My sites got infected with some bad malware that has inserted malicious code on at least 3135 files (all my wordpress sites).
This is one of the files infected: http://pastebin.com/FXU1ht4R
And here is my desired output: http://pastebin.com/YPJwjiWH
I have no idea about Unix commands, besides some simple find
and grep
commands.
After some research I found about the sed
command but I don't know how to use it in my case.
As you can see from the above code, the general pattern is that the code is inserted at the top of each file, meaning before the original <?php
tag (which means now the original <?php
tag is second.
So I thought I could find all the files containing cnajwp =
and remove everything before the second <?php
tag.
I can find the files containing cnajwp
by using
find * -type f -name "*.php" -exec grep -l "cnajwp =" {} \;
but I don't know how to replace everything before the second <?php
tag on these occurrences.
Could anybody here give me a helping hand?