Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a couple of hundred .htaccess files and I want to remove mallicous lines from them. On the top they all have:

IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|aol|goto|infoseek|lycos|search|bing|dogpile|facebook|twitter|live|myspace|linkedin|flickr)\.(.*)
RewriteRule ^(.*)$ [R=301,L]

and on the bottom:

ErrorDocument 400
ErrorDocument 401
ErrorDocument 403
ErrorDocument 404
ErrorDocument 500

I'm really lost in sed portion, can somebody help me? :(

I have so far:

find . -name '.htaccess' -exec sed 'pasla-ghwoo' {} \;
share|improve this question
Would it not be easier to restore them from your backups? – Ladadadada Jun 8 '12 at 19:16
This doesn't help with the mechanism used to get the malicious files there in the first place. Fix the root cause, not the symptom. – Shane Madden Jun 8 '12 at 23:41

What do you want to replace it with? I personally prefer this Perl one-liner:

perl -i.bak -p -e 's/find/replace/ig' .htaccess

This creates a backup files modified and adds the .bak extension.

Does that give you enough to get started?

Here is a similar sed e.g,, (untested though!):

sed -i 's/find/replace' 

-i is "in place."

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.