[BlueOnyx:03353] Re: Gumblar

[Chris Gebhardt - VIRTBIZ Internet]

Hi Colin,

Colin Jack wrote:
  > Yup – infects PCs and then harvests FTP passwords.
> Bad lads then FTP into your site and modify it.
> 
> We have had two sites compromised so far.
> 
> I would like to search the entire server /home/.sites for signature code 
> but could do with a little help writing a script.


You could do:
# grep -R "SEARCHTEXTHERE" /home/.sites/*

Just replace SEARCHTEXTHERE for the string you want to search for.

-- 
Chris Gebhardt
VIRTBIZ Internet Services
Access, Web Hosting, Colocation, Dedicated
www.virtbiz.com | toll-free (866) 4 VIRTBIZ