Write enable
$ tree -fiad | grep .svn$ | xargs -I '{}' chmod ugo+w '{}' -R

$ date
Mon Apr 23 12:58:08 CEST 2012

A hacker inserted eval(base64_decode(“obfuscated_code”)) on a client’s PHP files. I used this command to remove anything that matches “eval(base64_decode”
$ tree -fi | grep .php$ | xargs -I '{}' sed -i '/^.*eval(base64_decode.*$/d' '{}'

# parted /dev/sda
GNU Parted 2.3
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel gpt
(parted) print
Model: Areca ARC-1212-VOL#000 (scsi)
Disk /dev/sda: 4,00TB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

(parted) quit
Information: You may need to update /etc/fstab.


Create RAID Level 1 with two partitions

# mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda1 /dev/sda2
mdadm: /dev/sda1 appears to contain an ext2fs file system
size=1953124352K mtime=Thu Jan 1 00:00:00 1970
mdadm: Note: this array has metadata at the start and
may not be suitable as a boot device. If you plan to
store '/boot' on this device please ensure that
your boot-loader understands md/v1.x metadata, or use
--metadata=0.90
Continue creating array? yes
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md0 started.


Format the RAID device to make it usable

# mkfs.ext4 /dev/md0
mke2fs 1.41.12 (17-May-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
122077184 inodes, 488280286 blocks
24414014 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
14902 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
102400000, 214990848

This filesystem will be automatically checked every 23 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.


See RAID stats

# cat /proc/mdstat
Personalities : [raid1]
md0 : active raid1 sda2[1] sda1[0]
1953121144 blocks super 1.2 [2/2] [UU]
[>....................] resync = 0.3% (5876672/1953121144) finish=971.4min speed=33405K/sec

unused devices:


See RAID summary

# mdadm /dev/md0
/dev/md0: 1862.64GiB raid1 2 devices, 0 spares. Use mdadm --detail for more detail.


See RAID details

# mdadm --detail /dev/md0
/dev/md0:
Version : 1.2
Creation Time : Mon Feb 13 16:44:45 2012
Raid Level : raid1
Array Size : 1953121144 (1862.64 GiB 2000.00 GB)
Used Dev Size : 1953121144 (1862.64 GiB 2000.00 GB)
Raid Devices : 2
Total Devices : 2
Persistence : Superblock is persistent

Number Major Minor RaidDevice State
0 8 1 0 active sync /dev/sda1
1 8 2 1 active sync /dev/sda2
# Done!


UPDATE  table
SET     words = REPLACE(words, 'brown', 'green')
WHERE   words REGEXP 'brown ' OR words REGEXP ' brown'

Better solution from http://techras.wordpress.com/2011/06/02/regex-replace-for-mysql/:

SET sql_mode='NO_BACKSLASH_ESCAPES';

DELIMITER $$
CREATE FUNCTION  `regex_replace`(pattern VARCHAR(1000),replacement VARCHAR(1000),original VARCHAR(1000))

RETURNS VARCHAR(1000)
DETERMINISTIC
BEGIN
 DECLARE temp VARCHAR(1000);
 DECLARE ch VARCHAR(1);
 DECLARE i INT;
 SET i = 1;
 SET temp = '';
 IF original REGEXP pattern THEN
  loop_label: LOOP
   IF i>CHAR_LENGTH(original) THEN
    LEAVE loop_label;
   END IF;
   SET ch = SUBSTRING(original,i,1);
   IF NOT ch REGEXP pattern THEN
    SET temp = CONCAT(temp,ch);
   ELSE
    SET temp = CONCAT(temp,replacement);
   END IF;
   SET i=i+1;
  END LOOP;
 ELSE
  SET temp = original;
 END IF;
 RETURN temp;
END$$
DELIMITER ;

Thanks to Igor Krupitsky.