Find and Replace Shell Commands

Question

I have a wordpress installation that is infected.. Mostly theme files and plugin files..

I need 3 commands and i will be using putty:

1- inside root and recursive sub-directories folders change all 200 permissions to 644 (for some reason every time i change this manually it come back to 200 after a minute)

2- inside root and recursive sub-directories folders to replace content of index.php

with:

3- delete all php.ini files inside root and recursive sub-directories folders.

Answer 1

0 Backup!

1 If permission change every minute, probably you have a script that run every minute... in any case

 find . -type d -exec chmod 755 {} \; // for directories
 find . -type f -exec chmod 644 {} \; // for files

2 You have to use sed or somethings similar, according to string to replace.

3

 find . -iname "php.ini" -exec rm -fv {} \;

4 Call an expert and find how your wordpress installation has been hacked.