The Gumblar.a trojan infected 4 sites on my Hostmonster server. This should be easy to fix if I knew what to enter through the SSH command line to do a search and replace. The string that needs to be replaced recursively through hundreds of files in multiple folders is a long javascript string that contains forward slashes, back slashes, and quotation marks. How can we write a search & replace for a fairly long block of text that contains characters that are otherwise reserved for the Linux command itself?
FYI: the virus inserted a javascript in the head of every HTML file, the bottom of every PHP file, and appended a line of text into every .js file. Not hard to clean out of the sites, but nasty if it infects local machines. It loads Trojans onto the visitor's machine. In this case, it got each of the sites listed by Google as an "attack site". Big warning page appears when you enter the site. 10's of 1000's of sites were infected. In my case, a php config file had permissions set at 744. Too high. Lowered the permissions and it should be less vulnerable now.