** Command to list all infected files:
grep -lr --include=*.php "eval(base64_decode" /path/to/webrootgrep -lr --include=*.php "eval" .grep -lr --include=*.php "base64" .grep -lr --include=*.php '@include "\\' .grep -lr --include=*.php '@unserialize(@file_get_contents' .grep -lr --include=*.php '($_COOKIE, $_POST) as ' .find /path/to/webroot -type f -name '*.ico'