Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

We're running a Debian server and we have a malware or something doing code injection.

I know how to search and replace this string :

<iframe src="" width="2" height="2" frameborder="0"></iframe>

I do it this way :

find /home -type f | xargs sed -i 's$<iframe src="" width="2" height="2" frameborder="0"></iframe>$ $g'

My problem is the url changes from files to files, so how can I search and replace :

<iframe src="ANY STRING HERE" width="2" height="2" frameborder="0"></iframe>

Because the width, height, and frameborder is always the same.

share|improve this question

marked as duplicate by Tom O'Connor, mgorven, Khaled, Bryan, Iain Mar 1 '13 at 21:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Your site's compromised. Redeploy it from a pristine copy, and then fix the security problem that caused this in the first place. – Michael Hampton Mar 1 '13 at 14:23
Yes i sure will but i can't and i have to find someone to do it. Until then, this little fix will avoid the site being listed as malicious by google. At least I hope so... – Docteur_K Mar 1 '13 at 14:45
This little fix will be undone quickly by whoever hacked your site in the first place. – ceejayoz Mar 1 '13 at 15:18
I know, but again, i can't manage this by myself, i a front end actionscript 3 developper, not bad at all, but i don't know anything about sysadmin... So until i find someone i do what i can :( But still, thank you for carring, it's very nice of you, and be sure i ll do my best to reinstall everything as soon as possible :) – Docteur_K Mar 1 '13 at 16:17
up vote 1 down vote accepted


find /home -type f | xargs sed -i 's$<iframe src="[^"]*" width="2" height="2" frameborder="0"></iframe>$ $g'

here [^"]* means 0 ore more characters of anything but ".

share|improve this answer
Awsome, thank you very much for your quick and very efficient response ! I might ask for too much, but do you know if it's possible to send an email if the requested string is found ? Thank's again, you saved my day ! Frederic. – Docteur_K Mar 1 '13 at 14:41
You're welcome! Just run another script before this to walk through all files and e-mail you all the matched files. Like: grep -R '<iframe src="[^"]*" width="2" height="2" frameborder="0"></iframe>' /home | mail -s "Alert" – Stone Mar 1 '13 at 15:12
One more time, Thanks ! And since i'm french and we dont really mind abusing people helping ^^ Do you know if it's possible to send the email only if a file matched ? Thanks again a thousand times, it's very kind of you :) – Docteur_K Mar 1 '13 at 16:15
You can redirect the grep to a file and then check if the file exists and only if it exists send the letter. – Stone Mar 5 '13 at 20:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.