Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

my php based website got infected with malware, which added something like this in the code:

<?php eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWh));

Now i want to replace all the "eval(" till its ending braces "));" with space or delete all those occurences, either with sed or other tools.

i have tried this

sed 's/eval\*/ /g' code.php

But its not working.

What can be its solution?

Thanks in advance.

share|improve this question

marked as duplicate by SvW, Iain Mar 15 '12 at 8:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
If you get infected with malware, don't try to "clean" it. Start over from a backup. Also, just editing this stuff out will last a few minutes or hours before the attacker does it all over again. Find the root cause and make sure it can't happen again on the newly installed machine –  SvW Mar 15 '12 at 8:45
    
@SvenW: i had backups, but they were old. so the only way is to replace the text. And i have found the root cause and fixed it, now just need to clean the code. –  Farhan Mar 15 '12 at 8:48
    
IMO, 'the backups were too old' is not a valid answer to solving the problem. Never trust a compromised site/server. You do not know what else got changed. Take your old backups, and edit the code from there. Learn from this experience. Your only way is a dangerous one, because you don't want to put time in it. –  Lucas Kauffman Mar 15 '12 at 8:50
    
@LucasKauffman I am already aware of the dangers of it, what i am doing, i cannot tell everything in detail. –  Farhan Mar 15 '12 at 8:52
add comment

1 Answer

up vote 4 down vote accepted

As SvenW says the only real solution to this is to reinstall from a known good backup. You could try

sed 's/eval(.*);//' code.php

which given your input produces

<?php

But you don't know what damage has been done to the system so nuke it from orbit and restore from a known good backup - it's the only way to be sure.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.