Linux terminal command to clean a base64_decode hack?

[MuGeN]

We have had 3 sites hacked, they are all the **base64** encode hack that looks like this:

eval(base64_decode("CmVycm9yX3JlcG9ydGluZygwKTsKJHFhenBsbT1oZWFkZ.........")

Is there a command similar to this one:

$ find . -name "*.php" -print | xargs sed -i 's@eval(base64_decode("CmVycm9yX3Jlc........")

That I can use but which uses Regex to find and replace the entire string based on the starting characters? The reason I ask is because every instance of the injection starts the same but concludes in different ways, so I'd like a way to attack all of them at once.

Any ideas?

 

[MuGeN]

naah it needs to match the regex because valid code may very well follow the nasty stuff...

Surprisingly hard to find out this stuff!