diff --git a/malware4.pl b/malware4.pl
index 78fc23f..21815fc 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -497,6 +497,7 @@ my @regexen = (
     qr/<\?php.+?Mr\.N00B\s+Mini\s+Shell.+?\$auth\_pass\s+\=.+?eval\(\$st\(\$gz\(\$st2\(\$bs\(\(\$con7ext\)\)\)\)\)\)\;/is,
     qr/<\?php\s+\/\*\*\s+\*\s+Leaf.+?\$sessioncode\s+\=\s+md5\(\_\_FILE\_\_\)\;.+?Leaf\s+PHPMailer.+?\}\s+print\s+\'<\/body>\'\;\s+\?>/is,
     qr/<title>Hacked\s+By\s+Dr34mCyb3r.+?<\/style>\s+<div\s+class\=\"video\-background.+?allowfullscreen><\/iframe>/is,
+    qr/<\?php\s+\$([A-z0-9]{1,20})\=\'ba\'\.\'se64\_dec\'\.\'o\'\.\'d\'\.\'e\'\.\'\'\;\s+\@eval\(\$([A-z0-9]{1,20})\(.+?\)\)\;/is,
 
 );
 
diff --git a/sc.php b/sc.php
index 7c121f8..be3bf25 100644
--- a/sc.php
+++ b/sc.php
@@ -1120,7 +1120,7 @@ echo '<br><pre>';
 function version() {
 // externalized the function to version.php in order to keep this cleaner than before
 
-require_once("version.php");
+require_once("cms-ver.php");
  
 }