Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found the following two different pattern in some hacked javascript files.

<!--2d3965-->  some code  <!--/2d3965-->

/*2d3965*/ some code /*/2d3965*/

I am able to remove the first pattern from the file using this command:

sed -i 's/<!--2d3965-->.*<!--\/2d3965-->//g' javascript_file.js

but not able to remove the second pattern using similar command:

sed -i 's/\/\*2d3965\*\/.\+\/\*\/2d3965\*\///g' javascript_file.js

What's correct syntax to remove the second pattern?

share|improve this question
Wouldn't it be easier to just revert to your backups that you have in your version control system? – Zoredache Sep 12 '13 at 17:44
The hackers were nice enough to mark exactly where they injected code? And you trust those markers? The only reasonable course of action is to restore from backups. – 200_success Sep 12 '13 at 17:52
This is a common attack, actually. – ewwhite Sep 12 '13 at 17:53
Yes, I have the backup. Just want to setup a monitor script to delete those code immediately when it find it. – garconcn Sep 12 '13 at 18:00
Seriously? You think the next compromise will look identical to the last one? Wouldn't a better check be to calculate a cryptography hashs of the files, and watch for changes? That combined with actually identifying and fixing the vulnerability so it can't happen again? – Zoredache Sep 12 '13 at 18:13

The code I've used for this type of attack on .php, .js and .html files is:

perl -p -i.orig -0 -e 's/<\?\s*#([0-9a-z]{6})#.*#\/\1#\s*\?>//gs; s/<\!--([0-9a-z]{6})-->.*<!--\/\1-->//gs;'

Annoying... You should figure out how the attacker got in and check the health of your backups as well. I had to run the above on 4 million files once because the backups were also tainted.

share|improve this answer
Thanks. I will test this first. – garconcn Sep 12 '13 at 18:02
@garconcn Did this work? – ewwhite Sep 13 '13 at 12:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.