Quick & dirty cleaner for PHP malware: 'php.brute.bf1lic.1??.UNOFFICIAL'

disinfect.sh

#!/bin/bash

echo "Quick & dirty cleaner for PHP malware: 'php.brute.bf1lic.187.UNOFFICIAL'"
echo

function disinfect {
	infected=$1
	echo "Disinfected file: ($infected)"
	sed -i -r -e 's/<\?php if\(\!isset\(\$GLOBALS\["[\\x0-9a-fA-F]+"\]\)\) \{ \$ua=strtolower\(\$_SERVER\["[\\x0-9a-fA-F]+.+ \?><\?php/<?php/g' $infected
}

IFS=$'\n'
count=0

for infected in $(grep -Elr '<\?php if\(\!isset\(\$GLOBALS\["[\\x0-9a-fA-F]+"\]\)\) { \$ua=strtolower\(\$_SERVER\["[\\x0-9a-fA-F]+' .)
do
	disinfect $infected
	count=$((count + 1))
done

echo "[+] Disinfected: $count"