title: PHP/SSH regex script/command to delete identical malware code from many files
body: <p>I have a virus that has infected thousands of files on one of my client's server.</p>
  
  <p>Fortunately, I have dealt with a lot of other malware on this guy's server and this one looks easy to do simple regex on (he put all his websites on the same account :( but I'm working with him to resolve that).</p>
  
  <p>Basically though, unlike most malware I have seen where it injects php BEFORE the closing ?> of the GOOD code (making it very hard to determine whats good code/bad code), this current malware ALWAYS adds a new <code>&lt;?php ... malware ... ?&gt;</code>.</p>
  
  <p>So basically, say there's good code here:</p>
  
  <pre><code>&lt;?php
  require('./wp-blog-header.php'); 
  ?&gt;
  </code></pre>
  
  <p>Instead of adding some kind of base64_decode eval immediately after the require statement but before the ?> (which can make removal difficult when the page happens to end in a conditional/complex statement), this will always add the following code with a NEW <code>&lt;?php ... ?&gt;</code> like so:</p>
  
  <pre><code>&lt;?php
  require('./wp-blog-header.php'); 
  ?&gt;&lt;?php ... malware ...?&gt;
  </code></pre>
  
  <p>I don't want to put any malicious code up here but, this is how the malicious code always starts:</p>
  
  <pre><code>&lt;?php @error_reporting(0); if (!isset($eva1fYlbakBcVSir)) {$eva1fYlbakBcVSir = "tons and tons of characters";$eva1tYlbakBcVSir = "\x6335\1443\3x6f\1534\x70\170\x65";$SNIPSNIPSNIPSNIP;} ?&gt;
  </code></pre>
  
  <p>I'd like to search every file for <code>&lt;?php @error_reporting(0); if (!isset</code> and if it's the last PHP statement on the page, then delete everything within the </p>