vb.org Archive - trojan on my site, only sometimes happened (or random)

dear all,

i have weird experience with my site...
sometimes the page shown ads page which i dunno where is coming from... and sometimes also contain trojan or something else...

if i'm using Mozilla, the page contain ads or trojan can not appear, just appear blank page only with view source like below, but if using Internet Explorer or Opera, the trojan sometimes can shown ads pages which contain virus or asking to download something.

and this is the source code appear in Mozilla when the page is blank.

Code:

<script type="text/javascript" language="javascript"> var csrtw=new Date( ); csrtw.setTime(csrtw.getTime( )+12*60*60*1000); document.cookie="n\x5fses\x73_id\x3d53d\x312540afaf174fd0466f84\x316\x35af\x65e3 "+"; path=/\x3b ex\x70\151\x72es="+csrtw.toGMTString( ); </script> 

<script>document.write(String.fromCharCode(59+1,100,105,118,32,115,116,121,108,1 01,61,39,100,105,115,112,108,97,121,58,110,111,110,101,39,62))</script><h1><a href="http://keygenguru.com">serial</a>&nbsp; </h1><a href="http://keygenguru.com">keygen</a>&nbsp; <h1><a href="http://keygenguru.com">crack download</a>&nbsp; </h1>108.162.106.51 <h1><a href="http://www.getcoolmovies.com/movies/countries/usa/avatar/">Avatar movie</a>&nbsp; </h1><h1><a href="http://www.getcoolmovies.com/movies/countries/usa/avatar/">Download Avatar movie</a>&nbsp; </h1>84.126.249.228 <a href="http://keygenguru.com/movies.php">download movies</a>&nbsp; <a href="http://keygenguru.com/movies.php">online movies</a>&nbsp; 24.18.237.19 <h1><a href="http://supersoftwarestore.com">cheap oem software</a>&nbsp; </h1>



etc etc etc..... (skipped)



h1><a href="http://digg.com/health/Buy_Generic_Viagra_0_89">Buy Generic Viagra no prescription</a>&nbsp; </h1><h1><a href="http://digg.com/health/Buy_Generic_Zithromax_2_06_3">Buy Generic Zithromax no prescription</a>&nbsp; </h1><a href="http://digg.com/health/Buy_Cialis_8_09_3">Buy Cialis online</a>&nbsp; 205.251.177.45



-end of line-

but, when i try to Refresh the page, it seems back to normal and load normally...
the source page shown above is not always like this, sometimes it can be diffrent, thats make me crazy.
i've already try to take a look the code (php code) which it seems normal, and nothing to modified

where should i check the script or style or whatever container suspicious coding like above?

note: this script can load on every page, but not often, just sometimes (maybe random or something else)

please help me

thanks,
topan.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.00929 seconds Memory Usage 1,718KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (4)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: