Pasted

maldet -a /home/USERNAME/public_html
 
find /home/USERNAME/public_html -ctime -2 -name "*.php"
 
grep -nr strtoupper /home/USERNAME/public_html |grep eval
 
for i in `find /home/USERNAME/public_html/ -name "*.php"`;do head -n 1 $i|grep "eval" && echo $i;done
 
grep -nr strtoupper /home/USERNAME/public_html|grep eval|awk -F: {'print $1'}
 
remove symlink
find /home/USERNAME/public_html -name "*.php" -type l -exec unlink {} \;
 
by date
find . -name "*.php" -newermt 2015-12-19 ! -newermt 2015-12-20 -type f
 
find . -type f -name '*.php' -print | xargs grep -i x29
find . -type f -name '*.php' -print | xargs grep -i x29|awk -F: {'print $1'}
find . -type f -name '*.php' -print | xargs grep -E '[0-9a-zA-Z/]{80}'
find . -type f -name '*.php' -print | xargs grep -E '[0-9a-zA-Z/]{80}'|awk -F: {'print $1'}