Mysterious iFrame Code turned up in all automated newsletters

I just found out that the code is still being added. How I found out: I stripped the code out of a newsletter’s source code, reloaded the page (Second Step), viewed source code. And the code is even added multiple times, about each time I click on the text field for editing.

…additionally, our last subscriber had his first autoresponder (after successful opt-in!) bounced by the provider, luckily to my notice. Coincidence?

So, I got a response about my bounce. Indeed, the iframe is the reason for bouncing my email. Since I cannot remove them without MailPoet or something else putting them right back in, I am now considered a threat by at least one provider. Of course, this happens right when we are featured by a big site on facebook :/ Please help me.

The code added is odd since it creates a hidden iframe, but doesn’t embed a page in the iframe, so it doesn’t seem to serve any purpose.

Doing a search on the only seemingly unique part of that code, “xdcom_frame”, pulls up a number of forum postings where that code is also oddly included at the bottom posts. So perhaps this is being caused by malware on your computer. Have you checked to see it if gets added when working on a different computer?

Thank you for investigating. These search results were not found when I checked before. Indeed, when I edit my newsletters with Chrome, the code does not get added. It seems I caught something with Firefox, some malicious add-on maybe. I cannot find anything in my add-on list, though. I should probably reinstall Firefox.

The problem seems gone now, without taking any further steps. It could have been some faulty update by the Firefox Proxtube add-on, which also caused multiple notification tabs to open. I restarted my browser, now the code is not added any more (I checked with Chrome, too).