diff --git a/malware4.pl b/malware4.pl
index d2579fb..c79ec2c 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -60,7 +60,7 @@ my @regexen = (
 	qr/<\?php\s+\$ua\s+\=\s+\$\_SERVER\[\'HTTP\_USER\_AGENT\'\]\;\s+if\s+\(preg\_match\(\'\/facebook\/si\'\,\$ua\)\)\s+\{.+?<\/noframes>\s+<\/html>\'\;\s+\}\s+\?>/is, 
     qr/<\?php\s+session\_start\(\)\;.+?\.php\_uname\(\)\..+?<\/form>/is,
 	qr/\'\;if\(\s+\$\_POST\[\'\_upl\'\].+?<\/form>/is,
-
+	qr/<\?php\s+if\(\!empty\(\$\_FILES\[\'message\'\]\[\'name\'\]\).+?<\/body>\s+<\/html>\'\;\/\/([0-9]{1,20})/is,
     
 );
 my @base64_decodes = (