/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1=str_replace\(['"].{0,90}?\1.{0,50}?if\(\@\$\w+\[['"]merdo['"]\]\)\{echo\s*['"]<\!\-+\s*sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}\$\w{0,21}=\@json_decode\(str_rot13.{0,460}?\$\w{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w{0,21}\[['"]links.{0,110}?header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\1(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)
/
gis