I mean can you directly view the cached files in that directory, the "infected" ones. Via ftp or your cpanel file manager? What do they contain?

I found these... clicking did not open them. I deleted them

Hi @eel,

The posts which are suspected have the following IDs:

• 61306
• 14097
• 89902

You can open them by changing the example.com/community/ path to yours:

 https://example.com/community/postid/61306/ 
 https://example.com/community/postid/14097/ 
 https://example.com/community/postid/89902/ 

These are cache files which contains the content of posts in your forum. The listed posts of your forum contain spam URLs, and they are stored in the cache files as well. This is the reason of the infected reports. In most cases this is a false positive reports, in any case you can click the [Delete All Caches] button in wpForo > Overview admin page.

Very helpful. Thank you!