<!DOCTYPE html> <html> <head> <title></title> </head> <body><div>Hi Gareth,<br></div> <div> </div> <div>On Tue, 16 Sep 2014, at 09:56 PM, Gareth France wrote:<br></div> <blockquote type="cite"><div>Eh? <br></div> </blockquote><div> </div> <div>Simon has given a quick account of the traditional Unix file searching tools, grep, find and xargs (which isn't technically a searching tool but is very often used with them). They are very powerful, but take a good amount of practice to use most effectively.<br></div> <div> </div> <div>To be a little more helpful, could you perhaps give a quick rundown of what you have to work with? If you have command line access, it should be possible for someone on the list to help walk you through using find etc. to track down the files which have been compromised. Otherwise, it may be a little trickier, but perhaps the easiest way might be to FTP (or however you usually transfer) the files to your local machine, do the command line trickery on that, and then re-upload the clean files afterwards.<br></div> <div> </div> <div>There is a small niggle at the back of my neck about never trusting a compromised box, and of course you also will want to track down the vulnerability that initially allowed the bad guys in, else you'll just be back to square one before long!<br></div> <div> </div> <div>Thanks,<br></div> <div>Josh</div> </body> </html>