Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

We've noticed several security warnings from antivirus software when visiting one of our customer's pages.

Besides other steps to improve security, we now want to scan the server's directories for files which have malicious javascript code included (it's in hexadecimal, with a function to convert to ascii and and eval()-function). We tried it with ClamAV, but it doesn't detect those files.

We've already submitted one of the files on ClamAV's web page, but we're not sure if this scanner will be able to detect them. Are there other scanners or methods we could try to identify those files?

Webserver is apache2 running on Gentoo.

share|improve this question
1  
Why not just grep for evals? grep -H -r "eval(" /path/to/www – Polynomial Jul 23 '12 at 9:36
2  
Hi @32bitfloat, welcome to IT Security. As it stands, this question is not a good fit for our Q&A format, since it seems like a request for product recommendations - a "shopping list question". Please see the FAQ and How to Ask - if you update it to remove that aspect (perhaps more of a "how can I detect this"), ping me or one of the other mods and we'll reopen it. – AviD♦ Jul 23 '12 at 10:00
@Polynomial I'm not sure if we could rely on an exisiting eval so I don't think this matches our needs. – 32bitfloat Jul 23 '12 at 11:25
@AviD Sry, I thought "security tools" would match...without this detail, the question I wanted to ask would be a duplicate, so it's better to keep it closed. Thanks anyhow. – 32bitfloat Jul 23 '12 at 11:25
@32bitfloat - "security tools" is definitely ontopic (assuming antivirus is a "security" tool... ;-) ). The issue was that you were asking "which tool should I use", and not "how can I detect malicious JS"... – AviD♦ Jul 23 '12 at 11:59

closed as not constructive by AviD♦ Jul 23 '12 at 9:58

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.