Updated the condition on web_shell_crews

I added a "not MZ header at 0" as this was flagging on some EXEs being submitted to VT.