Comments on: HTML:Iframe-inf wordpress Infection

By: Malware - netzwelt.de Forum

Malware - netzwelt.de Forum — Fri, 07 Aug 2009 06:44:20 +0000

[...] [...]

By: 7 Steps to remove Iframe virus from your Wordpress blog | Techno360

7 Steps to remove Iframe virus from your Wordpress blog | Techno360 — Sat, 18 Jul 2009 15:41:42 +0000

[...] How to remove IFrame Trojan? Frame Hack WP on Several Sites Using Combofix to guide and tutorial HTML: iframe wordpress-inf Infection [...]

By: Como limpar o maldito vírus IFrame que infectou o seu blog na plataforma Wordpress – WP (vírus de blogs) | Rei da Cocada Preta

Sun, 12 Jul 2009 17:08:48 +0000

[...] para limpeza usadas neste tutorial: How to remove IFrame Trojan? HTML:Iframe-inf wordpress Infection iFrame Hack on Several WP Sites AntiVirus protection for your blog Using Combofix a guide and [...]

By: HTML:Iframe-inf fun….not

HTML:Iframe-inf fun….not — Thu, 02 Jul 2009 00:13:25 +0000

[...] days ago, which helped me a treat, but also returns more files that are ok than the ones infected: here The shell scripts this guy has created, did help me track the bits i needed to remove which was a [...]

By: ????? ???????? – ???? ????? iframe injections ??????? SSH | ?? ?????

????? ???????? – ???? ????? iframe injections ??????? SSH | ?? ????? — Sun, 21 Jun 2009 19:57:24 +0000

[...] ????? ????) ?????? ???? ???? ?? ????? ??? ????? ?? iframe, http://fieldsmarshall.com/htmliframe-inf-wordpress-infection/ ?? ?????? ????? ??????? ????? ??? [...]

By: fields.marshall

fields.marshall — Fri, 19 Jun 2009 17:08:42 +0000

Victor thanks for your comments..

Email me your SED code and I will place it .. You think this is better than perl ?

Max you would need to talk to your hosting provider to get command line access

By: Max

Max — Thu, 28 May 2009 05:10:35 +0000

what’s a command line and how do you access it

By: Victor

Victor — Fri, 22 May 2009 13:52:56 +0000

Sorry but i can't add the full code because this doesn't support url in comment.

find ./ -type f -exec sed -i 's///' {} \;

By: Victor

Victor — Fri, 22 May 2009 13:50:18 +0000

I think this is the simpliest solution to remove iframe-inf after you have found the infected text. Works 100%.

find ./ -type f -exec sed -i ’s///’ {} \;

Just replace the iframe src addres with the one from your infected text. Use regex on click=.*. Run the command from /home directory to remove the virus from all website files.

Good Luck!

By: fields.marshall

fields.marshall — Tue, 05 May 2009 14:10:18 +0000

Hi GrandPa Smurf,

Yes, I have seen the infection on servers without wordpress. On shared hosting if the infection can get in with one website then it seems to be able to access other websites and spread to others.

Glad the script was helpful