/.*w3who.dll\x3F[^\r\n]{51}/i
/^.{3}(\x00[^\x00]|[^\x00]\x00|[^\x00][^\x00]){25}/Rs
/.*act=(cmd|search|upload|about|encoder|bind|ps_aux|ftpquickbrute|security|sql|eval|feedback|selfremove|fsbuff|ls|phpinfo)/smi
/.*action(=|\x3f)[^(\n|&)]*\x3c[^(\n|&)]+\x3e/i
/.*admin_root=(https?|ftps?|php)/
/.*]+> T]*onLoad\s*=\s*[\x22\x27]?window\(\)/smi
/.*body=\x2521\x2521\x2521Optix\s+Pro\s+v\d+\x252E\d+\S+sErver\s+Online\x2521\x2521\x2521/smi
/.*body\=\x7BIP\x3A[^\x7B\r\n]*\x7D\x7BOS\x3A[^\x7B\r\n]*\x7D\x7BSysuptime\x3A[^\x7B\r\n]*\x7D\x7BTrojan\x3A[^\x7B\r\n]*\x7D\x7BPort\x3A[^\x7B\r\n]*\x7D\x7BPassword\x3A[^\x7B\r\n]*\x7D\x7BUser\x3A/smi
/.*cache_lastpostdate\[[^\]]+\]=[^\x00\x3B\x3D]{30}/smi
/.*calendar(|[-_]admin)\.pl/i
/.*cdpView.ovpl[^\r\n]*cdpnode=[^\r\n]*(\x2c|\x24|\x7c|\x3b|\x22|\x26|\x3c|\x3f)/smi
/.*-chrome\s*javascript/
/.*cid=tb\x2e(addr|sb)/i
/.*CiWebHitsFile=\/?([^\r\n\x3b\&]*\.\.\/)?/i
/.*.cmd\x22.*\x26.*/smi
/.*connectedNodes.ovpl[^\r\n]*node=[^\r\n]*(\x2c|\x24|\x7c|\x3b|\x22|\x26|\x3c|\x3f)/smi
/.*connectID=[^&\x3b\r\n]{25}/smi
/^Content-Disposition\x3a(\s*|\s*\r?\n\s+)[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}/smi
/^Content-Length\s*\x3a\s*-\d+/mi
/^Content-Length\x3A\s*[^\r\n]{10}/smi
/^Content-Length\x3a(\s*|\s*\r?\n\s+)-\d+/smi
/.*contenttype=[^\r\n\x3b\x38]{10}/smiU
/^Content-Type\s*\x3A\s*audio\x2Fmidi/smi
/^Content-Type\s*\x3a(\s*|\s*\r?\n\s+)image\x2fgif/smi
/^Content-type\x3a(\s*|\s*\r?\n\s+)image\x2fbmp/smi
/^Content-Type\x3a(\s*|\s*\r?\n\s+)image\x2fgif/smi
/^Content-Type\x3a(\s*|\s*\r?\n\s+)image\x2fp?jpe?g/smi
/^Content-type\x3a(\s*|\s*\r?\n\s+)text\x2fplain/smi
/^Content-Type\x3A\s*video\x2Fquicktime/smi
/^Content-Type\x3A\s*video\x2F(quicktime|x-quicktime)/smi
/^Cookie\x3a[^\r\n]*source%3Dultrasearch136%26campaign%3Dsnap/smi
/^Cookie\x3a[^\r\n]*www\x2Esnap\x2Ecom[^\r\n]*toolbar_domain_redirect/smi
/.*Cookie\x3A.*s_sq=aolsnssignin/si
/.*CreateObject\(\s*\x22Adodb\.stream/smi
/.*crypto\x3Arc4_(encrypt|decrypt)\x28\x27[^\x27]{12}/smi
/^(\d{5}|390[1-9]|39[1-9][0-9]|[4-9][0-9]{3})\x3A/R
/.*db4web_c(\.exe)?\/.*(\.\.[\\|\/]|[a-z]\:)/smiU
/.*default.idq[^\r\n]*ciRestriction[^\r\n]*script/smi
/^\d+\x3baa88\x2edll\x3b\d+\x3b/smi
/.*(EAL|EAR|ETT)\s*-0{0,4}1/i
/.*