extending patterns and whitelists

scan.php

@@ -156,6 +156,7 @@ class MalwareScanner
             '\x65\166\x61\154\x28' /* dec/hex issue? */,
             '\x65\x76\x61\x6C' /* case, dec/hex issue? */,
             'ZXZhbCg', // eval
+            "'ev'.'al'.'",
 
             'eval(base64_decode(',
             '\x47\x4c\x4f\x42\x41LS', // GLOBALS
@@ -170,6 +171,8 @@ class MalwareScanner
             /* too open? */
             // 'gzinflate(base64_decode(',
             'md5($_GET[', // md5($_GET["ms-load"])
+
+            '="create_";global'
         );
         foreach ($patterns as $toSearch) {
             $substrCount = substr_count($fileContent, $toSearch);