How to Remove DIV from Iframe?

What's the best way to remove a PHP injection added an iframe to an image ALT tag when I can't locate the infected PHP file?

• When I scroll over the image, the ALT tag displays the embedded redirect code. However, I've scoured all my php files and can't seem to find it and remove it. Any help? (I'm a n00b in case you guys couldn't tell.)

• Answer:

  This may not be a PHP attack necessarily - the same can be done with JavaScript (and more often it is). If you can run some search commands on your directory, try searching for things like eval( which are often used to obscure the code. Also search for things like uuencode or other ways of encoding/decoding. Just because you cleanse the files, you should also be aware that an infection could klikely re-occur unless you close the vulnerability which allowed an attacker to inject in the first place. My company offers website security scans for a very low price which can help you find and correct these kinds of injection points. Also, if you are using a CMS like wordpress, be cautious about downloaded themes, which often contain this kind of code. Feel free to reach out to me with the infected link, and I will take a look at it.