Q:

Script to clean up hacked web site

I'm looking for something like a php script to run on my web-site to clean up corrupted files. 
I've found 3 different formats of corruption: 
php files : have an iframe line just before a  
.js files : have a iframe line on the first line of each file
each folder have a default.php file which contains only a line with echo(decodeBase64(...))
So, I know how to find/erase the malwares, 
I could then write a script which read/write the files on my server to clean it up.  
But It would take hours... So is there already something like that that exists? 
(ps: Were hosted on GoDaddy and are not thinking about mooving because of the low price, 
I'm also not a pro about security, even though I know we'll need to patch these security breach, I need some temporary solution for right now)

A:

It shouldn't take hours, I wrote a very very very simple script in minutes that you can manually tweak to suit your needs. 
Here it is:
    $realPath = realpath('path/to/your/wp/installation');
    // The needle is the string that you want to look for in your files
    // gzinflate is pretty common, also try to look for preg_replace or eval,
    // but those instructions are commonly used in WP, so you'll have a bunch of
    // false positives. 
    //
    // As far as js files, you might want to also look for document.writes because
    // that's how worms insert iframes into your websites.   
    $needle = "/gzinflate/"; 
    $di = new RecursiveDirectoryIterator( $realPath );
    foreach (new RecursiveIteratorIterator($di) as $filename => $file) {
            $haystack = file_get_contents($filename);
            if(preg_match_all($needle, $haystack, $matches)) {
                   // Outputs suspicious file, not necessarily infected. 
                    echo $filename;
                    echo "\n";
            }

