IFRAME Trojan Solution

Today, more than 2000 <IFRAME src = "http://ca.winvv.com/cn.htm" width = 0 Height = 0> </iframe> servers on one server are injected and I'm dizzy! After checking for half a day, it turned out to be caused by the FCKeditor Upload Vulnerability. While searching for materials, I found that CSS has an interesting attribute expression. I found that this stuff has some meaning and thus I wrote it, "to be specific "!
Reference: "ie5 and later versions support using expression in CSS to associate CSS attributes with JavaScript scripts. the CSS attributes here can be inherent attributes of elements, it can also be a custom attribute. That is to say, the CSS attribute can be followed by a javascript expression, and the value of the CSS attribute is equal to the result of JavaScript expression execution. You can directly reference attributes and methods of an element in an expression, or use other browser objects. This expression is like a member function in this element ." In my understanding, expression is followed by JS expressions to execute related operations.
Format:
(1) mark the inherent CSS attribute name: expression (JS expression );
(2) custom attribute name: expression (JS expression );
How to Use js to destroy an IFRAME object: Convert the request address in IFRAME to a blank page (about: blank), and then extract the IFRAME object from the DOM (Document Object Model) to cut off all requests in IFRAME.
CSS Code : IFRAME {Wuwei: expression (this. src = 'about: blank ', this. outerhtml = '');}
Explanation: The outerhtml attribute is the HTML code contained in the DOM object, while the innerhtml attribute is the HTML code contained in the DOM object (excluding itself.
Example: If you want to make your IFRAME appear on the webpage, and other IFRAME trojans do not work, add
# Okiwuwei {iwuwei: expression ()! Important}
The corresponding IFRAME code is:
<IFRAME id = "okiwuwei" src = "http://blog.csdn.net/codeshark/"> </iframe> is OK.
Problem summary: Many spam sites increase their click-through rate and access volume through the pop-up window. It is estimated that they inject Trojans through IFRAME and then achieve this effect. Of course, this method is only ie only, and cannot fundamentally prevent Trojan injection.

First, create a new webpage and insert the above CSS code (or add the above sentence to your existing CSS code ):
<Style type = "text/CSS">
IFRAME {Wuwei: expression (this. src = 'about: blank ', this. outerhtml = '');}
</Style>
Then insert several IFRAME codes on this page, assuming they are Trojans. The Code is as follows:
<IFRAME src = ""> </iframe>
<IFRAME src = "http://blog.csdn.net/codeshark/"> </iframe> Wuwei blog