*Need help locating this file - Microsoft is reporting my site as unsafe? (updated, there is a virus)

Below is a message from several of the people that have gone to the site and tried to enter. I have several other sites, and this one was created for totally different topics unrelated to the original site. All of my other sites work just fine with no unsafe error codes coming up. I have had as many as 10 different people sending me an "unsafe report". There are no ads, I paid to have them removed for members and guests, and have walked them through adding the site to trusted sites within the internet options... to no avail.

Not sure of where to go from here?

This is the message from microsoft?
''This website has been reported as unsafe"

There shouldnt be anything unsafe about it, I have done nothing different with this one than the other 4 sites that I have with forumotion.

Hello,

Is sounds like a script you installed on your forum. Any smiles, images or codes just installed?

Actually yes, I did install some smileys, but I downloaded them to my computer first, and then I also installed a widget with an image that clicks to go back to our original forum.

Will scout around to see if these are the problem. Will let you know.

Thank you!

OK. I installed one smiley, I just deleted it, but other than that there is nothing different that I have done, other than the skin, I went from originally using Phpbb3 to phpbb2.

Is it possible that a script error occured?
Do I need to resync the forum?
Is it possible the site was hacked? I have always thought that forumotion runs the most upto date security, but someone mentioned that, so I thought I would pose the question.

Thank you!

https://help.forumotion.com/t103243-

You probably have a GIF image that contains malicious code. Normally you wouldn't have a problem with images, but phpBB2 had a bug that allowed people to insert code into GIF images, and that code would get executed. So there are a lot of smileys (and other GIF images) floating around which contain malicious code.

Delete all GIF images you are using on your board, and I'll bet the problem goes away.

I will look at those too, and thank you for being so helpful... this has me very upset and perplexed.

Would a gif cause the following? I just got this from one of my mods in a pm:

I did have Trend AV report a spyware on my lap top after visiting OOM2. I hadn't really been anywhere but on OOM and OOM2 that day or the day before.

OOM2 is the forum in question.

Well the Microsoft message is fake and is a virus,
Please listen to what Dion is saying because it is most likely caused by a bad GIF as he stated above.

And as far as i know this only appears for people using IE8,

Anyway this member had the same problem for over a week and as of now we think he got rid of it by deleting a image he had on his home page.

https://help.forumotion.com/t103243-trojanjs-redirectore

EXCELLENT! THANK YOU! I WILL LET THE MEMBERS KNOW!

That makes sence, because its only happening to a few members and not all of them...

Most greatful for the help!

OK, I received this back from microsoft, but I can not find where to remove the problem .gif, I have been to every corner of admin panel and can not find it, possible to get an idea of where to look?

We did identify a download on your site that has malware:
www.oom2.com/users/2911/13/13/79/smiles/573335.gif

This gif file hosts the threat: Trojan:JS/Redirector.E

This looked like user 2911, but I only have 579 members...

I didnt put the .gif on the site, so either a user did, or it was part of the skin that I used.

Any help would be appreciated, am exhausted from looking.

Thank you!

24 hour. Bump.

That image is a smiley. Go to your ACP and delete the smiley which has this: users/2911/13/13/79/smiles/573335.gif as part of its file name.

If the smiley doesn't exist, then someone added it into a post using IMG BBcode. You'll need to find that post and remove the tag.

Either way, you should alert the staff. The techs need to remove that image from wherever it's currently stored, because this problem will happen again and again until the image is removed.

you shud also check that you have not picked up something that has planted its self in your browser and acting in your forum the same way
scan pc with malwarebytes and antivirus/or aswell uninstall your browser and re-boot then re-install browser .

I have been through every ACP area and can not locate this smiley.

How do you alert the staff?

and thank you for suggesting the running for malware... It might be that I need to suggest that to the members as well...

what a pain this has been

whers your site url ill come and sign up and see bro

sorry about the bold, and thank you for the reminder, it was purely out of habit.

my site url is http://www.oom2.com

Thank you!

I just tried the link. I did not get a warning message.

Microsoft removed the warning for unsafe site this last monday, but told me they found the .gif with the virus attached, but some of the members are still reporting that they are getting a warning.

Problem is I unable to locate that .gif to remove it.

Have you gone through the whole forum topic by topic to see if someone added it to a post?

No, I have not, thought maybe someone here could tell me how to remove it without going through all 2207 messages, since I thought maybe it was an issue that might have been gone over before, but I could not find.

Thanks for your help, I will go through them until I find it.

Thank you!

Sorry but you will have to check each topic one by one.

You could try to use your browser finder to locate the smiley.