{"id":1682,"date":"2010-01-07T07:01:16","date_gmt":"2010-01-07T12:01:16","guid":{"rendered":"http:\/\/g33kinfo.com\/info\/?p=1682"},"modified":"2010-01-07T07:01:16","modified_gmt":"2010-01-07T12:01:16","slug":"removing-malware-code-in-webpages","status":"publish","type":"post","link":"https:\/\/g33kinfo.com\/info\/removing-malware-code-in-webpages\/","title":{"rendered":"Removing malware code in webpages"},"content":{"rendered":"

From http:\/\/tech.superhappykittymeow.com<\/a> Good stuff here also…<\/p>\n

More and more client workstations are being infected with keyloggers and trojans. In addition to stealing your WoW username and password (oh noes, my purpz!), they also have been stealing FTP logins.<\/p>\n

This has manifested itself in the linux server world by seemingly legit users logging in over FTP, downloading a file, then uploading it a few seconds later with 100-ish bytes appended. A look at xferlog reveals this behavior, usually against a regex of pages (index.*, default.*, etc), and the connecting IP will often be foreign. A look at the secure log will reveal that the password was not brute-forced; rather, it was known.<\/p>\n

The real solution is to change all passwords and force the end user to reformat their computer, since they’re infected and do not realize it. Alas, this is not quite practical (though if someone could invent a remote formatter, I’ll give you $10 for it). Rather, advise the end user of the situation and suggest reformatting \u2014 or, at the very least, using a collection of anti-spyware, anti-virus, and anti-everything software on their workstation. Change the affected user’s password.<\/p>\n

To clean up the leftover malicious code that was appended, find out the exact string (usually a `tail index.php’ will reveal it) as it is often a javascript line or an iframe.<\/p>\n

Copy the string completely and we’ll just sed it out:
\n
\nsed -i \"s#