Is this anything to be worried about, but I just went to open a site that I know to be trustworthy but then Avast 4.8 brought up a warning that there was a sign of “HTML:Iframe-inf”
I just had an email from the site owner to say they are working on it.
I aborted the connection just to be safe.
system
October 4, 2009, 8:00pm
2
that’s what NoScript says about iFrames…http://noscript.net/faq#faqsec7
If you set noscript in FF to protect against this, you’ll get a prompt after a click…but that sometimes freezes the browser, use to anyway.
that’s what NoScript says about iFrames…http://noscript.net/faq#faqsec7
If you set noscript in FF to protect against this, you’ll get a prompt after a click…but that sometimes freezes the browser, use to anyway.
Where about in FF is this setting? and if this setting is put into effect, would it be for all web pages?
system
October 4, 2009, 8:21pm
4
it’s not a setting in Firefox itself, but in the “noscript” extension. And yes, that will work for all sites
http://noscript.net/
system
October 4, 2009, 10:00pm
5
Hi nightshade,
This kind of detection is very common these days, with many ‘legitimate sites’ becoming hacked to distribute malware:
Every 3.6 seconds a website is infected
This post by DavidR would be worth a read for the webmaster, since they are aware of the issue.
Actually cleaning the file is not going to resolve why you got hacked it will only clean the file (well avast doesn’t clean the file just alerts to it, you have to find and strip out the injected code) and not the cause, you need to contact your host, see below.
– HACKED SITES - This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.
We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.
I suggest the following clean up procedure for both your accounts:
check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
Check all .htaccess files, as hackers like to load re-directs into them.
Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.
Also see, Tips for Cleaning & Securing Your Website, http://www.stopbadware.org/home/security .
Thanks to you both for your replies.
