Track infected scripts

maldet -a /home/USERNAME/public_html

find /home/USERNAME/public_html -ctime -2 -name "*.php"

grep -nr strtoupper /home/USERNAME/public_html |grep eval

for i in `find /home/USERNAME/public_html/ -name "*.php"`;do head -n 1 $i|grep "eval" && echo $i;done

grep -nr strtoupper /home/USERNAME/public_html|grep eval|awk -F: {'print $1'}

remove symlink
find /home/USERNAME/public_html -name "*.php" -type l -exec unlink {} \;

by date
find . -name "*.php" -newermt 2015-12-19 ! -newermt 2015-12-20 -type f

find . -type f -name '*.php' -print | xargs grep -i x29
find . -type f -name '*.php' -print | xargs grep -i x29|awk -F: {'print $1'}
find . -type f -name '*.php' -print | xargs grep -E '[0-9a-zA-Z/]{80}'
find . -type f -name '*.php' -print | xargs grep -E '[0-9a-zA-Z/]{80}'|awk -F: {'print $1'}