Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

(yes, the title is strange, but read on...)

I copied some data from here and there on my linux box and now i find some many eml and HTML:Nimda viruses on my system when i scan it using clamtk. Problem is that these are 1700+ files that i have to manually select and do action. Plus clamtk doesnt clean it? is there any other way possible to remove these viruses?

I have a finding to share, all infected html files contain:

<html><script language="JavaScript">window.open("readme.eml", null,"resizable=no,top=6000,left=6000")</script></html>

multiple times around the end of file (the previous end e.g. it is appended at the end of every html file)

so all i gotta do is:

  1. Search for all eml files, delete them, some eml files' paths have spaces and other characters between them, so will have to be careful here to no remove the directory or miss the file.

  2. Search for all html files, grep them for these lines, if the lines exists, i would have to delete any lines that match the pattern of :

<script language="JavaScript">window.open("readme.eml", null,

because rest of pattern varies a bit.

I think i need a shell script, my own scripting isnt really great but i will try, in a mean while i am waiting here for answers.

share|improve this question
    
see also serverfault.com/questions/42393/… –  cas Apr 25 '10 at 1:27

1 Answer 1

up vote 1 down vote accepted
for file in $(find . -type f -name '*.html' -print)
do
    sed '/pattern/d'
done
share|improve this answer
    
dam, never used sed, didnt know it was this great, thanks –  Shoaibi Sep 9 '09 at 9:42
    
does it work at your end? –  Shoaibi Sep 9 '09 at 9:47
    
okay, i need "-i". –  Shoaibi Sep 9 '09 at 10:04
2  
I would think you'd need: sed -i '/pattern/d' $file - the answer as written doesn't actually mention the file variable. –  Sam Stokes Sep 9 '09 at 10:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.