/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,30}?include\s*['"]\.\/\.\.\/ysfunctions\/ysfunctions\.php.{0,350}?\$\w+\[["']yass_password.{0,90}?loginsend\([^;]+;.{0,50}?\$to\s*=\s*["'\.]+\/\w+\.php\?['"]\.md5\(base64_encode\(rand.{0,50}?header\([^;]+;(?:[^>]+>\s*)?$
/
gis