Those aren't all that mysterious. Those are SQL injection attacks that use .js to pull all sorts of fun tricks. The only solution is to either do a database restore or write a script to remove these from your database.<div>
<br></div><div>Keeping your site up to date with the latest security releases and patches greatly reduces your vulnerability to such attacks.<br><br><div class="gmail_quote">On Mon, Aug 10, 2009 at 11:10 PM, rajasekharan <span dir="ltr"><<a href="mailto:websweetweb@gmail.com">websweetweb@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hello Drupalers,<br>
<br>
You may have heard or even experienced the attack where some mysterious iframe tags are placed right after the<br>
<body> and before the </body> tag in you index.php file, header.php, login.php and footer.php.<br>
This even causes the php files to break as the iframe tags are placed randomly within the index.php file (failing to find the <body> tag) resulting in<br>
php errors.<br>
<br>
The attack causes your website to be blacklisted and marked as an attack site in the search engines. Even the web browsers<br>
scare people away from visiting the site with nice blood red alert signs (not that I blame them).<br>
<br>
This problem exists for users of all content management systems such as wordpress, phpbb, joomla, fauxBB and so on. I might have the solution to this problem.<br>
<br>
The problem starts at the website owner's computer being infected with some virus. The virus listens to the FTP transactions and relays the<br>
FTP information to someone else. Most attack victims have reported having used FileZilla so the virus may even be finding and reading<br>
FileZilla's xml/registry database (or may simply be a conincidence).<br>
<br>
The attacker uploads a PHP file to the server and starts executing it and immediately removes it. I was unable to find any offending script in one of my clients'<br>
websites where the attack had taken place. The malicious script is (probably) running as a background process (may be using ignore_user_abort or similar) while the script file has been deleted (which is possible in linux). This is why sometimes the offending code return to the pages inspite of the FTP password being changed. But the attack always stops after the server has been restarted. I am<br>
still not certain if the background process theory is correct as I have not been able to verify it yet.<br>
<br>
The only solution I can think of is to change the password and restart the server. If the server is in a shared host, it may be possible to kill the<br>
offending script's process. You can find out if there are any php threads running for a long time via SSH using the ps -aux command and<br>
kill it using kill [procid].<br>
<br>
Please let the list know if you face the same problem.<br>
<br>
Raj Sekharan<br>
<a href="http://www.expeditionpost.com" target="_blank">http://www.expeditionpost.com</a><br>
_______________________________________________<br>
consulting mailing list<br>
<a href="mailto:consulting@drupal.org" target="_blank">consulting@drupal.org</a><br>
<a href="http://lists.drupal.org/mailman/listinfo/consulting" target="_blank">http://lists.drupal.org/mailman/listinfo/consulting</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>Cary Gordon<br>The Cherry Hill Company<br><a href="http://chillco.com">http://chillco.com</a><br>
</div>