cure.php

<?php

function writeln ($str) {
        echo $str . PHP_EOL;
}

$GLOBALS['cured'] = 1;

function cure($file) {
        $re_infected = '\<\?php \/\*\*\/ eval\(base64_decode\("[a-zA-Z0-9\=\/\+]+"\)\);\?\>';
//      $re_infected = '"[a-zA-Z0-9\=\/\+]+';
//      writeln($re_infected);
        $contents = file_get_contents($file);
//      writeln($contents);
        $GLOBALS['cured'] += preg_match("/$re_infected/ums", $contents);
//      print_r($m);
        file_put_contents($file . '.bak.php', $contents);
        $contents = preg_replace("/{$re_infected}/iums", '', $contents);
        file_put_contents($file, $contents);
}

$Directory = new RecursiveDirectoryIterator($argv[1]);
$Iterator = new RecursiveIteratorIterator($Directory);
$Regex = new RegexIterator($Iterator, '/^.+\.php$/i', RecursiveRegexIterator::GET_MATCH);

foreach ($Regex as $file) {
        cure($file[0]);
        writeln($file[0]);
}
writeln("Cured {$GLOBALS['cured']} files");