I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames.

malicious code

How to use SED or another command to remove all these in all files?

  • why not re-install it over it? – alexus Mar 9 '15 at 21:35
  • There is a ton of sites, several different themes – Adamz Mar 9 '15 at 22:55
  • 2
    You should restore from a working backup, that is the only proper way to recover. – Tero Kilkanen Mar 10 '15 at 6:05
  • 1
    I'm going to close this as a duplicate of the question dealing with compromised server because that's the right way to deal with this issue, but if you want to insist on using that workaround, you should check out the Super User and Unix & Linux Stack Exchanges. – Cristian Ciupitu Mar 10 '15 at 16:01
  • It is a question about how to use a command – Adamz Mar 11 '15 at 6:48

Try this with GNU find and sed to remove those lines in php files:

find /path/to/dir -iname "*.php" -exec sed -i -e '/^\/\/###==###/,/^\/\/###==###/d' '{}' \;
  • Perfect! thanks a bunch, Sed accepts a range? the comma is just a from this to this? A lot of other info on the web points to using lookahead switches etc this here is a much better way than all the perl methods I have found and elaborately concocted sed commands. – Adamz Mar 10 '15 at 7:01
  • Yes, sed can remove everything from matching line to matching line. – Cyrus Mar 10 '15 at 7:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.