Question

I just noticed that my website got hacked and all the .php files have a base64 encode string on line 1. The string is the same across every file so…

How can I search my entire root directory and remove this?

Answer 1

try:

find /path/to/dir -type f -name '*.php' -exec sed -i '/string-to-remove/{1d;}' '{}' \;

edit:

• added -name '*.php' to restrict this to .php files.
• added sed matching directive