IFRAME JS code injection is relatively sophisticated operation; In some cases, the hacker(s) are using previously hacked sites hosted on a Web server where the vast majority of the owners are usually unaware their systems have been compromised. If a client's Web site has been hacked, that means the hackers accessed the client's Web site through an insecure script, or their PCs are infected and the hackers got their passwords. We suggest you ask your clients with infected sites to clean their PCs (reinstall the Operating System (OS) if necessary), change their sites' passwords and save them in a secure place.

When someone visits an infected site, their browser is detected and attacked (currently, browsers affected are IE, Firefox and Opera). The visitor is unaware that they may have a keylogger that sends sensitive information, including their passwords, to the hacker(s). The hacker(s) use a program that goes to the persons site(s) and instantly adds the hidden FRAME JS code to Web page(s). This is how a Web site gets compromised. If a hacker gets an access to your server and can upload files using FTPing, or if Php and other scripts are not secured, it makes no difference what permissions the folders and files are set to or what security measures are implemented, your client's web sites could be compromised again.

To put your server back on track, you need to do the following:

• Make sure your own PC and/or client's PC is secure, NOT infected, and has an up-to-date Anti-Virus program. Re-install the OS, if necessary.
• Remove IFRAME codes in all files reside/hosted on your server.
• Upgrade, patch, and secure all Php and Perl/cgi scripts hosted on your server (no exceptions). 
• Change sites' passwords and save them in a secure place.
• Do not use any FTP applications that allow you/clients to access/upload files directly to the root directory on your server.

If you need help with your server, please click here and browse our Server Management Plans. Our engineers will be more than happy to work with you and put your server in excellent working condition.

Other articles in this Category

Understanding Attack Techniques

The Concept of Security

What Causes High Server Load?

Mod Security Rules and SPAM

Limit the resources for a specific user

Denial of Services (DoS) Detrimental to Businesses

Protect Your Company Against DDoS Attacks

Malecious Random JavaScript Rootkit

Latest findings about the Random JavaScript Rootkit

RKhunter report: The command '/usr/bin/ldd' has been replaced by a script

Linux kernels v2.6.17+ vmsplice()Root Exploit

Horde v3.1.6 and earlier is NOT secure

Warning :: A new wave of domain scam/spam

Your client or your PC might be a zombie in a Botnet

HowTo :: scan and stop uploading infected files to your server