Run a replace on all *.htm files recursive (*.html are also automatically included) with Perl regular expression option enabled searching not case-sensitive for (</html>\s*?)\S[\s\S]* and using \1 as replace string.

(...) ... a capturing group for back-referencing the string found inside the parentheses with \1 in replace string.

</html> ... this string in any case.

\s*? ... whitespace characters like spaces, tabs, carriage returns and line-feeds (and some others most likely not present in the *.html files) zero or more times non-greedy.

\S ... a non whitespace character.

[\s\S]* ... a whitespace character or a non whitespace character (= any character) zero or more times greedy. As this last expression matching any character is greedy, it matches everything to end of file.

Try this Perl regular expression replace first on a single HTML file opened in UltraEdit as I have done with currently latest UltraEdit. If it works as expected, run it using Replace in Files. Best would be to run this Perl regular expression Replace All two times to verify with second run that all *.htm and *.html files were finally cleaned up from malware code.