Cleanup php files from virus

I'll get mallwared site hosted on linux hosting. All php files now start from lines:

<?php
$md5 = "ad05c6aaf5c532ec96ad32a608566374";
$wp_salt = array( ... );
$wp_add_filter = create_function( ... );
$wp_add_fil开发者_如何学Pythonter(  ... );
?>

How I can cleanup it's with bash/sed or something?

---

You should restore your backup.

---

FILES="*.php"
for f in $FILES
do
  cat $f | grep -v 'wp_salt|wp_add_filter|wp_add_filter' > $f.clean
  mv $f.clean $f
done

---

Just a warning, the wp_add_filter() recursively evaluates encoded php code, which in turn calls another script that is encoded and evaluated. This larger script not only injects malicious code throughout your site but appears to collect credentials, and execute other hacks. You should not only clean your site, but make sure the flaw is fixed and any credentials that might have been exposed are changed. In the end, it appears to be a wordpress security issue but I've not confirmed this. I've added some comments on this over at http://www.php-beginners.com/solve-wordpress-malware-script-attack-fix.html, which includes a clean-up script and more information on how to decode the malicious script.

---

You can do it with PHP (fopen, str_replace and fwrite) . There shouldn't be any encoding problems.

---

I just hit with this on a very full hosting account, every web file full of php?!

Much digging and post reading everywhere I came across this guys cleaner code (see http://www.php-beginners.com/solve-wordpress-malware-script-attack-fix.html) - and tried it on a couple of the least important sites first.

So far so good. Pretty much ready to dig in and utilize it account wide to try and wipe this right off.

---

The virus/malware seems to be called "!SShell v. 1.0 shadow edition!" and infected my hosting account today. Along with the cleaner at http://www.php-beginners.com/solve-wordpress-malware-script-attack-fix.html, you actually need to discover the folder containing the shell file that gives the hackers full access to your server files and also discover the "wp-thumb-creator.php" that's the file that does all the php injection. I've posted more about this @ my blog: http://www.marinbezhanov.com/web-development/6/malware-alert-september-2011-sshell-v.1.0/