malware
 

My users are reporting they are getting malware on their PC after using vB at http://www.landofmarbles.com/phpbb/index.php

One user said in a post titled "malware*"

"i'm getting it here. it said i needed anti-virus software. then it closes this webpage and takes me somewhere else. it did the same thing on another computer i used. please remove the malware. thanks"

Another user posted:

"Yeah* saw that today as well between showing a thread on the forum. It threw up a javascript file that attempted to redirect me to a .cn (chinese) domain. Microsoft Security Essential caught it while I was on the site.

What happened to me is that showthread.php went blank rather than showing the thread and my antivirus software popped up a warning. I viewed the source on the blank page and attached an image of it. I partially decoded it and attached a blurred shot of where it attempts to redirect you. The destination url is listed on malwareurl.com as redirecting to a rogue antivirus installation.

It was not happening every time and the machine I was using to access the site was running Internet Explorer 6* so it might only be targeting certain browser versions.

Update: the url was listed on http://freepcsecurity.co.uk/ yesterday and that site says the following:

Quote:
New additions of malicious sites for October 6* 2009 which will compromise your PC Security. Some may contain ‘driveby’ downloads and are to be considered highly dangerous.

Also bear in mind that these use ‘flux’ techniques and may not resolve and disappear from one domain and appear on another.

These sites WILL harm your computer so it is advised to keep well away from them or add them to your Hosts file so that they are blocked. "

He also said:

"You might also show that javascript code screenshot I gave and ask the powers that be to search your site files for strings that are in that code."

The screenshot he refers to can be seen here:
http://www.landofmarbles.com/phpbb/a...4&d=1254932179

Anybody have any idea what my next step should be?