find /home/ -name “*.php” | xargs grep -ril ’eval(gzinflate(base64_decode’

find /home/ -name “*.php” | xargs grep -ril ’udp://’

find /home -name “*.php” | xargs grep -ril “shell_exec”

find /home -name “*.php” | xargs grep -ril “passthru”