Question

My server has been infected with malware. I have upgraded my Linux server to the latest version and no new files are being infected, but I need to clean up all the files now.

I can locate all the files doing the following:

grep -H "gzinflate(base64_decode" /home/website/data/private/assets/ -R | cut -d: -f1

But, I want to now delete the line containing gzinflate(base64_decode in every single file.

Answer 1

I’d use sed -i '/gzinflate(base64_decode/d' to delete those matching line in a file:

... | xargs -I'{}' sed -i '/gzinflate(base64_decode/d' '{}'

Note: You really want to be using grep -Rl not grep -RH .. | cut -d: -f1 as -l lists the matching filenames only so you don’t need to pipe to cut.

Warning: You should really be concerned about the deeper issue of security here, I wouldn’t trust the system at all now, you don’t know what backdoors are open or what files may still be infected.