Pretty new at shell scripting. My server was hacked and instances of links for viagra were placed in it. I have lots of sites, so I need to search for all instances of "viagra" and list the files, so I can go remove the intrusions. Can this be done using shell?

Thanks.

I'm going out on a limb and assuming you are using linux. If that is the case you can use grep to find the word:

sk@svn:/tmp$ ls
sk@svn:/tmp$ mkdir -p ./some/junk/dir
sk@svn:/tmp$ echo "viagra" >> ./some/junk/dir/somefile.txt
sk@svn:/tmp$ grep -l -r -i viagra .
./some/junk/dir/somefile.txt

For grep --
-l: list files, not the lines
-r: recursive
-i: case insensitive

Are you using wordpress it happened with me few days back ... the reason was the old version of wordpress

Pretty new at shell scripting. My server was hacked and instances of links for viagra were placed in it. I have lots of sites, so I need to search for all instances of "viagra" and list the files, so I can go remove the intrusions. Can this be done using shell?

Thanks.

Yes, it can. A simplistic way to find all affected files, leaving you to do the rest of the work:

find / -type f -exec grep -li viagra {} \;

Or, assuming you are on a reasonably POSIX-ish system, a more complex way to find and edit all affected files, minimizing the effort you must exert:

find / -type f -exec grep -li viagra {} \; | while read a; do
  echo -n "Press <ENTER> to edit "
  tput smso
  echo -n "$a"
  tput rmso
  echo "  or <CTRL/C> to quit"
  read b </dev/tty
  vi "$a" </dev/tty
done

The tput() commands assist clarity, but aren't vital; delete them if your system doesn't speak terminfo. This is re-entrant. You don't have to remember where you were when you took a break or erred; once the noxious content has been removed, find() won't find it again.

This works on Debian Linux.

This article has been dead for over six months. Start a new discussion instead.