SED multiline recursive find and replace

Question

I have a large number of sites with the same bit of php inserted in all files that contain footer in their filenames.

//###==###
malicious code
//###==###

How to use SED or another command to remove all these in all files?

You should restore from a working backup, that is the only proper way to recover. — Tero Kilkanen, Mar 10 '15 at 06:05
I'm going to close this as a duplicate of the question dealing with compromised server because that's the right way to deal with this issue, but if you want to insist on using that workaround, you should check out the Super User and Unix & Linux Stack Exchanges. — Cristian Ciupitu, Mar 10 '15 at 16:01
Did you ever figure out what happened? I got the same thing on my server. Infected all my index and footer php files. — wgpubs, Sep 12 '15 at 17:15

score 1 · Accepted Answer · answered Mar 10 '15 at 06:00

1

Try this with GNU find and sed to remove those lines in php files:

find /path/to/dir -iname "*.php" -exec sed -i -e '/^\/\/###==###/,/^\/\/###==###/d' '{}' \;

answered Mar 10 '15 at 06:00

Cyrus

Perfect! thanks a bunch, Sed accepts a range? the comma is just a from this to this? A lot of other info on the web points to using lookahead switches etc this here is a much better way than all the perl methods I have found and elaborately concocted sed commands. – Adamz Mar 10 '15 at 07:01
Yes, sed can remove everything from matching line to matching line. – Cyrus Mar 10 '15 at 07:13

1 Answers1