Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #336988#
- echo "<script type="text/javascript" language="javascript" > CODE OF MALWARE </script>";
- #/336988#
- /*336988*/
- CODE OF MALWARE
- /*/336988*/
- <!--336988-->
- <script type="text/javascript" language="javascript" >CODE OF MALWARE</script>
- <!--/336988-->
- '^.*336988.*[sS]*.*336988.*$'
- $regex = New-Object System.Text.RegularExpressions.Regex "<!--68c8c7-->((.|n)*)<!--/68c8c7-->"
- $regex = New-Object System.Text.RegularExpressions.Regex "/*68c8c7*((.|n)*)68c8c7*/"
- Get-ChildItem . -Recurse -Include *.aspx,*asp,*.html,*.htm | where-object {$_.lastwritetime –gt $DateToCompare} | %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}
- Get-ChildItem . -Recurse -Include *.js | where-object {$_.lastwritetime –gt $DateToCompare} | %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}
- function tryFixFile($filepath, $filepathBackup)
- {
- $infile = [string]::join([environment]::newline, (get-content -path $filepath))
- $regex = New-Object System.Text.RegularExpressions.Regex "<!--68c8c7-->((.|n)*)<!--/68c8c7-->"
- if($regex.IsMatch($infile))
- {
- $intAnswer = $WScriptObject.popup("File needs to be change: " + $filepath + " do you want to continue?", 0,"Change File",4)
- If ($intAnswer -eq 6)
- {
- Write-Host " Creating backup for file: " $filepath
- Copy-Item $filepath $filepathBackup
- $replace = $regex.Replace($infile,"")
- $replace | out-file $filepath
- } else
- {
- $a.popup("File " + $filepath + " won't be changed.")
- }
- }
- }
- function DoWork($filename, $directory)
- {
- $filepath = $directory + '' + $filename
- $filepathBackup = $directory + '' + "Backup_" + $filename
- $WScriptObject = new-object -comobject wscript.shell
- tryFixFile $filepath $filepathBackup
- }
- $pathToCheck = Read-Host 'WARNING!! Path to check/change?'
- if (Test-Path $pathToCheck)
- {
- Set-Location $pathToCheck
- #files were affected no longer that 2 days ago, you can change this
- $DateToCompare = (Get-date).AddDays(-2)
- Get-ChildItem . -Recurse -Include *.aspx,*asp,*.html,*.htm | where-object {$_.lastwritetime –gt $DateToCompare} | %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}
- }else
- {
- write-host "Path doesn't exist"
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement