Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A hacker got into a web server and added this string (removed some characters for security purposes and added line breaks for readability) in all index.php files:


I have tried using the sed command to remove it (replacing it with nothing) but it is nearly impossible to define a working regular expression with such a huge string.

Is there another way, maybe reading the string from a .txt file?

share|improve this question
up vote 1 down vote accepted

Assumung you don't use these tricks anywhere, why not this (appropriately executed, using sed -i and maybe find -exec ..., which was not part of your question, was it?)

$ sed 's/eval(gzuncompress(base64_decode(.*)));//' << EOF                     
> <?php eval(gzuncompress(base64_decode('eF5Tcffxd3L0CY5WjzcyNDGGMV4+1dSwqSqzU0LQGAJCPCMM=')));eval(gzuncompress(base64_decode('eF5LK81LLsnMzKx+JjNW0rgUAqDUUxQ=='))); eval(gzuncompress(base64_decode('eF6VlMmy/3sMxOez/iJOojHFT0Ig/8jlTymmN/I=')));?>
<?php  ?>

...you can afterwards deal with the empty <?php ?>s (which don't hurt much, do they?).

Edit removed line breaks to make sure it fits to the situation described.

Edit2 You'd be better off just replacing everything with a (known good) backup, probably, if you've got one.

Edit3 I just caught the "all index.php files" bit. You can thus try something like

find /path/to/wwwroot -name "index.php" -exec sed -i regex {} \;
share|improve this answer
I have used some backups but for some files I had to do it this way. Thanks sr_! It worked great. – Kenzier Nov 15 '11 at 11:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.