IFrame HY Trojan

Viruses and worms
1

My website has recently started reporting an IFrame HY trojan. I am not sure what this is or how to get rid of it. Or how it would have got into the files on my website. Any help would be greatly appreciated.

Avast is reporting it as
HTML:IFrame-HY [Trj]

2

Hi mivy00,

To be able to help you, please could you provide us with the link to the website?

When posting suspect urls please could you modify it to make it non-clickable (i.e. change http to hXXp)
Thanks,

-Scott-

3

Generally, avast detection is accurate in these cases.
Isn’t it an encrypted/obfuscated script or iframe?

Also, please, check if there are infected gif images (resolved as infected server generated messages): http://forum.avast.com/index.php?topic=45658.0

Check here how to clean and make a website secure.

4

I was able to clean the site I think. I removed some I frame code from every index.html on my site. The site is hxxp://www.nfocusstudios.com . I can now visit each page on the site without Avast saying there are any viruses. Trend and Norton didnt recognize the issue. My question now would be how to keep this from occuring in the future.

5

Isn’t it a problem of a strong password to edit the site?

6

This is commonly down to old content management software being vulnerable, see this example of a HOSTs response to a hacked site.

We have patched up the server and we found a weakness in PHP which was helping aid the compromise of some domains. We updated it, and changed some default settings to help prevent these coding compromises. The weaknesses were not server wide but rather just made it easier on a hacker to compromise individual end user accounts.

I suggest the following clean up procedure for both your accounts:

  1. check all index pages for any signs of java script injected into their coding. On windows servers check any “default.aspx” or
    “default.cfm” pages as those are popular targets too.

  2. Remove any “rouge” files or php scripts uploaded by the hackers into your account. Such scripts allowed them to make account wide
    changes, spam through your account, or spread their own .htaccess files through all of your domains in that end user.

  3. Check all .htaccess files, as hackers like to load re-directs into them.

  4. Change all passwords for that end user account. The cp password, the ftp password, and any ftp sub accounts. Make sure to use a
    “strong” password which includes upper case, lower case, numbers and NO COMPLETE WORDS OR NAMES!

This coupled with our server side changes should prevent any resurfacing of the hackers efforts. In some cases you may still have coding which allows for injection. All user input fields hidden or not should be hard coded, filtered, and sanitized before being handed off to php or a database which will prevent coding characters from being submitted and run through your software.

– Every 3.6 seconds a website is infected http://forum.avast.com/index.php?topic=47096.msg396648#msg396648.