*Need help locating this file - Microsoft is reporting my site as unsafe? (updated, there is a virus)

Jan

2012

Below is a message from several of the people that have gone to the site and tried to enter. I have several other sites, and this one was created for totally different topics unrelated to the original site. All of my other sites work just fine with no unsafe error codes coming up. I have had as many as 10 different people sending me an "unsafe report". There are no ads, I paid to have them removed for members and guests, and have walked them through adding the site to trusted sites within the internet options... to no avail.

Not sure of where to go from here?

This is the message from microsoft?
''This website has been reported as unsafe"

There shouldnt be anything unsafe about it, I have done nothing different with this one than the other 4 sites that I have with forumotion.

1 MrMario, on 18/01/2012 at 01h41

Hello,

Is sounds like a script you installed on your forum. Any smiles, images or codes just installed?

2 Miskebam, on 19/01/2012 at 06h02

Actually yes, I did install some smileys, but I downloaded them to my computer first, and then I also installed a widget with an image that clicks to go back to our original forum.

Will scout around to see if these are the problem. Will let you know.

Thank you!

3 Miskebam, on 19/01/2012 at 06h11

OK. I installed one smiley, I just deleted it, but other than that there is nothing different that I have done, other than the skin, I went from originally using Phpbb3 to phpbb2.

Is it possible that a script error occured?
Do I need to resync the forum?
Is it possible the site was hacked? I have always thought that forumotion runs the most upto date security, but someone mentioned that, so I thought I would pose the question.

Thank you!

4 Guest, on 19/01/2012 at 06h19

/t103243-

You probably have a GIF image that contains malicious code. Normally you wouldn't have a problem with images, but phpBB2 had a bug that allowed people to insert code into GIF images, and that code would get executed. So there are a lot of smileys (and other GIF images) floating around which contain malicious code.

Delete all GIF images you are using on your board, and I'll bet the problem goes away.

5 Miskebam, on 19/01/2012 at 07h38

I will look at those too, and thank you for being so helpful... this has me very upset and perplexed.

Would a gif cause the following? I just got this from one of my mods in a pm:

I did have Trend AV report a spyware on my lap top after visiting OOM2. I hadn't really been anywhere but on OOM and OOM2 that day or the day before.

OOM2 is the forum in question.

6 kirk, on 19/01/2012 at 12h08

Well the Microsoft message is fake and is a virus,
Please listen to what Dion is saying because it is most likely caused by a bad GIF as he stated above.

And as far as i know this only appears for people using IE8,

Anyway this member had the same problem for over a week and as of now we think he got rid of it by deleting a image he had on his home page.

/t103243-trojanjs-redirectore

7 Miskebam, on 19/01/2012 at 19h11

EXCELLENT! THANK YOU! I WILL LET THE MEMBERS KNOW!

That makes sence, because its only happening to a few members and not all of them...

Most greatful for the help!

8 Miskebam, on 27/01/2012 at 16h14

OK, I received this back from microsoft, but I can not find where to remove the problem .gif, I have been to every corner of admin panel and can not find it, possible to get an idea of where to look?

We did identify a download on your site that has malware:
www.oom2.com/users/2911/13/13/79/smiles/573335.gif

This gif file hosts the threat: Trojan:JS/Redirector.E

This looked like user 2911, but I only have 579 members...

I didnt put the .gif on the site, so either a user did, or it was part of the skin that I used.

Any help would be appreciated, am exhausted from looking.

Thank you!

9 Miskebam, on 28/01/2012 at 16h23

24 hour. Bump.

10 Guest, on 28/01/2012 at 21h28

That image is a smiley. Go to your ACP and delete the smiley which has this: users/2911/13/13/79/smiles/573335.gif as part of its file name.

If the smiley doesn't exist, then someone added it into a post using IMG BBcode. You'll need to find that post and remove the tag.

Either way, you should alert the staff. The techs need to remove that image from wherever it's currently stored, because this problem will happen again and again until the image is removed.

11 lobosoll, on 29/01/2012 at 22h15

you shud also check that you have not picked up something that has planted its self in your browser and acting in your forum the same way
scan pc with malwarebytes and antivirus/or aswell uninstall your browser and re-boot then re-install browser .

12 Miskebam, on 29/01/2012 at 22h41

I have been through every ACP area and can not locate this smiley.

How do you alert the staff?

and thank you for suggesting the running for malware... It might be that I need to suggest that to the members as well...

what a pain this has been Sad

13 lobosoll, on 29/01/2012 at 22h42

whers your site url ill come and sign up and see bro

14 slg, on 29/01/2012 at 23h01

Miskebam wrote:I have been through every ACP area and can not locate this smiley.

How do you alert the staff?

and thank you for suggesting the running for malware... It might be that I need to suggest that to the members as well...

what a pain this has been

Please don't use bold or color. Please keep to the default text. This is reserved for the staff for moderation.

15 Miskebam, on 29/01/2012 at 23h05

sorry about the bold, and thank you for the reminder, it was purely out of habit.

my site url is http://www.oom2.com

Thank you!

16 slg, on 29/01/2012 at 23h08

I just tried the link. I did not get a warning message.

17 Miskebam, on 29/01/2012 at 23h17

Microsoft removed the warning for unsafe site this last monday, but told me they found the .gif with the virus attached, but some of the members are still reporting that they are getting a warning.

Problem is I unable to locate that .gif to remove it. Sad

18 slg, on 29/01/2012 at 23h19

Have you gone through the whole forum topic by topic to see if someone added it to a post?

19 Miskebam, on 29/01/2012 at 23h26

No, I have not, thought maybe someone here could tell me how to remove it without going through all 2207 messages, since I thought maybe it was an issue that might have been gone over before, but I could not find.

Thanks for your help, I will go through them until I find it.

Thank you!

20 slg, on 29/01/2012 at 23h28

Sorry but you will have to check each topic one by one.

You could try to use your browser finder to locate the smiley.