Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often have problem with sites that get hacked. Usualy they end up with inserted script in different files. Is there a way, on linux, to search for this content and automaticaly delte it ? Usualy this content starts with, and ends with something like this.

<!--2d3965--><script type="text/javascript" language="javascript">

Would it be possible to use some kind of combination of grep to search for files containing this content and then pipeing it to sed to delete everything from


share|improve this question

I wrote such script, it could be useful.

#!/usr/bin/env python
import os
import sys

for infile in sys.argv[1:]:
    print infile
    f = open(infile, 'r')
    ftmp = open(filetmp, 'w')

    for line in f:
        if BEGIN in line:
            #print line.partition(BEGIN)[0]
        if END in line:
           #print line.partition(END)[2]
            if not skip:
    #you can add save restrictions here
    os.rename(filetmp, infile)

You should give:

  1. filename with virus
  2. string, which marks virus begin string
  3. string, which marks virus end

    Don't forget to change permissions back, if file requires it. btw, I think, it's appliable only for text files.

Please test it, and backup before using.

Use it in this way:

python index.html js/jquery.js
share|improve this answer

I would add this files into subversion or git and automatically compare the official version of this files with the files on the sites on a regular basis. If you see a difference you know you had been hacked and can search for the leak. Meanwhile you then can restore the original file from the versioning tool.

share|improve this answer
Unfortunately I don't think this would work since I have a webhosting server with allot of users. I would need to add all client websites to git for this to work + users usualy change their files too. :( – Pracovek Sep 10 '13 at 9:40
then how do you know whats legitimate and what not? Could your clients add the correct files into git? Advantage for them would be that they also could role back if something bad happens. – Hartmut Sep 10 '13 at 9:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.