Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a malware on my server. So I've figured out how to find all that malicious files

 grep -r --include*.php "Some String from files" .

That seems work fine!

but how to delete them? I've tried using xargs

grep -r --include=*.php "FilesMan" . | xargs -I {} rm {}

But got

rm: cannot remove `./www/wp-content/plugins/zuglohjetok/vaoaddiy.php:$default_action = FilesMan;': No such file or directory

Can someone share some magic line of code?

And also I've tried to look up for all recent modified files on server by "find", but that got me tons of files. Is there any other fancy methods to find malware or infected files?

share|improve this question

migrated from Jan 12 '13 at 15:21

This question came from our site for professional and enthusiast programmers.

Probably not what you want to hear, but systems that have been infected by malware usually cannot be trusted. Partial recovery might lead you to think your system is secure again, which may not be the case. I would recommend wiping everything and reinstalling from scratch. – Frédéric Hamidi Jan 12 '13 at 11:57
Frédéric, you're right! I'm still need to do some research on that. But it looks like malware got in by a web shell script, through some plugin in old unupdated wordpress. but that should be still confirmed. The script its self was just creating directories with index.html files with redirect to some spammy websites. That all harm I've found has been done so far – Alex Reds Jan 12 '13 at 12:06
Sorry to say that, but the fact that you've not found more doesn't prove the absence of more. Related: How do I deal with a compromised server? – Jonas Wielicki Jan 12 '13 at 14:41
@Jonas, no doubt! I still need to do some deep research. But from what I have found out already, this is the work of this script "Web Shell by oRb". And as far as I can tell, this script got in through some wordpress plugins. Thanks for the link, will read it – Alex Reds Jan 15 '13 at 22:41
@AlexReds from what I was able to find, its the worst category of malware you can get, as it gives the attacker something similar to a shell. – Jonas Wielicki Jan 16 '13 at 11:12
up vote 5 down vote accepted
find some/dir -iname '*.php' -exec grep -q "some string" {} \; -delete

Use -print instead of -delete to make sure the command works as expected first.

share|improve this answer
thanks Ignacio, will try it now – Alex Reds Jan 12 '13 at 12:14
So it works flawlessly. Thanks Ignacio for the quick respond! – Alex Reds Jan 12 '13 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .