• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • The Famous Blog
    • Blogging
    • Social Media
    • SEO
    • Marketing
    • Design

Famous Bloggers

How To Blog and Start a Business

  • Contribute
    • Submit News
  • Login

Home » The Famous Blog » Cleaning Up The airschk Mess

Cleaning Up The airschk Mess

May 5, 2011 - Last Modified: May 5, 2011 by Mohamed Osam

Cleaning Up The airschk Mess

This is Part II of our “You’ve been hacked” blog I published last week. In this post, we will focus on how you can clean your files from the airschk web bug injections.

If you are one of the many blog administrators who run WordPress or other .php based CMS, this may interest you. When was the last time you checked your server database, files or logs for suspicious behavior or malicious code injections? If you haven’t done so lately, do yourself a favor and check it now!

I have received some very valuable comments on last week’s Part I post, mainly on other precautions that could be taken to protect yourself and your server(s) from similar attacks. One thing I may have missed in Part I is your desktop security. Attacks similar to airschk could be carried out through a hacker installed key logger or password spyware on your machine. This installed Spyware would spy on your keyboard strokes and/or other password files you may have stored locally on your machine, including browser saved passwords and saved form information. Your desktop security is therefore vital to your server security.

Another form of popular clear-text password transmission is email client applications that use regular POP3/SMTP to login to remote email servers. Consider using secure SSL connections for your POP and SMPT services running on the server and turn off any unused ports on your system.

Obviously, we can take a hundred more pages talking about other security measures you can take to protect yourself, your information, your server and your business against such attacks, but I would rather focus on the issue on hand right now; cleaning-up this specific web bug.

airschk code

I put together a quick bash script code for cleaning up web pages injected with airschk. The code may not be perfect, but it will sure do the job. Please note that the code I provide here was written on GNU Linux, and may slightly differ from other Unix/Linux flavors that you may be using for your site(s). Little tweaks may be necessary.

Cleaning up web pages injected with airschk

We ran and tested the code successfully on Hesham’s servers and were able to clean over 200 files in the system.

#!/bin/sh

##########################################################################
# clean_airschk
#
# Created By: Mohamed Osam, 2011-05-01, mohamedabou99@yahoo.com
#
# THE CODE IS PROVIDED HERE FOR ILLUSTRATION PURPOSES ONLY AND IS NOT
# AND SHALL NOT BY ANY MEANS BE USED IN PRODUCTION SYSTEMS WITHOUT
# THE PROPER AND NECESSARY MODIFICATIONS. USE ON YOUR OWN RISK!
#
# FamousBloggers.net, its partners and/or the author of this code shall not
# in any event be liable for any direct, indirect, punitive, special,
# incidental, or consequential damages, including, without limitation, lost
# revenues, or lost profits, arising out of or in any way connected with the
# use or misuse of the information or lack of information provided or with
# the delay or inability to use this source code, or from any information
# provided in cleaning up the web bug, or otherwise arising out of the
# use of this source code, whether based on contract, tort, strict
# liability or otherwise. The author shall not be liable for any loss or
# injury caused in whole, or in part, by the actions, omissions, or
# contingencies beyond the author's control, including in procuring,
# compiling, or delivering the information, or arising out of any errors,
# omissions, or inaccuracies in the information regardless of how caused,
# or arising out of any Internet user's decision, or action taken or not
# taken in reliance upon information furnished.
#
##########################################################################

#First, created a list of the infected files for future reference

if [ $# -ne 3 -a $# -ne 4 ];then
   echo; echo "Wrong use of $0"
   echo "Usage: $0    [-b]"
   echo "       -b: Optional. Will crate a backup file prior to the scan process modification"; echo
   exit 1
fi

echo "Searching for airschk infected files..."
find $1 -type f -name '$2' -exec grep -s airschk {} \; -print | grep $3 > airschk_infected_list

echo "airschk infected files list generated!"; echo; echo "Cleaning-up files..."; echo

BACKUP_FILES=$4
BACKUP_SWITCH="-b"
OLD_FILES_EXT=".old_airschk_pre_clean"

exec "$file.airschk_clean"

      if [ "$BACKUP_FILES" == "$BACKUP_SWITCH" ]; then
         mv $file $file$OLD_FILES_EXT
      fi

      mv -f $file.airschk_clean $file

      #### Add the "perl" statement line if you get the "^M" characters at the end of each line
      #### as some unix implementations does that. This line will remove all \r characters from the final file
      #### You could alternatively use "sed" with the same regexp, but again that would depend on the
      #### linux flavor you are running.

