JS/TrojanDownloader.Agent.NRN trojan ?

[jene]

HI
ANTIVIRUS SHOWS TO MY USERS THIS WHEN THEY ENTER TO MY FORUM

JS/TrojanDownloader.Agent.NRN trojan
WAHT I NEED TO DO PLZ ?

TNX !!

[Blind Dragon]

Whats your site - I'll look through it for you if you like to find the malicious code ;)

I run a free support site that specializes in malware

[Blind Dragon]

Your site is infected with a javascript redirect virus

Note: I replaced your address with yoursite.net to protect users who may not know what they are doing!

Basically all you need to do is delete the contents of the following folder and re-upload the original files in the following folder:

* yoursite.net/vb/clientscript

List of infected files:

1/21/2010 5:05:22 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_md5.js?v=384" file.

1/21/2010 5:05:22 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_read_marker.js?v=384" file.

1/21/2010 5:05:22 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_menu.js?v=384" file.

1/21/2010 5:12:33 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/yui/connection/connection-min.js?v=384" file.

1/21/2010 5:12:34 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_global.js?v=384" file.

1/21/2010 5:12:35 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=384" file.

1/21/2010 5:12:40 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/yui/connection/connection-min.js?v=384" file.

1/21/2010 5:13:13 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_global.js?v=384" file.

1/21/2010 5:13:24 PM Sign of "JS:Illredir-D [Trj]" has been found in "http://www.yoursite.net/vb/clientscript/vbulletin_menu.js?v=384" file.

This wont fix any security holes the site may have but it should remove the infected files.

After you have done this let me know and I'll check it again. I can't dig into the source until you have replaced these files.

[jene]

done ..

tnx !!!

[jene]

help somebody plz
i steel have the virus