Log in

View Full Version : Virus Alerts! HELP


hodgy
02-25-2013, 01:48 PM
Starting to pull my hair out. First off, I am not versed in the software but have people to help me with it.

In the past month my members virus alerts have been going off the hook when they visit the site and every page. It stopped for a week and then started up again. We have checked everything and even updated the software 3.8.7. My guy tells me it's all clear, but members are panicking and now my advertisers are questioning the integrity of the forum.

The site is www.yamahamotorcycleforum.com

I started a thread and this is what members are posting when their virus alerts go off.

Parent Pro
cess: C:\Program Files (x86)\Internet Explorer\iexplore.exe
File: C:\Users\Pappy\AppData\Local\Microsoft\Windows\Tem porary Internet Files\Low\Content.IE5\MFE8V351\js[1].htm

file:C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\KC2IK8JH\js[1].htm

Parent Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe
File: C:\Users\Pappy\AppData\Local\Microsoft\Windows\Tem porary Internet Files\Low\Content.IE5\MFE8V351\js[1].htm

FilePath="C:\Users\Owner\AppData\Local\Microsoft\Windows\Tem porary Internet Files\Low\Content.IE5\U7F1CY6P\js[1].htm"

and so on.

This last week I have also been getting loads of "auto response" emails sent to our email address even though we do not send emails out. The people receiving these emails are not members, so someone or some software is using our email address as the return.

this is getting very very frustrating. Any help would be greatly appreciated.

Lynne
02-25-2013, 06:44 PM
Have you talked to your host about this?

Simon Lloyd
02-26-2013, 01:03 PM
Your server or vb installation has been compromised, somewhere you have/had a vulnerability which has been exploited, search your files and compare them against stock vb files are there any file names that dont belong?, in admincp run the maintainance tool for suspect versions and see what comes up.

hodgy
02-26-2013, 01:12 PM
Ok, will do. Thanks.