Where is Mal/IFrame-F on one of our customer sites? 1

[isaacgrover]

Good evening from Wisconsin,

One of our hosting clients called us today with a concern that one of their visitors had reported that "Mal/IFrame-F" was found on their website. The website is for a small funeral home chain in Wisconsin and uses Joomla for content management.

I've pulled up the site on several of our workstations running different antivirus products with no report, and I had our web guru verify the date/time stamps and file sizes of every file on their site with the originals and there is no difference.

Could this be a false alarm on the website visitor's side or a legimate infection on our client's site? And if it is a legitimate infection on our client's site, how do we find the infected file on the server when only one antivirus product (so far) reports it?


--
Isaac Grover, Owner
Quality Computer Services of River Falls, Wisconsin
Web:

http://www.qcs-rf.com

 

[BadBigBen]

Could this be a false alarm on the website visitor's side

most likely... seeing that you guys did the correct thing, in checking the code with different AVs and comparing file size and date with the originals...

This is what I would do... Run scans with all the available AVs and LOG them... then sent a report to the owner of the website and present them with the LOGS as proof of a clean site...

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[smah]

Also try Linkscanner. However, a clean report here doesn't neccessarily guarantee that there are no problems.

One of the problems with Content Management Systems is that they have the tendency to be subject to SQL Injection expoits. Another problem is that once installed, they don't often get updated to more secure versions. You can use Scrawlr to scan for possible SQL Injection problems. Also, search the CERT website for Joomla. Check the version information for the various exploits against whatever version is actually being used.

 

[BadBigBen]

Thanx, Smah...

those are things that I was not aware of...

noted for future reference...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[smah]

Anyone that manages a website or a network of more than a couple PC's should subscribe to the appropriate CERT mailing list - it's a great resource for security issues.