My sites got infected with some bad malware that has inserted malicious code on at least 3135 files (all my wordpress sites).This is one of the files infected: http://pastebin.com/FXU1ht4RAnd here is my desired output: http://pastebin.com/YPJwjiWHI have no idea about Unix commands, besides some simple find and grep commands.After some research I found about the sed command but I don't know how to use it in my case. As you can see from the above code, the general pattern is that the code is inserted at the top of each file, meaning before the original <?php tag (which means now the original <?php tag is second.So I thought I could find all the files containing cnajwp = and remove everything before the second <?php tag.I can find the files containing cnajwp by using find * -type f -name *.php -exec grep -l cnajwp = {} \;but I don't know how to replace everything before the second <?php tag on these occurrences.Could anybody here give me a helping hand?
how to use sed command to replace everything before second occurrence?
shell script;text processing;sed
This uses your command to find the infected files, and gives the list to xargs, which runs an expression on the first line.find * -type f -name *.php -exec grep -l cnajwp = {} \; |xargs sed -i -E '1s/^(<\?php) \$ocnajwp =.*$/\1/'According to your input-file sample, this should do the trick.Since in the meantime you have found files, where the infection was placed slight differently, and you have ended up with some files, where both first lines contain <?php, you could run the following to clean up those files:find * -type f -name *.php -exec \gawk -i inplace 'NR==2 && /^<\?php$/ {next} 1' {} \;