Found malware

[cric2k]

Hi,

I found a virus being embedded in the template 'headinclude_bottom' - it was a clever javascript insert that was only showing itself to certain members (for instance not admins).

When I removed {vb:raw template_hook.headinclude_bottom_css} from headinclude_bottom it no longer embedded the malware in the html.

I've tried looking about plugins and can't find the hook - am I supposed to be looking for a hook, or does anyone have any idea how someone has managed to get this data in there?

I'm on 4.1.9 by the way.

Thanks