!--2d3965-->.*<!--\/2d3965-->//g' javascript_file.js

but not able to remove the second pattern using similar command:

sed -i 's/\/\*2d3965\*\/.\+\/\*\/2d3965\*\///g' javascript_file.js

What's correct syntax to remove the second pattern?

sed

1 Answers

  1. The code I've used for this type of attack on .php, .js and .html files is:

    perl -p -i.orig -0 -e 's/<\?\s*#([0-9a-z]{6})#.*#\/\1#\s*\?>//gs; s/<\!--([0-9a-z]{6})-->.*<!--\/\1-->//gs;'

    Annoying... You should figure out how the attacker got in and check the health of your backups as well. I had to run the above on 4 million files once because the backups were also tainted.

    • 2