Originally Posted by GrouchyAdmin

This might not be it; it's probably more extensive, but this is likely it's heuristic:

find /docroot -type f -name *.{php|inc|html|etc} -exec md5sum {} >> /tmp/omghaxxorz.txt \;
#!/bin/sh
for n in `cat /tmp/omghaxxorz.txt` do
name=`cut -f1 -d: $n`
md5=`cut -f2 -d: $n`
if [`md5sum $name | cut -f2 -d:`"x" != $md5"x" ]; then
OMG A HAXXOR
else
DONT TAZE ME BRO
fi