Malware Issue - Urgent Help

[Cutsizzle]

I am having users say they are getting a malware warning when going to my site.

Can somebody find the root of the problem please?

www.chicitysports.com
www.chicitysports.com/forum

Thank you to whoever can help!

[Lynne]

What happened when Google visited this site?

Of the 29 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-11-10, and the last time suspicious content was found on this site was on 2010-11-10.This site was hosted on 1 network(s) including AS32475 (SINGLEHOP).

Your site has no CSS. Looking in the page source, it calls this:
http://www.chicitysports.com/wp-content/plugins/digg-digg/include/../css/diggdigg-style.css?ver=4.5.0.2

So, you've got some issues. I'd suggest using a totally default style and turning off your mods and seeing if that fixes the issue.

[CarlitoBrigante]

In these cases, the problem is NEVER, NEVER, NEVER cleaning up the infection. Usually the infection is either in a template or a plugin, hidden using some basic encoding like base64 to make it more difficult to be detected. Easy to clean.

The true problem is finding out HOW you were infected. This can take hours of going through your logs, and in some cases where logs are rotated very often or where you have a lot of traffic, it can take days of research to figure out what happened. In the past, investigating hack attempts, I even found security holes in scripts that most people considered perfectly safe. To do the same, you need to do some search across your access_log (and error_log) and aim at finding possible weird or unusual vBulletin calls. Try googling for access_log analysis and you might find some tips on how to get started.

In many cases, in my experience, the point of entry is simply a shared server environment, especially if the host is of dubious reputation. In these cases, the system is not setup to use the proper security policy and users are able to gain access to your database, for example, or to world writable directories in your website.

Regardless of their point of entry, these hackers (or script kids) then inject some code - often PHP scripts - into directories or vBulletin plugins, and then run the code to install whatever they want in your templates.

This can be used to spy on your users passwords, or sometimes just to show ad popups that link back to the hackers' accounts (in this case, it is easy to figure out who the attacker his and contact your local authorities, if the infraction is serious or caused major service disruption).

Lynne gave you good tips, BUT if the code has been injected into your plugins, or if the security hole allowing people to enter is in some modification and nobody has yet noticed or reported it, her tips will not be enough to get rid of the infection. Of course, if you do not have a fully upgraded setup - vBulletin and ALL modifications - then you might be running code with already known security holes.

--------------- Added [DATE]1290464426[/DATE] at [TIME]1290464426[/TIME] ---------------

On a note, after the always needed software upgrades, mod_security is by FAR the best tool to prevent these hacks even if you have vulnerable software installed. Some providers even create custom rules that are updated as soon as an exploit in a popular software (or one that you report) is found out, and your mod_security is automatically updated.

This might sound like advertising, but I have no affiliation with them - the guys at AtomiCorp.com offer a package which includes mod_security rules customized and updated as soon as a new exploit is found out in software like Wordpress or vBulletin. The only problem I had with their packages is that if you have an admincp located in a custom directory (which is often recommended), you might see some slowdown in the admincp area, caused by the fact that their mod_security rules are optimized only for standard vBulletin installs. And I think their stuff is optimized for Plesk, not sure if it would work on cPanel.