Using sed to remove a line from all files in a directory

motiongrafika · 01-23-2010, 12:45 PM

A Javascript has crept into all my hmtl, php files in my shared hosting account. I have SSH access.

How can I use sed to remove that line from all files in a directory recursively ?
sed doesnt change the original file.
And I need to specify *.php and *.html

Thanx

win32sux · 01-23-2010, 12:53 PM

Quote:

Originally Posted by motiongrafika

A Javascript has crept into all my hmtl, php files in my shared hosting account. I have SSH access.

How can I use sed to remove that line from all files in a directory recursively ?
sed doesnt change the original file.
And I need to specify *.php and *.html

You don't seem to be too concerned about how this got on there in the first place (please correct me if I'm wrong), which is weird considering you've posted in Security. Are you sure the JavaScript isn't placed there by your hosting provider? If it is, then removing it could be a violation of the terms and conditions.

motiongrafika · 01-24-2010, 01:35 AM

Its a Virus / Phishing Script that has got injected.
This has happened previously on our previous hosting company. So definitely not by the host. We are still investigating the roots of this injection.

But for now I need to remove this in all my html & php files

Code:

<script>/*LGPL*/ try{ window.onload = function(){Gf7msvj9kxh8z [MODERATED] catch(Dv3z1tirm73hc81l1fz ) {}</script>

unSpawn · 01-24-2010, 02:23 AM

Quote:

Originally Posted by motiongrafika

I need to remove this in all my html & php files

See this simple example for backing up and removing code and make your sed line look like something like 'sed -i "s|<script.*LGPL.*catch(Dv3z1tirm73hc81l1fz.).{}</script>|<\!-- REMOVED0 -->|g" -i "s|<\!--d7090973ec8e254afa1b87186938b792-->|<\!-- REMOVED1 -->|g" "${FILE}"'.

Quote:

Originally Posted by motiongrafika

for now (..) We are still investigating the roots of this injection.

Leaving it at changing files will seem carefree and easy but you'll find the "infection" will also spread again and as easy. Best combat the cause first.

motiongrafika · 01-28-2010, 12:32 AM

The value of catch keeps changing.
Any method to remove all lines after </html> ?

Quote:

Leaving it at changing files will seem carefree and easy but you'll find the "infection" will also spread again and as easy. Best combat the cause first.

You are right - we removed it manually and re-uploaded and its back today.

But this script is not seen on pages which another guy located elsewhere uploads to. This seems to happen only when we upload in office.