** Command to list all infected files:
grep -lr --include=*.php "eval(base64_decode" /path/to/webroot
grep -lr --include=*.php "eval" .
grep -lr --include=*.php "base64" .
grep -lr --include=*.php '@include "\\' .
grep -lr --include=*.php '@unserialize(@file_get_contents' .
grep -lr --include=*.php '($_COOKIE, $_POST) as ' .
find /path/to/webroot -type f -name '*.ico'