Find a block of code

[grandmastertuck]

Hello all, I’m a new user to the forum, and I have a question for you knowledgeable folk. I recently got hacked and the hacker planted some blocks of code for a Yahoo! Counter that I never installed. I need to know if there is a way to tell which PHP file this block of code is hidden in. I use a simple CMS for my website, and it has hundreds of PHP files that assemble the pages, and I have no idea which one of those has this rogue code. I have spent hours digging through the filetree, bringing up each PHP file, inspecting it, then closing it, to no avail. I just can’t find this code, but when I view the page’s source in my browser, there it is.

Is there some kind of tool that can be installed server side that will allow me to conduct a search of all the php files in the tree, looking for this block of code? Or is there some simple way to accomplish this? I am at my wits end, here.

thanks so much for all your help. Without folks like you, us novice programmers would never get to be as skilled as you.

-Jake

[Zyppora]

CMS systems could use a templating system. I’d suggest searching the templates for any suspicious code. If you know when this code was deployed, you could check out the timestamps on the files to see where it may be. Also, the code could be stored in your database, be sure to check that out too.

Lastly, make sure you patch up the security hole through which the code came in, and, if it’s indeed Yahoo-related, inform Yahoo of this.