Malware Removal from the server

Unfortunately, there isn’t an easy or quick way to do that –
you must go through all of the steps to clean that up or it will happen again –

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

I know this is way too late but I’ll reply here in case someone else has this issue.

there is a way to do this in linux IF you have shell access to the server. It involves using the ‘find’ tool and the ‘sed’ tool.

However, it is NOT for the faint of heart. You really need to know what you are doing at the server level.

this is a simple example..

find . -name “*.php” -print | xargs sed -i ‘s|words to find|replace with (can be blank)|g’

You would run that from the /home/ directory. It would recursively find all files on all user accounts that are .php files…would then do the replacement

It is a good idea to backup before attempting this sort of thing.

For the advanced coder, sed is a regular expression capable engine. So you could do sed -i ‘s|<script>.*</script>||g’

one way to test this before throwing it at the whole filesystem is to run sed by itself on a single file.

sed -i ‘s|replaceme|withme|g’ testfile.php

then you can make sure it works and does the job before going global.

Lots of resources exist on this..just search google for ‘find and sed’