/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*\s*\/\/\s*\/\/\s*skullv1 shell.{0,300}?\$shell_name\s*=.{0,200}?\$shell_password.{0,200}?\$shell_code\s*=\s*['"]enrsvqmzo0isip[\w\+\/=]+q7whyy11mi7\+dvp\/rry9hg==['"];.{0,100}?eval\(["']\?>['"]\.gzuncompress\(base64_decode\(\$shell_code(?:[^>]+>\s*)?$
/
gis