-1

I have a vps server that had been attacked with a virus which keeps injecting many hidden files. How can I delete all hidden files in directories and sub directories of the public_html folder, except two files: .htaccess and .user.ini?

I have tried the below Linux command, but without success:

find "public_html" -type f -name '.*' -delete !(".htaccess"|".user.ini")
10
  • 2
    That's doesn't seem like a good idea, to just delete the files that the virus is creating.... – Dave Jan 18 at 16:41
  • I guess I have already killed the virus , I have installed wordfence and I have added many security precaution , the virus was not able anymore to stop my website , it did it many time before ; I need now just deleting the restes of this virus – sabdel sabdel Jan 18 at 16:45
  • Why not just delete everything on the server and reupload the important files? – Dave Jan 18 at 16:46
  • I have many website hosted on this vps server I can't start from the scratch – sabdel sabdel Jan 18 at 16:48
  • 1
    You're fighting an uphill battle ... like taking aspirin against COVID. Take the machine off-line, make a full-disk clone for forensics; find out how the malware got there, restore from the last good known back-up and patch the access vector. – tink Jan 18 at 16:55
1

As people have already told you in the comments, this is a very bad idea. You will never be sure you've cleaned everything up and standard procedure for something like this is to wipe the sever and restore from a clean backup.

That said, the reason your find command isn't working is because find doesn't understand extended globbing patterns like !(".htaccess"|".user.ini"). Instead, you need to use find's own syntax:

find . -type f -name '.*' ! -name .htaccess -a ! -name .user.ini -delete

Or

find . -type f -name '.*' ! \( -name .htaccess -o -name .user.ini \) -delete
1
  • Thanks @terdon , you answer me question – sabdel sabdel Jan 18 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.