      ## perl -i -pe 's/\r//g' $file

      #Now set all file attribute and ownership information back to the way it was
      chown $fowner:$fgroup $file
      chmod u=$u_attr,g=$g_attr,o=$o_attr $file

      process_result="SUCCESS!"
   else
      process_result="*ERROR: Failed to read file!"
   fi

   echo "$file_count: Processing $file ...$process_result"
done

echo;echo "**** Processing complete! Total of $file_count file(s) processed.";echo

Start first by making a full backup of your web files and all other files you plan to scan. When you are done with your backup, create a text file in your preferred directory on your server; I named the script “clean_airschk”. Make sure you give proper execute privileges to the user/group that will be running the script. You can do that using the “chmod” command,

chmod +x clean_airschk

The script will create a file called “airschk_infected_list” on the directory it is executed from. The “airschk_infected_list” file will carry a list of all files infected on your system; keep this list for future reference. The script will then start cleaning up all infected files and create backup copies (if the –b option is used) of each cleaned file. The backup file will carry the same original filename but with an added “.old_airschk_pre_clean” filename extension. The backup file will be created on the same file system location of the original file. It is highly recommended that you use the “-b” option when running the script. This will help you decide later on whether you want to revert back the operation, move all backup files into one location, or just delete the backup files completely.

To run the script from the location in which it was created at, use the following command-line format,

./clean_airschk    [-b]

So for example, if you want to scan all your php files under your web home directory (htdocs for example), and backup any file found infected, the command and it’s output will be as follows,

$ ./clean_airschk /htdocs *.php /htdocs -b

Searching for airschk infected files...

airschk infected files list generated!

Cleaning-up files...

1: Processing /home/famous/htdocs/demos/kendo/kendo-main/uploads.php ...SUCCESS!
2: Processing /home/famous/htdocs/demos/kendo/kendo-main/kendo-main.php ...SUCCESS!
3: Processing /home/famous/htdocs/demos/kendo/kendo-main/install/index.php ...SUCCESS!
4: Processing /home/famous/htdocs/demos/kendo/kendo-main/index.php ...SUCCESS!
5: Processing /home/famous/htdocs/demos/kendo/kendo-main/admin/login.php ...SUCCESS!
6: Processing /home/famous/htdocs/demos/kendo/kendo-main/admin/index.php ...SUCCESS!
7: Processing /home/famous/htdocs/demos/kendo/kendo-main/admin/settings.php ...SUCCESS!
8: Processing /home/famous/htdocs/astro/index.php ...SUCCESS!
9: Processing /home/famous/htdocs/astro/sites/default/default.settings.php ...SUCCESS!
10: Processing /home/famous/htdocs/astro/modules/bob/bob-profile-item.tpl.php ...SUCCESS!
11: Processing /home/famous/htdocs/astro/modules/bob/bob-picture.tpl.php ...SUCCESS!
12: Processing /home/famous/htdocs/astro/modules/bob/bob-profile.tpl.php ...SUCCESS!
13: Processing /home/famous/htdocs/astro/modules/bob/bob-profile-category.tpl.php ...SUCCESS!
:
:
:
167: Processing /home/famous/htdocs/kendonation/kendo-main/admin/index.php ...SUCCESS!
168: Processing /home/famous/htdocs/kendonation/kendo-main/admin/settings.php ...SUCCESS!

**** Processing complete! Total of 168 file(s) processed.

$

As always, your suggestions and comments are welcome.

ShareTweet

Filed Under: Hosting

About Mohamed Osam

Follow @mohamedosam

A network engineer and a security specialist with a BSc degree in Computer Engineering, MS in Computer Networks, MBA in International Business and MS in Global Management. A member of the National Political Science Honor Society and The International Honor Society for Collegiate Schools of Business. Seinfeld, That '70s Show, Monk and Lost are my favorite TV shows, and Back to the Future, 12 Monkeys and Crash are my favorite movies. I however enjoy activities like biking, golfing and reading, but I spend most of my time behind a computer screen.

Reader Interactions

Related Posts

  • Hosting CompanyHow to Find the Right Hosting for Your Company
  • Tools to Optimize Web Speed for both Apache and IIS 7 Server
  • Advantages And Disadvantages Of Managed WordPress Hosting
  • UKHosting GiveawayUKHosting Giveaway : Free 5 Web Hosting Accounts

{ 4 Responses }

  1. Mohamed Osam says:
    Hesham, seems like our friend got really ticked by this blog topic :) I just checked your server, and you are being under another sweep of distributed attacks as we speak. The attacker is scanning open ports and trying to gain access through brute force attacks. This may explain the relatively slow server performance. Anyway, we have just taken a few extra precautions. It is very interesting however on why you in particular were singled out. Sign of success may be? ;)
    • Hesham says:
      I see what you mean! lol sign of success! .. I like that :) I really appreciate your time and effort! Thanks for the amazing work!

Primary Sidebar

Our Newsletter

Our Newsletter

Join our mailing list to receive the latest news and updates from our blog.

You have Successfully Subscribed!

Popular Articles

  1. Top 10 Sites Where You Can Get Paid to Write 115,654 views
  2. How to Get Targeted Twitter Followers Fast 92,036 views
  3. How to Set Half Rating Scale 1-5 (Poor to Excellent) by Words 86,889 views
  4. 66 Awesome Social Media Quotes 78,368 views
  5. 50 Traffic Sources You Should Milk Like Crazy 75,081 views
Schema Structured Data for wordPress
  • Blog
  • Contribute
  • About Us
  • Contact Us
  • Disclosure Policy

Copyright ©2020 · FamousBloggers - All Rights Are Reserved · Powered by Genesis Framework

  • Login
Forgot Password?
Lost your password? Please enter your username or email address. You will receive a link to create a new password via email.
Go to mobile version