为什么正则表达式模式可用于html注释，但不适用于php和js注释？

Question

I have this problem:

Various pages of my site (tipically: html, php and js) are affected by a trojan horse (JS/Kryptik.ADZ based on NOD32 scan).

The code in each type of page is like this:

PHP:

#336988#
echo "<script type=\"text/javascript\" language=\"javascript\" > CODE OF MALWARE </script>";
#/336988#

JS:

/*336988*/
CODE OF MALWARE
/*/336988*/

HTML:

<!--336988-->
<script type="text/javascript" language="javascript" >CODE OF MALWARE</script>
<!--/336988-->

So i use Notepad++ and regex to replace malware with blank text. My regex is this: (<!--|\\#|/\\*)336988.+/336988(-->|\\#|\\*/)

But only HTML is found by this expression. Why?

I don't understand.

I'm sorry if my english and my knowledge of regex is poor.

Thanks

Carlo

Answer 1

试试这个：

'^.*336988.*[\s\S]*.*336988.*$'

Answer 2

试试这个，我遇到了同样的问题，并且有效。

/#336988#(.*?)#\/336988#/ism

Answer 3

这里是修复336988、68c8c7、8f4d8e，a59dc4的脚本。

Answer 4

Today I had the same problem but with different code. This code affected aspx, asp, htdocs, html, htm and js files. Below my code in Powershell to fix these files. For JS files you need to change line:

    $regex = New-Object System.Text.RegularExpressions.Regex "<!--68c8c7-->((.|\n)*)<!--/68c8c7-->"

to:

    $regex = New-Object System.Text.RegularExpressions.Regex "/\*68c8c7\*((.|\n)*)68c8c7\*/"

and line

    Get-ChildItem . -Recurse -Include *.aspx,*asp,*.html,*.htm | where-object {$_.lastwritetime –gt $DateToCompare} |  %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}

to:

    Get-ChildItem . -Recurse -Include *.js | where-object {$_.lastwritetime –gt $DateToCompare} |  %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}

below code (this script will create Backup_* file, after all you can delete those files):

function tryFixFile($filepath, $filepathBackup)
{   
    $infile = [string]::join([environment]::newline, (get-content -path $filepath))
    $regex = New-Object System.Text.RegularExpressions.Regex "<!--68c8c7-->((.|\n)*)<!--/68c8c7-->"

    if($regex.IsMatch($infile))
    {
        $intAnswer = $WScriptObject.popup("File needs to be change: " + $filepath + " do you want to continue?", 0,"Change File",4)
        If ($intAnswer -eq 6) 
        {
            Write-Host "  Creating backup for file: "  $filepath
            Copy-Item $filepath $filepathBackup
            $replace = $regex.Replace($infile,"")
            $replace | out-file $filepath
        } else 
        {
            $a.popup("File " + $filepath + " won't be changed.")
        }
    }
}

function DoWork($filename, $directory)
{   
    $filepath = $directory + '\' + $filename
    $filepathBackup = $directory + '\' + "Backup_" + $filename

    $WScriptObject = new-object -comobject wscript.shell

    tryFixFile $filepath $filepathBackup
}



$pathToCheck = Read-Host 'WARNING!! Path to check/change?'
if (Test-Path $pathToCheck)
{
    Set-Location $pathToCheck

    #files were affected no longer that 2 days ago, you can change this
    $DateToCompare = (Get-date).AddDays(-2)

    Get-ChildItem . -Recurse -Include *.aspx,*asp,*.html,*.htm | where-object {$_.lastwritetime –gt $DateToCompare} |  %{Write-Host Examining file: $_.fullname; $_} | ForEach-Object { DoWork $_.Name $_.DirectoryName}
}else
{
    write-host "Path doesn't exist"
}