Update 'malware3.pl'

malware3.pl

@@ -23,6 +23,7 @@ my @regexen = (
     qr/<\?php\s+function\s+([A-z0-9]{1,10})\(\$([A-z0-9]{1,10})\,\s+\$([A-z0-9]{1,10})\)\{\$([A-z0-9]{1,10})\s+\=\s+\'\'\;\s+for\(\$([A-z]{1,2})\=0\;\s+\$([A-z]{1,2})\s+\<\s+strlen\(\$([A-z0-9]{1,10})\)\;\s+\$([A-z]{1,2})\+\+\)\{\$([A-z0-9]{1,10})\s+\.\=\s+isset\(\$([A-z0-9]{1,10})\[\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\]\)\s+\?\s+\$([A-z0-9]{1,10})\[\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\]\s+\:\s+\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\;\}\s+\$([A-z0-9]{1,10})\=\"base64\_decode\"\;return\s+\$([A-z0-9]{1,10})\(\$([A-z0-9]{1,10})\)\;\}.+?\$([A-z]{1,2})\s+\=\s+\Array\(.+?eval\(([A-z0-9]{1,10})\(\$([A-z]{1,2})\,\s+\$([A-z]{1,2})\)\)\;\?>/is,
     qr/<\?php\s+\$([A-z0-9]{1,10})\=\'aWYoaXNzZXQoJF9SRVFVRVNUWydjb2NvJ10pICYmICRfUkVRVUVTVFsnY29jbyddIT0nJyl7ZXZhbCgkX1JFUVVFU1RbJ2NvY28nXSk7ZXhpdCgpO30\=\'\;eval\(base64\_decode\(\$([A-z0-9]{1,10})\)\)\;exit\(\)\;\s+\?>/is,
     qr/<script.+?G91825.+?<\/script>/is,
+    qr/<div\s+style\=\"position\:\s+absolute\;\s+left\:\s+\-5000px\;\s+font\-size\:\s+0\.0\;\s+width\:\s+0\.0\;\s+height\:\s+1\.0\;\s+overflow\:\s+hidden\;\">.+?<\/a>.+?<\/div>/is,
     qr/<div\s+style\=\"position\:\s+absolute\;\s+left\:\s+\-5000px\;\s+font\-size\:\s+0\.0\;\s+width\:\s+0\.0\;\s+height\:\s+1\.0\;\s+overflow\:\s+hidden\;\">.+?rel\=dofollow>.+?<\/a><\/h2>.+?<\/div>/is,
     qr/<IfModule\s+mod\_rewrite\.c>\s+RewriteEngine\s+On\s+RewriteCond\s+\%\{HTTP\_USER\_AGENT\}\s+\(google\|yahoo\|msn\|aol\|bing\)\s+\[OR\]\s+RewriteCond\s+\%\{HTTP\_REFERER\}\s+\(google\|yahoo\|msn\|aol\|bing\)\s+RewriteRule\s+\^\.\*\$\s+index\.php\s+\[L\]\s+<\/IfModule>/is,
     qr/<\?php\s+function\s+query\_str\(\$params\)\{\s+\$str\s+\=\s+\'\'\;.+?\$urlz\=lrtrim\(\$urlz\)\;\s+\$contenttype\=lrtrim\(\$contenttype\)\;\s+\$encode\_text\=\$\_POST\[\'encode\'\]\;.+?sent\s+successfully\'\)\;\s+<\/script>\"\;\}\}\s+\?>\s+<p\s+align\=\"center\">\&nbsp\;<\/p>\s+\&nbsp\;\s+<\/body>\s+<\/html>/is,