/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,120}\$_session\[['"]\w+['"]\]\s*=\s*\$_post\[['"]\w+['"]\].{0,120}\$md5=md5\("\$random"\);\s*\$base=base64_encode\(\$md5\);\s*\$host=md5\(.{0,50}\$logon="\w+\.html\?\$host\-\$host\-\$host\$host.{0,100}header\("location:\s*\$logon[[:punct:]\s]+$
/
gsi