added suspicious PHP file finder