new patterns

scan.php

@@ -463,8 +463,8 @@ error_reporting(E_ALL);
 	"RewriteCond %{HTTP_REFERER}\s*\^\.\*\s*\([^\)]*[google|yahoo|bing|ask|wikipedia|youtube][^\)]",
 	"^<\?php\s*if\(!function_exists\([^{]+\s*{\s*function[^}]+\s*}\s*[^\"']+\s*[\"'][^\"']+[\"'];\s*eval\s*\(.*\)\s*;\s*}",
 	"<\?php)*\\\$md5\s*=\s*[\"|']\w+[\"|'];\s*\\\$wp_salt\s*=\s*[\w\(\),\"\'\;\$]+\s*\\\$wp_add_filter\s*=\s*create_function\(.*\);\s*\\\$wp_add_filter\(.*\);\s*(\?>",
-    "<\?php(.*)if\(isset\(\$\_REQUEST\[(.*)assert(.*)exit(.*)\?>",
-    "<\?php(.*)if\(isset\(\$\_REQUEST\[(.*)\"asse\"\.\"rt\"(.*)exit(.*)\?>",
+    "<\?php.*?if\(isset\(\$\_REQUEST\[.*?assert.*?exit.*?\?>",
+    "<\?php.*?if\(isset\(\$\_REQUEST\[.*?\"asse\"\.\"rt\".*?exit.*?\?>",
     // hacker emails & socials
     "b0x\@hotmail\.com",
     "facebook\.com\/007mrspy",