In message <eeadcf600901140059l1ebc9788redd1f3c6d721aa7d@xxxxxxxxxxxxxx> , Farhan khalid <farhan2kf@xxxxxxxxx> writes >i have 400 folders in ftp in one site with index.php and all 400 index.php >files are injected with this code and this is just 1 site there are 30 more >ftp accounts with 50 or 100 folders having html or php files injected with >this code. the total affected files might be around 3000 - 5000 or more I still don't understand why you don't download the whole structure to your local hard disk. With my FTP client, I would just point to the root of each site, copy it to my local hard disk, and work on it there. As I said, the download, and subsequent upload, could take hours, but you could be doing something else whilst it runs. In any case, you should be taking urgent action, as your sites will get blocked as an attack site. The same code is on http://trang.doae.go.th/mueang/ which Firefox warns be not to visit. There are other well known sites, forget the names, which will list your sites as a problem. Can you explain why you are not following the route which I, and at least one other member, have suggested? -- Pete Clark Advertise your events in Spain - local and free http://hotcosta.com/events.php