4

My CMS is full of SPAM scripts and they are almost in every folder. I figured out, that I can find those scripts by using this find/grep command:

sudo find . -type f \( -name '*.php' -or -name '*.node' \) -exec grep -i "eval(base64_decode" {} +

Well some of the files just contain the spam-script and they are between 300 - 302 Bytes.

But some other files, which are been used by the CMS, are also infected. They should not be deleted completely, just everything from the first character untill the first php closing ("?>").

First I used the "delete" command and wrote this:

sudo find . -type f \( -name '*.php' -or -name '*.node' \) -exec grep -i "eval(base64_decode" {} + -delete

But that was a big mistake because I deleted all my important files. Before I delete more files, I just wanted to ask how to do it?

Something like: Get every file the code above finds and check if it is between 300 - 302 bytes, if yes -> delete it. If no -> Delete the first PHP section. But important!!! Not deleting the rest! The file is like:

<?php ?> ... <?php ?> ... <?php ?>"

only the first PHP block is infected.

Please can you help me? There are hundreds of files and I don't wanna do this by my own.

Thanks a lot in advanced!

Improve this question
1
  • 1
    If your CMS is infected you may want to just purge the entire CMS and start anew, rather than go hunting for one malicious file, especially if the script has spread to multiple additional pages in the CMS.
    – Thomas Ward ♦
    Commented Oct 13, 2014 at 12:13

1 Answer 1

Reset to default
3

You can try the following command which will call a perl find/replace command for every file matching the "eval(base64_decode" pattern:

sudo find . -type f \( -name '*.php' -or -name '*.node' \) -exec grep -li "eval(base64_decode" {} \; 2>/dev/null | xargs perl -i -p0e 's/<\?php.*?\?>//s'

The perl part will just remove the first <?php ?> block in the files returned by the find command.

Improve this answer
2
  • @user1130108: I'm glad that you've found this ugly command useful. Remember Thomas's advice, you should purge your CMS as many other files could be infected in different ways.
    – Sylvain Pineau
    Commented Oct 13, 2014 at 12:38
  • +1 on Sylvain for this beautiful "ugly" command line.
    – Cbhihe
    Commented Oct 13, 2014 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .