I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly constantly.
At any rate, any PHP pages running on any of my sites on this server have had an iframe with a link to a malicious exe file from a chinese IP as the source. I shutdown the FTP server and was able to implement X-Frame-Option: DENY in IIS to prevent the file from trying to download. However, now I am trying to play detective and find where this malicious code is.
I tried looking throughout IIS but I believe it must be PHP specific. I looked in the php.ini files for references to this IP address but couldn't find anything.
If anyone could recommend ways to find and clean the malicious iframe code it would be appreciated. I have both PHP 5.3 and 5.4 installed from the Web Platform Installer.
Thanks.