Self-healing index.php???

   //start of code to check index.php integrity
   //could be contained in an included file
   $fr = fopen('index.php', 'r');
   fseek($fr, -10, SEEK_END);  //get 10 characters from the end
   $byte = fread($fr, 5);  //lets look at the first five
   fclose($fr);  //close the file
   if ($byte!='er();')  //comparison should deal with eof, newline characters, more complex comparison
   {
		//something is at the end of the file that we don't expect
		//should send an email and/or kick off a script to look for new/suspicious files?
		//the _next_ time the page is loaded, it will be clean.
		//But the current "bad" one is still loaded.  How clean it out?

		if (!copy('indexbackup.php', 'index.php'))  //copy over the known good backup
		{
			//should log the problem to an error file, send email, etc.
		} 
   }
   //end of code to check index.php integrity

<?php
$chkfilename = "index.php";
$chkmd5return = md5_file($chkfilename);
echo 'MD5 : |'.$chkmd5return.'|';
?>

   //start of code to check index.php integrity
   //could be contained in an included file
   $md5hash = 'hash_string_output_from_code_above';
   $chkmd5return = md5_file('index.php');
   if ($chkmd5return != $md5hash)    
   {
		//something is at the end of the file that we don't expect
		//should send an email and/or kick of a script to look for new/suspicious files?
		//the _next_ time the page is loaded, it will be clean.
		//But the current "bad" one is still loaded.  How clean it out?
		if (!copy('indexbackup.php', 'index.php'))  //copy over the known good backup
		{
			//should log the problem to an error file
		} 
   }
   //end of code to check index.php integrity

   $md5hash = 'hash_string_output_from_code_above';
   $chkmd5return = md5_file('index.php');
   if ($chkmd5return != $md5hash)    
   //start of code to check index.php integrity
   //could be contained in an included file   
   {
		//something is in the file that we don't expect
		//should send an email and/or kick of a script to look for new/suspicious files?
		$backuprestored = copy('indexbackup.php', 'index.php'); //copy over the known good backup
		//the _next_ time the page is loaded, it will be clean.
		//But the current "bad" one is still loaded.  How clean it out?
		if ($backuprestored)  
		{
                        //this forces a reload of the page in the browser, bringing up the new one
			header("Location: index.php");
		}
		else
		{
			//should log the problem to an error file
		} 
   }
   //end of code to check index.php integrity

<?php
   $msgsubject = 'Index check';
   $emailaddy = '[email protected]';
   $md5hash = 'hash_string_output_from_code_above';
   //the job is being run from above the root folder
   $chkmd5return = md5_file('public_html/path/to/index.php');
   if ($chkmd5return != $md5hash)    
   {
                //the backup copy is kept outside of the root folder
		$backuprestored = copy('indexbackup.php', 'public_html/path/to/index.php');
		if ($backuprestored)  
		{
			$message = 'Index.php checksum does not match. Recopied.';
			//Double check the checkum on the copied file here?
		}
		else
		{
			$message = 'Problem copying file';
		} 
   }
   else
   {
	$message = 'Checksums match';
   }
	mail($emailaddy, $msgsubject, $message);   
?>