Quick find for WordPress malware

main.sh

#!/bin/bash

# Find includes that start with escape character
grep -R '@include \"\\'

# Find files that end with ico and have a random 8 character filename.
find . | egrep  "\.[0-9a-z]{8}.ico"

# Find files with ico code include injected at the top.

# Find obfuscated files with a specific pattern
grep -R "^\$[a-z]\{4,7\}.=.'.\+Array()\;\$[a-z]\{4,7\}\[\].\+))))\;\}$"
grep -R "<?php\s\+\$[a-z0-9]\{4,10\}\s=\s[0-9]\{1,5\};\$GLOBALS.\+\?>"
grep -R "\$[a-z]\{6\}=\"rawurl\"\s\.\s\"decode\"\;return\s\$[a-z]\{6\}"
grep -R "<?php\s\$[a-z]\{3,20\}\s=\s\"[a-z]\{3,20\}\"\;\$[a-z]\{3,20\}\s=\s\"\"\;foreach.\+exit()\;}}}"
grep -R "\$PASS\="
grep -R "if(\!empty(\$_REQUEST\['[a-z]\{1,8\}'])){\$[a-z]\{1,8\}=base64_decode.\+exit\;\}"
grep -R "<?php\s\$GLOBALS\['_[0-9]\{1,10\}_']=Array('str_'"
grep -R "<?php\s\$[a-zA-Z0-9]\{6,10\}\s=\s\"[a-z0-9]\{10,13\}\;.*'//');"
grep -R "eval.*(gzinflate(base64_decode(.*)));"
grep -R "El Moujahidin"
grep -R "indoxploit"

# Find obfuscated JS injected into JS files
grep -R "var [a-z]\{4,9\}\s=\s1;\svar\sd=document;.*"

# Time savers...
for i in $(grep -R "<?php\s\+\$[a-z0-9]\{4,10\}\s=\s[0-9]\{1,5\};\$GLOBALS.\+\?>" * -l); do sed -i "s|<?php\s\+\$[a-z0-9]\{4,10\}\s=\s[0-9]\{1,5\};\$GLOBALS.\+\?>||g" $i;done