WTF is trojan script iframe

Hey guys, need help. Im not sure where to put this so i need put it here.

WTF is trojan script iframe and how do i delete it?
My site got infected by it!

nahh it cookies stuff
what do you use bitdefender or kapersky

Quite simply delete the iframe ?

this hit me and it is pretty nasty... it is some type of PHP worm that infects index.php files, and links to some iframe on an outside site. I kept thinking I cleaned it too but a reformat was all that finally took care of it.
Posted via Mobile Device

what you didn't understand ? the word iframe or the trojan word ?

My sit got a Iframe attack 3 montha back...I started a similar thread asking for help....Here it is....See if it is useful for you.


http://www.blackhatworld.com/blackh...p-me-somethig-weird-happening-my-website.html

Ok, I had same issue, will share with you how I solved this problem.

1. write to google antimalware and download free malwarebytes software.
2. check your computer for malware.
3. Erase all ftp and http (browser) history
4. Change passwords
5. Check all index, header files in all dirs to find iframes, also you will find some more files:
it's like when you erasing one iframe in index for example and trying them go to your site, you will see warning for different file>check that file and erase iframe (don't forget to look for broken code end, because these iframes are nasty, they like to break the code). DONT FORGET HTACCESS! - often shit comes from this

Troubleshoot:
let's say it didn't help...
then make again every step, but replace 5 step and make this proccess:
-make backup of your database (check google)
-make backup of your uploads
-delete everything
-install fresh site and put your database with uploads.

Write in google "how to delete iframes" and so on.

btw
I don't use ftp program anymore, I use firefox addon fireftp - its safier.
Don't forget permissions. NEVER 777 in themes and plugins, especially in those files which people can see.
Good luck mate.
I would write more, but my english is my wall.

I had a problem also a few months ago
someone put this code


in all my index , config and db phps so google blocked my site with that stupid warning

was using the viral script

gundamwing said:

nahh it cookies stuff
what do you use bitdefender or kapersky

Click to expand...

I use kaspersky.. any way i can delete it? that thing is on my sales page.

netjedi said:

I use kaspersky.. any way i can delete it? that thing is on my sales page.

Click to expand...

check your sales page source try find iframe tag because kapersky detect iframe trojan or maybe an invisible popup you have there

found one of them... it was from a download in this forum. Someone shared a PLR which i added into bonus with the small part of the sales page. Whats inside?

<script type='text/javascript'> str='@3c@49@43@3d@27@68@74@74@70@3a@2f....

this seems to be the prob.
Anyone knows whats this?

it's scrambled code ... only if you know the scrambling method you can decode it ...

I just delete that part. Now the iframe thing doesn't appear..
Weird..