I have a malware on my server. So I've figured out how to find all that malicious files

 grep -r --include*.php "Some String from files" .

That seems work fine!

but how to delete them? I've tried using xargs

grep -r --include=*.php "FilesMan" . | xargs -I {} rm {}

But got

rm: cannot remove `./www/wp-content/plugins/zuglohjetok/vaoaddiy.php:$default_action = FilesMan;': No such file or directory

Can someone share some magic line of code?

And also I've tried to look up for all recent modified files on server by "find", but that got me tons of files. Is there any other fancy methods to find malware or infected files?

migrated from stackoverflow.com Jan 12 '13 at 15:21

This question came from our site for professional and enthusiast programmers.

  • 4
    Probably not what you want to hear, but systems that have been infected by malware usually cannot be trusted. Partial recovery might lead you to think your system is secure again, which may not be the case. I would recommend wiping everything and reinstalling from scratch. – Frédéric Hamidi Jan 12 '13 at 11:57
  • Frédéric, you're right! I'm still need to do some research on that. But it looks like malware got in by a web shell script, through some plugin in old unupdated wordpress. but that should be still confirmed. The script its self was just creating directories with index.html files with redirect to some spammy websites. That all harm I've found has been done so far – Alex Reds Jan 12 '13 at 12:06
  • 1
    Sorry to say that, but the fact that you've not found more doesn't prove the absence of more. Related: How do I deal with a compromised server? – Jonas Schäfer Jan 12 '13 at 14:41
  • @Jonas, no doubt! I still need to do some deep research. But from what I have found out already, this is the work of this script "Web Shell by oRb". And as far as I can tell, this script got in through some wordpress plugins. Thanks for the link, will read it – Alex Reds Jan 15 '13 at 22:41
  • @AlexReds from what I was able to find, its the worst category of malware you can get, as it gives the attacker something similar to a shell. – Jonas Schäfer Jan 16 '13 at 11:12
find some/dir -iname '*.php' -exec grep -q "some string" {} \; -delete

Use -print instead of -delete to make sure the command works as expected first.

  • So it works flawlessly. Thanks Ignacio for the quick respond! – Alex Reds Jan 12 '13 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.