0

I have encountered some malware on my Linux server, and am trying to remove it from many php files.

I've tried endlessly with grep | sed and grep | tr and couldn't even erase a simple text string, getting different errors.

When trying:

grep -l '@error' * | xargs -0 sed -i 's/error/nothing/g'   

I receive an error message:

can't read filename.php

Using Terminal on Mac - maybe it's an OSX syntax problem?

My final task is to delete a long string of code from all the files - one that includes some $,!,?,<,>,\," symbols - will I need to backslash them?

  • 2
    It is generally much safer to restore from backup or from your source control repository. You don't have those available? – Mat Apr 6 '12 at 8:42
  • @Mat - thanks, but it's too many backups to run, I also have the specific code I'm need to remove. – Nona Man Apr 6 '12 at 9:04
  • 3
    Why make backups if you can't / won't use them? Better rethink your backup and restore strategies. Best practice is a full restore when a server was compromised. Also, backups are a perfect way to find out what's changed since a previous date. – jippie Apr 6 '12 at 11:33
2

You should restore from backup or source control as @Mat suggested because otherwise you cannot be 100% sure you cleaned up everything.

The problem with your command is the -0 flag for xargs, because that way xargs is expecting null-terminated arguments, which does not work with the output of grep -l. Just drop the -0 and it will work, as long as the file names don't have white spaces in them.

grep -l '@error' * | xargs sed -i 's/error/nothing/g'
  • Thanks. This works - the '-0' was the catch here. BTW - I am trying to save a log file with the list of files in which the replacement was made. Any tips on how to do that? When I save the grep results to a file they are not piped to the xargs. Thank you Janos and community! – Nona Man Apr 7 '12 at 7:13
  • 1
    Sure!grep -l '@error' * | tee list.log | xargs sed -i 's/error/nothing/g' – janos Apr 10 '12 at 13:16
0
grep -l @error * | xargs sed -i s/error/test/g

will work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.