Help virus - win32:rootkit-gen
 

virus warnings started appearing on my board last night.. it tried to infect my pc and several users... I locked the forum down and started looking at files for recent changes..

I found the index.html file in the admincp/control_examples folder had an update date of last night and the file size is much larger that the original - I tried to move it to my pc to review but my avast went crazy - the original file is 1 byte the file on the server is 1700 bytes..

I am not the most tech proficient guy on the block..

My questions are:

1. should this file normally be changed by VB and showing a recent update?
2. should the size be that different from the original?

running 3.8.5

Thanks for any help!

Are you on a shared host? If so definitely let your hosting company know they should be able to fix it...

The file should be an empty index.html to prevent listing files in the directory is someone browse to it without specifying a scriptname.

But as said, if files are changed it is most likely it is done on the server and not thru vBulletin and more files might have been modified and unless your host fixes the security of the server it will happenb again.