Need Help with SSH to remove iframe virus Please!

[sdballer]

How can I search ssh and remove:

<iframe src="[mod edit removed link]" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>

the first part of http://XXXXXX is changing always.

thank you.

[ChiefGoFor]

These types of hacks are never any fun. If you have a backup from just before the hack, I would go with that route. Even if you clean up all of the iframes left behind, who is to say that they did not leave a backdoor open to get back in later and do it again?

But, you might want to try using a grep statement to find all of the iframe statements.

Code: Select all

grep -rn "<iframe" *

Note: Not all of the results will be the hackers doing. Some files will legitimately have iframes in them... but it will be easy to tell what is legit and what is not.

[PhilD]

To best repair a hacked site follow the checklist below. Removing the iframes probably will not remove the entire hack or the reason it was hacked in the first place.

[ ] Run the forum post assistant and security tool Instructions available here Post the results here so we can have a look at it.

[ ] Ensure you have the latest version of Joomla. Download the latest full version of Joomla and use it to replace the core files. Only by replacing all files in the installation (including extensions and templates) can you be sure to remove the backdoors inserted and hidden in files.[/b]

[ ] Review Vulnerable Extensions List and update or remove (if no update is available and vulnerable extensions.

[ ] Review and action Security Checklist checklist 7 make sure you've gone through all of the steps, not just the easy ones!!

[ ] Change all passwords and if possible user names for the website host control panel and your Joomla site.

[ ] Use proper permissions on files and directories. They should never be 777, but ideal is 644 and 755

[ ] For the malicious code topic

[mandville]

topic locked due to no response from original poster and age/changed code of topic - see http://forum.joomla.org/viewtopic.php?f=432&t=509319