/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,800}(\$zeeta);\s*if \(!\$npdcheckclassbgp.{0,200}str_replace[\('",\s\w\$\);]+(\$algo)\s*=\s*['"]default["'];\s*(\$pass)\s*=.{0,700}function_exists\('wp_cd.{0,410}(\$reqw)\s*=[\s\$\w\("']+\3.{0,70}\4,\s*(\$mtchs).{0,300}if\s*\(fopen\("\$subdira\/\.\2.{0,220}fwrite\((\$hdl)([,\s"'\<\?\w\\]+)\5[\[\w\]\\\?\>"'\)]+;\s*fclose\(\6.{0,120}\1\s*=\s*["']yup['"];\s*\}(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)
/
gis