Results 1 to 10 of 10
  1. #1
    Join Date
    Aug 2006
    Posts
    261

    Need SSH Script to fix infected files

    A client failed to keep their Wordpress up to date, and it was compromised. The hacker was also able to modify all php files for the one account, which happens to be a few thousand. I have upgraded wordpress and ensured the hole is fixed, however I now need to clean all the other files.

    The code was injected at the top of every php file,
    so the php files now look like this:
    (the code is sometimes different in makeup, but always at the top before the correct php code)

    <?php $zfdcebebec = '-%x5c%x7824y7%x5c%x7824....... ?><?php normal file
    line 2 of normal file
    line 3 of normal file
    ...
    ..
    ..
    line 3423 of normal file ?>

    I need a shell script that will search every php file and remove the first set of <?php .... ?> if two are found. (aka removing the bad code, leaving the good stuff)

    I need this ASAP. I am willing to pay $50-100.

    Please PM me if interested.

  2. #2
    Join Date
    Apr 2007
    Location
    US, UK, Europe, ME
    Posts
    258

  3. #3
    Hello,

    PM sent. Kindly check.

    Thank you
    Andrew N. - Senior System Administrator
    Are you in need of an urgent help? 10 minutes response time!
    EmergencySupport - Professional System Administrator and R1Soft Backup Services

  4. #4
    I can do it.

    My skype is: techsupportapps

  5. #5

  6. #6
    Join Date
    Dec 2003
    Posts
    936
    I have already sent him the scripts
    Primary email: advanced dot programmer at gmail dot com ..

  7. #7
    Quote Originally Posted by superprogram View Post
    I have already sent him the scripts
    Okay great

  8. #8
    Join Date
    Nov 2009
    Location
    /etc/my.cnf
    Posts
    10,039
    Wouldn't it be better to restore clean backups and upgrade where possible as infected files are still infected and most likely could be infected else where too.

  9. #9
    Join Date
    Jun 2003
    Location
    World Wide Web
    Posts
    581
    Hi,

    We are interested in this.

    You can contact us in Skype or via the livechat facility in our website https://www.supportexpertz.com

    Our skype id is logic.meeting

    Awaiting your response.
    SupportExpertz.com - the name says it all!
    Managed Cloud Servers
    Server Management and Monitoring
    24x7 outsourced customer support

  10. #10
    Join Date
    Jan 2014
    Location
    Fort Lauderdale
    Posts
    360
    Yea clean backup sounds like a better alternative. If I were infecting files, I would put a line you can find and at least one you cant.

Similar Threads

  1. Hiring somebody skilled to fix my Malware infected server
    By Urosino in forum Employment / Job Offers
    Replies: 8
    Last Post: 12-05-2013, 02:48 PM
  2. SSH Script - Find all files larger than 5MB in HOME
    By kenji.lee in forum Hosting Security and Technology
    Replies: 2
    Last Post: 03-13-2010, 09:25 PM
  3. PHP Script to edit SSH files?
    By kohkindachi in forum Programming Discussion
    Replies: 10
    Last Post: 07-07-2009, 07:23 PM
  4. all index files got infected
    By assassin85 in forum Hosting Security and Technology
    Replies: 101
    Last Post: 07-15-2007, 10:54 PM
  5. CHKrootkit Scan Details -bindshell infected- how can i fix?
    By cyberturk in forum Hosting Security and Technology
    Replies: 4
    Last Post: 03-01-2006, 10:36 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •