Home/ Questions/Q 8751765
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T13:06:38+00:00

I would like to know if I can help create the regular expression for

  • 0

I would like to know if I can help create the regular expression for this line of code:

document.write('<iframe src="http://msn.com" scrolling="auto" frameborder="no" align="center" height="7" width="7"></iframe>');

what happens is that a virus enter and edit all javascript files (. js) by adding at the end the line of code you mention. I’ll use the script of this publication (http://crear-paginas-web.blogspot.com/2010/04/archivos-php-hackeados-con.html) but I need the new regular expression to implement. I’ve been trying to make it on my own but as I know has paid off:

/document[.]write\(\'\<iframe src\=\"http\:\/\/(msn.com)\" scrolling\=\"auto\" frameborder\=\"no\" align\=\"center\" height\=\"7\" width\=\"\7\"\>\<\/iframe\>+\'\);/

I hope you can help me, greetings.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This regex will match your specific string:

    /document\.write\('<iframe src="http:\/\/msn\.com" scrolling="auto" frameborder="no" align="center" height="7" width="7"><\/iframe>'\);/

    http://regexr.com?32k7v

    Note that if there is a minimum variation in the markup then it won’t match. You’ll most likely have replace the address with a properly escaped version of your offending script’s address.

    If you want a more general regex, to match all document.write which writes iframe with a given URL, you can use:

    /document\.write\('<iframe.*?src="http:\/\/msn\.com".*?><\/iframe>'\);/

    http://regexr.com?32k85

    Note that if your website has many pages, it will be hard to be sure that there are no remains of the attack. Hence I’d still suggest restoring a backup of the files if you have any.

    • 0