Search malicious code on the website

find . -name '*.php' -exec grep -l '$msg=@gzinflate(@base64_decode(@str_replace' {} \; > rem01.txt find ./images/ -name '*.php' > rem02.txt find . -name '*.php' -exec grep -l 'preg_replace("/\.\*/e","' {} \; > rem03.txt find . -name '*.php' -exec grep -l 'eval (base64_decode($_POST["php"]));' {} \; > rem04.txt find . -name '.htaccess' -exec grep -l 'android|midp|j2me|symbian|series' {} \; > rem05.txt find . -name '.htaccess' -exec grep -l 'google|ask|yahoo' {} \; >> rem05.txt find . -name '*.php' -exec grep -l 'if(@md5($_POST\["gif"\])' {} \; > rem06.txt find . -name 'index.php' -exec grep -l '$_REQUEST\[.*\]; eval' {} \; > rem07.txt find . -name '*.php' -exec grep -l '&& function_exists("getmxrr"))' {} \; > rem08.txt find . -name '*.php' -exec grep -l '<br/>Security Code: <br/><input name="security_code" value=""/>' {} \; > rem09.txt find . -name '*.php' -exec grep -l 'ncode(print_r(array(),1)),5,1).c),$c);}eval($d);' {} \; > rem10.txt find . -name 'index.html' -exec grep -l '<META HTTP-EQUIV="Refresh" CONTENT="0; ' {} \; > rem11.txt find . -name '*.php' -exec grep -l '= array("Google", "Slurp", "MSNBot"' {} \; > rem12.txt find . -name 'index_backup.php' > rem13.txt find . -name '*.jpg' -exec grep -l 'eval(base64' {} \; > rfix_jpg.txt find . -name '*.php' -exec grep -Erol '(\\x[[:xdigit:]]{2})+' {} \; > remHEX.txt