wordpress 해킹 공격 관련

http://blog.unmaskparasites.com/2011/11/09/tmpwp_inc-or-not-your-typical-wordpress-attack/

작업전 백업 필수...

아래 명령어 실행후 관련항목 삭제

grep -rl 'superpuperdomain' *
grep -rl 'pingnow' *

remove_malware_js.php 파일 생성 및 실행

#!/usr/bin/php
<?php
$path = dirname(realpath(__FILE__));
$list_js = `find $path -name '*.js'`;
$list_js_arr = explode("\n", $list_js);
foreach($list_js_arr as $file){
if(!empty($file)){
if( strstr(file_get_contents($file), "var _0x4470=")) {
$exec = `sed -i '$ d' $file`;
echo "Excluido o virus do arquivo: $file\n";
}
if( strstr(file_get_contents($file), "var _0xa687=")) {
$exec = `sed -i '$ d' $file`;
echo "Excluido o virus do arquivo: $file\n";
}
if( strstr(file_get_contents($file), "var _0x4de4=")) {
$exec = `sed -i '$ d' $file`;
echo "Excluido o virus do arquivo: $file\n";
}
}
}

> chmod +x remove_malware_js.php

> ./remove_malware_js.php