Malware
 

Suspected injected code Instances
<script type="text/javascript" src="http://www.athomelibero.
in/isr.js?amekil">

This is injected into 3 threads and 2 regular sections on my forum, how do I go about finding out how it is done to prevent it and remove it?

do you mean posted by a member?

nope, it's injected. I'm looking at my google webmaster panel and report shows that the code is injected into 2 forum section urls and 3 thread urls.

If you are allowing members to post using HTML then you are going to get stuff like that. Do not allow HTML in threads/post.

Edit the post, you should see the code used.

HTML is disabled, its not being posted, I know this because the code is injected in forum display urls too ex: https://vborg.vbsupport.ru/forumdisplay.php?f=245