How to decode eval( gzinflate( base64_decode(

Question

I have this code injected in my site. How can I decode the trailing string? I need to know what happened and what is the code behind it.

Answer 1

This should output the code that would be executed by eval():

<?php
echo gzinflate( base64_decode( /* insert code */ ));
?>

I hope that's what you were looking for.

Answer 2

I use this to remove the nasty code injected in all my PHP files from public_html folder:

find -name "*.php" -exec sed -i '/<?.*eval(gzinflate(base64.*?>/ d' '{}' \; -print

Cheers!