0

I need to delete thousands of files that have similar names but different endings. They were created by malware that attacked a client's shared hosting and infected multiple wordpress sites. I'm using SSH in place of the cPanel file manager because it won't let me delete that many files at once.

The files are all named work.php.xxxx The x's represent numbers between 0 - 9999 i.e "work.php.2048" They are all in one folder.

Is there an SSH command that would allow me to delete them and only them in mass?

This is different from the suggested duplicate because the files all have unique endings after the .php extension, the suggested solution to that problem would not work for me.

Giacomo1968
  • 53,069
  • 19
  • 162
  • 212
Jetsetskyking
  • 3
  • 2
  • https://superuser.com/questions/392872/delete-files-with-regular-expression and https://superuser.com/questions/112078/delete-matching-files-in-all-subdirectories – music2myear May 20 '19 at 21:59
  • 2
    Possible duplicate of [Delete matching files in all subdirectories](https://superuser.com/questions/112078/delete-matching-files-in-all-subdirectories) – music2myear May 20 '19 at 21:59
  • Basically, you can use wildcards. While the marked duplicate is for files that END the same, you will simply flip things to search for and delete things that begin the same. – music2myear May 20 '19 at 22:00
  • HOWEVER!!! Having dealt with viral infected WP installs myself, you should actually backup the database, record all of the plugins and themes and the wpconfig file, and then delete ALL OF THE FILES on the host. Period. EVERY SINGLE ONE OF THEM. Then, get fresh, clean copies of the WP install, set up a fresh wpconfig file using the info from the old one but with the nonce salts changed, and then find and install the plugins and themes fresh. – music2myear May 20 '19 at 22:02
  • Then you should spend some time investigating how the infection started and work to secure the server to prevent it from happening again. – music2myear May 20 '19 at 22:02
  • If you can't delete these files from the command line, you might want to reconsider if you have the correct skillset to clean up after a WP malware infection. – Eugen Rieck May 20 '19 at 22:53
  • Thankfully I've already cleaned them up before and don't have to consider anything, and that the internet is a big enough place for me to fill in any lapses of knowledge. Also If it wasn't clear, I was looking for an efficient method of doing so, There are multiple ways to delete them. – Jetsetskyking May 20 '19 at 23:02
  • Thanks for the advice music2myear, the only reason I'm doing it manually is that I haven't heard back from the designer about getting a clean theme replacement, and other plugin licenses, everything i can is being replaced and I'll see where that leaves me. – Jetsetskyking May 20 '19 at 23:10

1 Answers1

0

I recommend doing this in two steps to make sure you get the results you want. First, move files to an empty folder.

user@linux:/.../somefolder#                 cd [TargetFolder]
user@linux:/.../TargetFolder#               mkdir DeleteFolder
user@linux:/.../TargetFolder#               find ./ -regex './work.php.[0-9][0-9][0-9][0-9]' -exec mv {} DeleteFolder/ \;
user@linux:/.../TargetFolder/DeleteFolder#  cd DeleteFolder
user@linux:/.../TargetFolder/DeleteFolder#  ls -l *

if your DeleteFolder contains only the files you want to delete, do the following:

user@linux:/.../TargetFolder/DeleteFolder#  rm work.php.[0-9][0-9][0-9][0-9]

You can obviously use rm work.php.[0-9][0-9][0-9][0-9] within the target folder if you want to do it in one step. I am personally quite cautious when using rm - hence then two-step method.

Brian
  • 977
  • 1
  • 9
  • 24
  • Thank's I'll definitely remember this. – Jetsetskyking May 20 '19 at 23:04
  • Happy to help. Please note I made an edit to a typo I made regarding the "DeleteFolder". In the line containing, "-exec mv {}" I originally had "del/" instead of "DeleteFolder". the "del/" was mental shorthand for "DeleteFolder/". – Brian May 20 '19 at 23:12