searching for hacked files on the server

gistfile1.txt

grep -rnw /mnt/home -e "return base64_decode"

/*
  $str_to_find[]='base64_decode';
  $str_to_find[]='edoced_46esab'; // base64_decode reversed
  $str_to_find[]='preg_replace';
  $str_to_find[]='HTTP_REFERER';
  $str_to_find[]='HTTP_USER_AGENT';
  */
  
  

//search current directory for all files changed in the last week
find . -type f -name '*.php' -mtime -7

//search files for common strings found in hacked files
find . -type f -name '*.php' | xargs grep -l "eval *(" --color
find . -type f -name '*.php' | xargs grep -l "base64_decode *(" --color
find . -type f -name '*.php' | xargs grep -l "gzinflate *(" --color

find . -type f -name '*.php' | xargs grep -l "eval *(str_rot13 *(base64_decode *(" --color