I have been getting notifications from my host that my server was found to contain viruses... Each time they reference wpForo cache. I usually just clear the cache and I do not get anymore notifications. But then a week or two later I get another notification. This is how it reads.
Your services for gopherpucklive.com are at risk of being suspended.
Your gopherpucklive.com domain name was found to contain viruses or content that violates our Universal Terms of Service.
Due to the serious nature of this issue, you have 72 hours to take action. If any viruses or content that violates our Universal Terms of Service remains on your site after that time, it may become necessary to suspend our services.
If you require assistance with this, please see the following instructions.
To get you started, we have provided an example of the content accessible at the following location:
wp-content/uploads/wpforo/cache/post/e8c61967546d372736294eda140f4f3c
Note that it is in the wpForo Cache. And each of the 4 or 5 times I have received this notification, it has been within the wpForo cache.
So I figured that I would start here and see if anyone has had this happen to them before or to just get your thoughts.
and what is in that CACHE file? Did you check? If not, keep one to check it out next time ...
The funny thing is that before clearing the cache, the file was not on the server. So I cannot even FIND it.
And now as I look back, I see that they have used the same file each time.
e8c61967546d372736294eda140f4f3c
Do you have any security/firewall plugin installed?
I did have Wordfence installed... It found nothing. I removed it to see if IT was the issue. Doesn't appear to be. So strange.