Microsoft security software detects and removes this threat.

This threat is a specially-formed IFrame that redirects you to websites that might have other malware.

You might come across this infection when you visit a hacked or malicious website.

What to do now

The following Microsoft software detects and removes this threat:

Clear the cache

You should delete your temporary Internet files so your security software doesn't continue to detect this threat:

Update vulnerable applications

There is more information about updating software that is commonly targeted by malware in the following links:

Threat behavior

Trojan:JS/IframeRef.EX is a detection for a trojan that redirects your browser to other sites. These sites may attempt to download and install malware onto your computer, often by exploiting software vulnerabilities.

Make sure you install all available updates for your computer to help prevent the downloading of more malware. For more information on updating software, including Java, Adobe and Microsoft products, please see the Additional information section in this entry.

This trojan is a malicious JavaScript file that creates a hidden IFrame. The JavaScript file is embedded into compromised webpages, usually via SQL injection or through Blackhat search engine optimization (SEO) poisoning.


When you visit a website that contains this threat your browser is redirected to another website that may attempt to download and install malware onto your computer. The malware could be any of the attacker's choice, and is typically downloaded onto your computer by exploiting software vulnerabilities.


Redirects webpages

In the wild, we have observed this threat redirecting to a large list of malicious URLs, including the following:

Additional information

Software vulnerabilities are fixed through the application of updates or patches from the software manufacturer.

The best way to protect your computer from exploits is to ensure that the versions of your software are up-to-date. Follow these links for more information on updating software that is commonly targeted by malware:

Analysis by Chris Stubbs


Alerts from your security software may be the only symptom.


Alert level: Severe
This entry was first published on: Jun 27, 2013
This entry was updated on: Oct 14, 2013

This threat is also detected as:
No known aliases