<?php

$i = $j = $k = 0;
$ccontent = file_get_contents('./yoyo.txt'); // this file contains the malware code, see: http://pastebin.com/M57UWwzD

function scanAndRemove($dir)
{
    global $ccontent, $i, $j, $k;

    if (!is_readable($dir))
    {
        return;
    }

    foreach(scandir($dir) as $file)
    {
        if(in_array($file, array('.', '..')))
        {
            continue;
        }

        $path = $dir . DIRECTORY_SEPARATOR . $file;

        if (is_dir($path))
        {
            scanAndRemove($path);
        }
        else
        {
            $k++;
            if (substr($file, -4) == '.php')
            {
                $j++;
                $source = file_get_contents($path);
                $source = str_replace($ccontent, '', $source, $count);

                if($count)
                {
                    $i++;
                    //echo $path . PHP_EOL;
                    file_put_contents($path, $source);
                }
            }
        }
    }
}

scanAndRemove('/home/{username}');

echo 'Total files: ' . $k . PHP_EOL;
echo 'Total PHP files: ' . $j . PHP_EOL;
echo 'Total infected files: ' . $i;