Update 'malware3.pl'

malware3.pl

@@ -52,7 +52,9 @@ my @regexen = (
     qr/<\?php\s+header\(\"Content\-type\:text\/html\;charset\=utf\-8\"\)\;\s+\$pagecode\s+\=\s+trim\(\$\_REQUEST\[\"PageCode\"\]\).+?\$script\_url\s+\=\s+"http\:\/\/\"\.\$host\.\$script\_name\;.+?echo\s+\$cnt\;\s+\}\s+\?>/is,
     qr/<\?php\s+\$a\s+\=.+?\.\/\*1\*\/.+?\.\/\*1\*\/.+?\$c\s+\=.+?\.\/\*1\*\/.+?\/\*1\*\/\..+?\$b\s+\=.+?\$a.+?\,\$c\(\$b\).+?\)\)\;/is,
     qr/<\?php\s+\$m\=.+?\)\;\$m\=\$m\(\$\_REQUEST\[.+?\]\)\;\@file\_put\_contents\(.+?\,\"<\?php\s+\"\.\$m\)\;\@include\(.+?\)\;\@unlink\(.+?\)\;/is,
-    
+    qr/<\?php\s+error\_reporting\(0\)\;\s+if\s+\(isset\(\$\_GET\[\"ping\"\]\)\s+and\s+\$\_GET\[\"ping\"\]\s+\=\=\s+\(\"ping\_host\"\)\)\s+\{\s+echo\s+\"true\"\;\s+\}else\{\s+function\s+smtpmail\(.+?if\s+\(\$return\s+\=\=\s+true\)\s+\{echo\s+\"true\"\;\}else\{echo\s+\"false\"\;\}\s+\}\s+\?>/is,
+    qr/<\?php\s+\/\*\s+Plugin\s+Name\:\s+Wordpress\s+Support.+?\$OOO000000\=urldecode\(.+?global\s+\$OOO000000\,\$GLOBALS\,\$OOO0O0O00\,\$OO00O0000\;\'\.\$GLOBALS\[\'OOO0000O0\'\]\(.+?\(\)\;return\;\?>/is,
+    qr/<\?php\s+\$([A-z0-9]{1,10})\s+\=\s+stripslashes\(base64\_decode\(base64\_decode\(\$\_POST\[\'([A-z0-9]{1,10})\'\]\)\)\)\;.+?if\(\$([A-z0-9]{1,20})\)\{echo\s+\'([A-z0-9]{1,10})\'\;\}\s+else\s+\{echo\s+\'([A-z0-9]{1,10})\s+\:\s+\'\s+\.\s+\$([A-z0-9]{1,20})\;\}/is,
     qr/<\?php\s+\$user\_agent\_to\_filter\s+\=\s+array\(\s+\'\#Ask.+?if\(\s+FALSE\s+\!\=\=\s+strpos\(\s+gethostbyaddr\(\$\_SERVER\[\'REMOTE\_ADDR\'\]\)\,\s+\'google\'\)\)\s+\{\s+\$isbot\s+\=\s+1\;\s+\}\s+if\(\@\$isbot\)\{.+?curl\_close\s+\(\$ch\)\;\s+echo\s+\$result\;\s+\}\s+\?>/is,
     qr/<\?php\s+\@error\_reporting\(0\)\;set\_time\_limit\(150\)\;ignore\_user\_abort\(true\)\;.+?print\s+\'\*send\:ok\*\'\;\s+exit\;.+?imagedestroy\(\$image\_p\)\;return\s+\$out\;\}\s+?>/is,
     qr/<script>var\s+a\=\'\'\;setTimeout.+?getCookie\(\"\_\_cfgoid\"\)\&\&\(setCookie\(\"\_\_cfgoid.+?\)\)\)\;<\/script>/is,