security.stackexchange.com/questions/136966/php-malware-on-server-but-helpless-in-identifying-the-malicious-code

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a ...

gist.github.com/ejfox/22140128e2883260ce255eee49094b7e

curl_setopt($ch, CURLOPT_URL, "http://search.yahoo.com/search?p=$ query_pars_2&fr=yfp-t&fr2=sb-top&fp=1&b=$yahoo_page&pz=10&bct=0&xargs= 0");.