Added new hash and improved check_filesystem.py

Added hash for CryptoPHP shell version 0.3x555. (Thanks Antonio)

Improved check_filesystem.py scanner, it now scans all image files
for CryptoPHP. Normally it will only scan "social*.png" files but
there have been reports of variants where it is "thumb.png".

The file pattern can be changed using the --patterns flag.
Update the scripts/README.md to match changes