#!/bin/bash

malware() {
    find -type f  -iname *.$1| while read file
    do
        a=`awk 'length(\$0) > 1020' "$file"|grep -e "base64_decode\|preg_replace"`
        if [ "$a" ]
	then
    	    echo $file
	fi
	b=`grep "\$_POST" "$file" |grep -i base64_decode | grep -i eval`
        if [ "$b" ]
	then
    	    echo $file
	fi
    done
}

malware phtml
malware php
malware phps
malware php5
