I’ve been searching around and I haven’t been able to come across this problem as of yet. Now on my own personal website / forums, a page that I usually visit at least 5-10 times a day, I’m suddenly getting a virus warning which won’t allow me to visut my site.
Not entirely sure how or more importantly why I’m suddenly getting the error but I was wondering if anyone can help.
The error / virus is
“” HTML:|frame-inf “”
Here’s a screen shot of what pop’s up on my computer when I attempt to log onto my page. Also, I’ve tried attempting to report it as a false positive but I’m not sure if that’s going to get me anywhere. I’ve also contacted my friend who helps me admin the site and he did not and does not have any issue with our forums.
Any information would be even more helpful, like the URL so it can be investigated.
I would say it is almost a cast iron certainty that your site has been hacked, the insertion of an iframe tag/s. Of all the sites I have investigated with this malware name, none have proved to be false positives. You only need to do a forum search for the malware name to see this.
Check your site code normally after the closing html tag for any hidden iframe tag insertion. Though it is possible that it could be inserted anywhere on the page code, by hidden I mean one of the iframe attributes is Hidden, not that you can’t see it in your code.
I’m not the most IT savvy guy as well, so an explanation in laymen terms would probably be most beneficial. And as I said, my friend who helps me admin the site has told me I’m a “noob” and that my AV is probably just taking a “crap.” I’m fairly sure he’s using Norton’s Corporate AV as well.
IF it helps, I’m using the free version of Avast since I’m a student and currently cannot afford to upgrade to pro.
The only difference is this hidden iframe has been inserted before the page code also a big standards no, no and highly suspicious. Not to mention the iframe is pointing at a Chinese domain spy-cams.cn, see image.
You could start by showing him this Topic and the above image.
He will have to search the html code for pages that have this iframe inserted and remove it, he may have a tool that can automate the removal of the iframe, but it isn’t guaranteed that the iframe would all be identical or if you use iframes legitimately in the site.
You/he should change the password used to modify the site and tighten up security on file permissions.
Well another thing to look at is the forums software as some may have vulnerabilities which can be exploited so it is important that the forum software is kept up to date.
You’re welcome, one of the most crucial things is to have the latest version of the php forum software as most commonly the hacking comes from vulnerabilities on old versions.
Even with captcha you will still get some drive by spammers, we still do, but this makes it harder to automatically create accounts to post spam. In the avast forums we have a large group of regular and they are very active in reporting spam using the Report to moderator link in posts.
So what little we get is promptly squashed (touching wood whilst having fingers crossed), but that does also rely on prompt action by the moderators.
