Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

While searching for our company name, we get (in the native results page) a message that claims: enter image description here

Webmaster tools does not tell me much about this, and so does the server log.

  • I don't get that message searching with Bing

Where should I check to remove the offending code (if at all there is one - and it's not a false-positive by google)

Further investigations, shows that none of the free online scanning tools, show my site as infected (even the google resutls say it's clean) but still I get this alert

http://sitecheck.sucuri.net/results/www.optitex.com - shows that the site is clean, even by Google engine.

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=optitex.com

Any ideas ?

EDIT:

If I use the WMT Fetch as Google - I get a thumbnail of the page - and that still shows ads for drugs (so help me GoD)

enter image description here

so: where is this coming from? how can I fix this issue?

share|improve this question
add comment

migrated from webapps.stackexchange.com Apr 11 '13 at 13:13

This question came from our site for power users of web applications.

2 Answers

up vote 1 down vote accepted

As the page linked by Al Everett says (emphasis mine):

"To be clear, when our malware detection system classifies a site as potentially hosting malware, we show a "This site may harm your computer" message. When we believe a site may be hacked or compromised but have not detected malware, we display "This site may be compromised" as an alert."

So the bad news is, your site has almost certainly been hacked. The good news is that it doesn't (so far) appear to be actively distributing malware to your visitors, but simply feeding your pagerank to spam domains.

The reason you don't see anything wrong when you visit the site is almost certainly that the malicious code injected into your site is set to only run when visited from Google's IP addresses. (It could also be checking the User-Agent string, but in that case you should be able to trigger it by changing your browser's User-Agent string manually to match Googlebot's; I just tried that myself, and got nothing suspicious back.) That's why the spam only shows up in Google's search results and through "fetch as Googlebot".

To get rid of it, you'll want to both remove the existing infection (preferably by restoring to a known-to-be-good backup, to make sure no backdoors are left in place) and update your software to keep it from happening again. (The most common way such spam infections happen is through known vulnerabilities in old versions of CMSes or other widely used software.) For details, see e.g. these instructions from Google or these more general tips from StopBadware.

share|improve this answer
add comment

Did you click on the link This site may be compromised? That points you to an an instructions page within the Webmaster Tools with information on what you can/should do.

share|improve this answer
    
Thanks, I have - but when asked to go to the Malware: request a review - I get a message: Google has not detected any malware on this site. so From googles POV my site is clean, but I still get the message. –  Saariko Apr 11 '13 at 8:42
    
Sorry, but this isn't something I've ever had to deal with. Perhaps the folks at Webmasters have better insight. –  Al Everett Apr 11 '13 at 12:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.