/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)[\s\=]+\\["']ZXZhbCUyOCUyNyUzRiU[\w]+\=\=\\["'];\s*\$\w+[\s\=]+\\["']P8v8EIsDAEOiuwNDEdcNDM[\w\/\+]+HDwYLyavXa9zOn49ntAmEA\\["'];\s*eval\(htmlspecialchars_decode\(urldecode\(base64_decode\(\1[\)]+;\s*exit[[:punct:]\s]+$
/
gis