From 519d68e680abbaab5341fca878a1651d4507d825 Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Sat, 6 May 2017 12:25:56 +0200
Subject: [PATCH] Update 'malware4.pl'

---
 malware4.pl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/malware4.pl b/malware4.pl
index 597022d..6b058db 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -89,7 +89,9 @@ my @regexen = (
     qr/<\?php\s+eval\(gzuncompress\(base64\_decode\(.+?\=\=\'\)\)\)\;/is,
     qr/<\?php\s+\$report\_url\s+\=\s+\$\_POST\[\'url\'\]\;\s+\$pass\s+\=\s+\$\_POST\[\'pass\'\]\;\s+\$list\s+\=\s+\$\_POST\[\'list\'\]\;.+?if\s+\(\@stripos\(\$hello\,\'\+OK\'\)\!\=\=false\)\s+\{\s+return\s+true\;\s+\}\s+return\s+false\;\s+\}/is,
 	qr/A<\?php\s+\$license\s+\=\s+str\_rot13\(\'n\'\.\'f\'\.\'f\'\.\'r\'\.\'e\'\.\'g\'\)\;\s+\$license\(\$\_POST\[\'info\'\]\)\;\s+\?>/is,
-    
+    qr/<\?php\s+preg\_replace\(\"\/\.\/.+?\)\)\)\;\"\,\"\.\"\)\;/is,
+
+
 );
 my @base64_decodes = (