Shell Programming and Scripting

Hi,

Someone hacked my site(s) and appended a header to every .php file in every domain. With several Word Press sites, you can imagine how many files that is! I hand edited some, but it is just a huge task to edit the thousands of files.

I was a long time Linux scripter, but have not done it in years. I need help!

The offending code is nicely set inside php tags. So, if I can delete it either by start characters "<?php" to the first "?>" or more simply, delete up to and including the first "?>" or even the first ">", that would do it.

I have tried a few things like sed and awk, but sed seems to work on lines and not a character by character and this code does not have a newline after it...

I can find the files with grep -l base64_decode *.php or something along those lines.

I hope I am not being a bother. I am pretty tired after working on this for hours. I know someone can write this off the top of their head.

All the files look like this:

<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCc.....gfSAgb2Jfc3RhcnQoJ21yb2JoJyk7ICB9ICB 9"));?><? real code for file.....

And there are no other ">" until that one that marks the end of the virus code...

Much thanks!
-Swank

Restore the site from a backup, god knows how many other files have been changed/replaced with trojans.

You can never trust your server again after a rootkit or whatever has been thru it.

Ugh. I think you are right. After cleaning a batch, they all got reinfected. No idea where the crap is coming from and not sure how to find out....

8+ domains hosed! No idea when the last full back-up was...

If you really need to clean up these php files try this awk script:

Code:

awk '
    NR==1&&/^<\?php .... eval\(base64_decode/ {K++}
    K&&/?>/ {sub(/^[^>]*?>/,"");K=0}!K' file

---------- Post updated at 01:25 PM ---------- Previous update was at 01:21 PM ----------

You could tgz up all your .php scripts and clean them on another server using something like the above, at lease you wont lose any code then.

Alternatively perhaps try this code as well:

Code:

awk '!/^\?php.*base64_decode/' RS=\< ORS=\< infile

or otherwise:

Code:

awk -F\> '/^\?php.*base64_decode/{$1=x}1' OFS= RS=\< ORS=\< infile

Ungrade to the latest Wordpress release. Remove as many addons as possible. Look under the Wordpress images directories. Remove any non-image files such as .doc, .php, etc. Any file with 3 numbers in it is suspicious and needs to be carefully checked. Also check all your .htaccess files. Check your permissions are correct on every file and directory.

Which hosting company are you with? There are a couple of major hosting companies who have this particular infection.