Checking Malware contents for any account :

Steps :

1. login to shell

2. fire one command given below :

grep -ilr “kusik-tusik-trf.com” /home/*/public_html/index.*

grep -ilr “iframe” *

grep -ilr “eval(base64_decode” *

most probably search : grep -ilr “eval(unescape” *

3. You will get file name. Open the file and search for the malware using particular word and then remove that line.

for example,

If you have used this command grep -ilr “kusik-tusik-trf.com” /home/*/public_html/index.*
then search the file for word kusik

thats all