Yesterday I upgraded to 4.0.4 PL1 and everything went smoothly. In about 2 hours I noticed that the forum's page is blank. i checked the code and in the very end found an alien code linking to a js file hosted on http://pantscow.ru:8080/. I deleted all files (except my images) and uploaded original files on my server. Everything works again. But several members posted that when they go to the forum homepage they get an anti virus alarm that page is infected. I had Norton and it couldn't detect anything. I installed Avast and it does indeed shows alarm (only on the home page). "Malware blocked. http://www.oregonfishingforum.com/index.php|>{gzip}. Infection: HTML:Script-inf".
As I understand the infection is not in the code of the page. What is that GZIP thing? Where is it? How to disinfect it? Please help!
__DEFINE_LIKE_SHARE__