I got hacked by running a really outdated Drupal installation (shame on me)
It seems they injected the following in every .php file;
.php
You can use sed with something like
sed
sed '1 s/^.*$/
The 1 part only replaces the first line. Then, thanks to the s command, it replaces the whole line by .
1
s
.
To modify your files in-place, use the -i option of GNU sed.
-i