regularExp.txt

eval\/\*[a-z0-9]+\*\/
eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\);
(chr\(\d+\)\.){4,}
(chr\(\d+\^\d+\)\.){4,}
(\$[a-z0-9]{3,}\[\d+\]\.){4,}
chr\(\d+\)\.""\.""\.""\.""\.""
\$GLOBALS\[\$GLOBALS[\'[a-z0-9]{4,}\'\]\[\d+\]\.\$GLOBALS\[\'[a-z-0-9]{4,}\'\]\[\d+\].
\$GLOBALS\[\'[a-z0-9]{5,}\'\] = \$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.
eval\([a-z0-9_]+\(base64_decode\(
\$[a-z]{3,}=\$[a-z]{3,}\("",\$[a-z]{3,}\);\$[a-z]{3,}\(\);
{\s*eval\s*\(\s*\$
Googlebot[\'"]{0,1}\s*\)\){echo\s+file_get_contents
eVaL\(\s*trim\(\s*baSe64_deCoDe\(
if\s*\(\s*mail\s*\(\s*\$mails\[\$i\]\s*,\s*\$tema\s*,\s*base64_encode\s*\(\s*\$text
fwrite\s*\(\s*\$fh\s*,\s*stripslashes\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)\[
echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)
chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\)
fwrite\([\$A-z\, ]+\)\; fclose\(\$[A-z]+\)\; echo
\$\_COOKIE\[(?|\'|\")[A-z0-9]{3,}(?|\'|\")\](?:[\{\$\)A-z\d\="]+)
return base64_decode\(\$[A-z]\[\$[A-z]\]\)\;\} error_reporting\(round\(0\)\);
function[A-z\s\=\\\"\(\)\{\;]+[A-z\s]+\=[\\\"\dA-z]{10,}
[A-z]+\/\*\;\*\/\([\$\_[A-z\"]+
ini_set\(\'mail\.add_x_header\'\,\'off\'\)[\sA-z\;\(\)\"\'\,\d]+ignore_user_abort\(true\)
chdir[\s\)\(]\$_POST\[[\'\_dir\s]+\]
[\_A-z\d\+\.]{500,}
base64_decode\(\'[A-z]{7}\=\'\)