From owner-freebsd-questions@FreeBSD.ORG Thu Dec 4 12:32:01 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0D0801065673 for ; Thu, 4 Dec 2008 12:32:01 +0000 (UTC) (envelope-from mcoyles@horbury.wakefield.sch.uk) Received: from smtp2-wak.yhgfl.net (smtp2-wak-ext.yhgfl.net [89.207.208.43]) by mx1.freebsd.org (Postfix) with ESMTP id 9E7368FC13 for ; Thu, 4 Dec 2008 12:32:00 +0000 (UTC) (envelope-from mcoyles@horbury.wakefield.sch.uk) Received: from horbury.wakefield.sch.uk ([10.126.96.34]) by smtp2-wak.yhgfl.net (8.13.8/8.13.8/Debian-3) with ESMTP id mB4CF6I4029390 for ; Thu, 4 Dec 2008 12:15:07 GMT Received: from ITTEAM02 [10.126.96.253] by horbury.wakefield.sch.uk with ESMTP (SMTPD32-7.07) id A9C528D0020; Thu, 04 Dec 2008 12:15:01 +0000 From: "Marc Coyles" To: Date: Thu, 4 Dec 2008 12:14:58 -0000 Message-ID: <002b01c95609$ed0c7200$c7255600$@wakefield.sch.uk> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AclWCezrNx3MuBYcTUS+XfHfWuXp4g== Content-Language: en-gb X-YHGfL-MailScanner-Information: Please contact the YHGfL Foundation for more information X-YHGfL-MailScanner: Found to be clean X-YHGfL-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0, required 0.5) X-YHGfL-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-4.399, required 5, autolearn=not spam, ALL_TRUSTED -1.80, BAYES_00 -2.60) X-MailScanner-From: mcoyles@horbury.wakefield.sch.uk Subject: Mass find/replace... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: mcoyles@horbury.wakefield.sch.uk List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Dec 2008 12:32:01 -0000 Never had to do this so not sure where to start. Have googled and found some solutions but they don't particularly work (see below)... Someone has managed to inject php code into a PILE of php pages on my webserver... "" This basically brings up a pile of spam links. I need to do a find / replace throughout the entire of the /home/horbury/public_html directory... I've tried 'find /home/Horbury/ -type f | xargs grep -l base64_decode' to get a list of the files that require the operation performing, but it comes up with an error (xargs: unterminated quote) after a few results... Any tips? Basically to find the above and remove it... otherwise I'll have to resort to doing it in Dreamweaver and reuploading, which is a major pita, or restoring from a backup (after working out when exactly this happened and how - I'm guessing thru a teacher's out of date wordpress install somewhere). Marc A Coyles - Horbury School ICT Support Team Mbl: 07850 518106 Land: 01924 282740 ext 730 Helpdesk: 01924 282740 ext 2000