-2

I can see same code under all php files.

Starting from 

<?php $rfghoh = '*f%)sfxpmpusut)tpqssu6

And end 

$rfghoh=$yuoopi-1; ?>

I am just looking for script using which only first line of php code get remove not the entire php file.

I tried find -name '*.php' -exec sed -i '/<?php $rfghoh/,/?>/d' '{}' \;

But its removing all content under files though I need to remove just under those tags.

Thanks

user1763672
  • 1
  • 4
    You also need to secure your server, so that you do not get hacked again. Just removing this code won't be sufficient for that. – Michael Hampton May 20 '16 at 12:49
  • 4
    Possible duplicate of How do I deal with a compromised server? – GregL May 20 '16 at 12:53
  • Hi, I did try as per http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server but it did not work.

    I am just missing a little code using which whole php file don't get empty only that content under first php tags.

     – user1763672 May 20 '16 at 12:59
  • I wanted to ask you for a quick answer regarding the code found in your script Starting from <?php $rfghoh = '*f%)sfxpmpusut)tpqssu6 And end $rfghoh=$yuoopi-1; ?> Did you find the cause of it? Do you use Strato as a hosting provider? – Rubén Muñoz Oct 31 '16 at 09:34

1 Answers1

0

use Dreamweaver to find and replace using the folder settings instead of file. (search and replace in all files in a folder)

you can use regex to match the lines you need to replace if the middle of each is different, if the lines are identical its not needed.

but thats just going to get your site back to where it was before being hacked. once cleaned you will need to secure your code.

user3091674
  • 1