Hi, I'm dealing with a compromised website, in which hackers injected an htaccess instruction to redirect traffic. I can easily locate .htaccess files that contain the forwarding hack, BUT in cases where the directory already contained an htaccess file, they appended the dangerous instructions, so I cannot just deleted any htaccess file or could harm the site by letting formerly pw-protected directories wide open, or urlrewrite instructions (WordPress) be deleted, etc. I could not find the way to locate files that only contain those 4 lines of redirect hack, could you shed some light ? So far, using

find . -type f -exec grep -q targetpiratedomain {} \; -exec echo rm {} \;

Thanks !