[Bill Stuntz]

Originally Posted by Dave

I've seen the filestore72.info malware before. It supposedly only executes when someone comes from a search engine and I believe it infects the datastore cache. It's a pain to get rid of it. It creates a cookie so people will only see it once.

Check all of your plugins and hooks and I recommend overwriting all vbulletin files with fresh files downloaded from vbulletin.com.

The research I did when our MB was infected said that the cookie keeps the redirect from happening for THAT USER/BROWSER more than once PER DAY. And that's what seemed to happen for me. It made it nearly impossible to track. If I'd seen the redirect from ONE infected post, other infected posts didn't redirect because I'd seen it that day from the other post. But the next day, I'd see the redirect - exactly once.