Remove lines containing a string from all files in directory

last night our server was hit with an attack that infected every php file on the server and inserted the following code

Code: /*god_mode_on*/eval(base64_decode with a ton of other characters after.

As it infected every php file i have been trying to clean it using a sed command to go through and remove the code from each file.

I have been trying to run

Code: find .

Hello.

I have a malware on my server. So I've figured out how to find all that malicious files

grep -r --include*.php "Some String from files" .

That seems work fine!

but how to delete them? I've tried using xargs

grep -r --include=*.php "FilesMan" .

Possible Duplicate: My server's been hacked EMERGENCY

my php based website got infected with malware, which added something like this in the code:

<?php eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWh));

Now i want to replace all the "eval(" till its ending braces "));" with space or delete all those occurences, either with sed or other tools.

i have tried th

I want to remove the first line in all files that have match with the next grep command:

grep -Rl '<\?php /\* <!-----.*/\?>' ./

These files were hacked and I want to remove this line. I tried with several commands with "sed" but with no result, commands like this:

sed 's/<\?php /\* <!-----.*/\?>//g' ./*

Thanks, best regards.

Edit.

I’m sorry that this WordPress blog was infected by the Cechirecom base64 hack/virus few days ago.The visitors from google were redirected to a blank page at http://www2.burnvirusnow34.xorg.pl where it told that they were infected and need to install the antivirus program they provide on that page.I didn’t realise that until someone kind-hearted reminded me because I always visit the

This is the data what I want to sort.

I have a list of zip files and regular files in a folder

Code: /home/data/

Example: PMExtra_A123_ABC_121001020000.zip PMExtra_B596_GRT_121001020000.zip PMExtra_C156_SFD_121001020000.zip PMExtra_S243_KDF_121001020000.xml PMExtra_L234_IDF_121001020000.xml I have to unzip all the .zip files and load into the same folder and remove the .zip files.

.zip files will have the xml files

Possible Duplicate: My server's been hacked EMERGENCY

My Ubuntu 10.04 LTS VPS has been hacked, probably via a WordPress site.

I was alerted to it when I noticed the incoming traffic was unusually high.

A WordPress site was littered with eval(base64_decode(...)) code in lots of files.