Just what the Site Doctor ordered. My sites on Bluehost were suspended and they offered their service for $60 to fix.
I downloaded my files immediately and when they fixed it downloaded again. Comparing files came up with this eval(base64_decode()) all over the place. Mine were joomla sites, php is php.
I’ll be getting my game plan to harden my sites based on your fine explanation.