Remove virus in wordpress with SED in a vps with linux

You have a big problem, I think. To start: removing those scripts may make the page unusable.

I would begin by doing these actions: 1) IMPORTANT: backup of all sites (FTP and DB).

2) Disable all site plugins from the wordpress admin and then deactivate the site from the hosting panel so that it is not available online.

3) I would remove the wp-admin and wp-includes folders and everything in that level except wp-config.php and .htaccess. (That is, it would only leave .htaccess and wp-config.php and the wp-content folder.)

4) It would remove (by pointing the names before), the plugin folders that are in wp-content / plugins

5) I would upload the plugins folders by ftp. This is: first download the zip of the plugins, unzip it and the folder with the name of the plugin upload it to wp-content / plugins

6) search any resident .php file in uploads (In uploads there should be nothing * .php) as much as the index.php with the echo of "Silent is gold".

7) Unzip a wordpress from the same version that you had installed and upload all the content, overwriting wp-content when it asks for it. This is necessary to ensure that the installation is clean.

8) In the wp-config.php file, you would add two lines at the end:

define('FS_CHMOD_FILE', 0644);
define('FS_CHMOD_DIR', 0755);

9) Activate the site, log in and activate the plugins.

This is not the total remedy, but at least you can solve the script problem I think. A lot of luck (Do not forget the FTP backup and the BBDD first of all)

The problem lies in the expression of Thirst that you use: when you say sed '/búsqueda/d' you are deleting all the lines that contain "search".

What you surely need is sed 's/búsqueda//' , which will replace "search" with nothing, eliminating it.

See an example:

$ cat fichero
hola
que tal estas
hola var bu ba
var va2
$ sed '/var/d' fichero
hola
que tal estas
ea
$ sed 's/var.*//' fichero
hola
que tal estas
hola 

In your case:

find . -name "*.php" -exec sed -i.bak 's/var _0xfcc4.*{a\(\)}}//' '{}' \;

Notice also that by doing sed -i '...' you are overwriting the file. This is dangerous, because if you do not do what you want, you lose the original. Hence, put sed -i.bak to save a backup file.

I do not know if you have already solved it, I suppose that at this point I am sure that it is. As a quick measure, what I did is, instead of eliminating the whole block, what I did was comment on the variable. With that, it was already solved quickly, then it was a matter of crushing all those files js by the original.

find . -type f -name "*.js" -exec sed -i 's/var _0xfcc4=/\/\/var _0xfcc4=/g' {} +

That was the quickest solution to apply as a first step with certain guarantees of not breaking anything, since it only commented on that "infected" line.

In addition to cleaning the .php I suggest you use wp-cli to force the reinstallation / update of the core, themes and plugins of each wordpress.

The sequence would be:

# cambiar a carpeta donde está el wp-config.php
cd /carpeta/del/wordpress 

# descargar e instalar la última versión de wordpress
# (cachea la primera descarga la usa para todas las demás)
wp core download --force

# descargar e instalar la última versión de los plugins
# (cachea la primera descarga la usa para todas las demás)
wp plugin install $(wp plugin list --field=name) --force

# descargar e instalar la última versión de los themes
# (cachea la primera descarga la usa para todas las demás)
wp theme install $(wp theme list --field=name) --force

• repeat for the other N facilities

Reestablish owners, groups and permissions (here it varies according to the OS and how you have the users of apache / nginx / php)

# cambiar a carpeta donde está el wp-config.php
cd /carpeta/del/wordpress 

# owner y group www-data ajustar según OS y webserver
sudo chown www-data: /carpeta/del/wordpress -R 

# variantes según tu esquema de seguridad 664, 644, 640 
sudo find . -type f -exec chmod 664 {} \; // ajustar a tus users y grupos

# variantes según tu esquema de seguridad 775, 755, 750 
sudo find . -type d -exec chmod 775 {} \; // ajustar a tus users y grupos

# sticky bit para que nuevos archivos hereden el grupo de la carpeta donde se crean
sudo find . -type d -exec chmod g+s {} \; 

special case is wp-config.php that should be more strict wave 440 or 400