Tag Info

Hot answers tagged

4

Figured it out. "Fetch as Googlebot" was reporting the site just fine too. I then used someone's tool to spoof crawler as Google and saw it happening. The portal plugin for phpBB had some base64 code inserted due to bad permissions (7xx) and I fixed it all. I'll probably wipe this server out though.


4

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not ...


3

There are two steps you need to take. First, you have to secure your website. Then you have to go into damage control and try to restore your website's ranking in the search engines. To secure your website you need to start by changing ALL passwords - particularly ftp but also change anything that requires a password in order to access. Then you should run ...


3

Check HackAlert SafeImpression from Armorize Malware. I've never used it, but if I understood well your problem, this may be worth a look.


3

IMO, if you have to ask, then you need to find a webmaster/web developer with some security expertise to handle the situation. There are millions of ways a site could be compromised and infected with malware. There isn't a magical program you can just run on your server to remove the malware infection. So without knowing how the system was built, how it was ...


3

The message I get in chrome says: melfordschoolofmotoring.co.uk contains content from 31.184.242.103, a site known to distribute malware. Your computer might catch a virus if you visit this site. If you look at your website's headers using livehttp headers (see note below about how I found this code) you'll see a request for ...


3

Once you've cleaned up the pages submit a reconsideration request to bing, for the pages that no longer exist I'd return a 410 (gone) status message so the search engines no longer look for them.


3

The site, with the warning, seems to stay in the google rankings. However, if someone clicks on that listing, they would be taken to a google warning page telling them to go no further. To get to the site you actually have to copy and past the address into your browser's location bar. This would seriously reduce the amount of traffic you get from google.


3

It's more than likely your WordPress install has been compromised. The permanent fix is to follow these steps to ensure it is fully cleaned and to prevent a recurrence. This is the best method to ensure it is 100% clean. Backup the database Make a note of the customizations, such as plugins or any other modifications you’ve made. Remove all files from the ...


3

You may not be hosting malware now but you have relatively recently: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=goodtherapy.org The script could be randomly injected or perhaps your ISP is cleaning things for you in the background. In any event, your site has been and probably still is compromised and you should be doing a ...


2

If you request a review through Google Webmaster Tools you should see a delisting in about 24 hours providing your site is verified to now be clean. Repeat instances don't seem to affect this timescale. We've had a situation in the past where a shared server host was hacked and the sites were continually reinfected. One one particular site I requested ...


2

Here's what Bing say here about if you're penalised for being spammy, but it sounds like it applies to malware too: Go to Bing E-mail Support and fill out the form completely Select Content Inclusion Request from the drop-down list. A new drop-down will appear underneath. From the new drop-down list, select Reinclusion request. Write a clear and detailed ...


2

Mark your website as temporarily down. Rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't lose too much data. Upgrade to the latest WP (again). Upgrade any plugins, and remove unnecessary plugins. Go online again.


2

If you can access the site via http, use this script (upload it to your server). It searches for commonly used patterns of the "bad guys" and prints some info in which files which malware code has been found. If you are not able to do that directly on your hosting account, download the whole stuff and use a local webserver to execute the script. I already ...


2

End-user malware systems often use their own databases to identify issues on sites. Some systems use domain-wide blocks while others use page-specific blocks. Also, I have seen a lag between de-listing at these sites and end user updates. In some AV products, the malware signatures may be local. If the user has not updated their AV in some time, your ...


2

You must fully audit/cleanse any PC that has had the FTP password stored on it. Remove the password from your FTP clients and change from another PC. Be very wary of storing the FTP password in your clients - especially if you are not 100% sure the malware has been removed from the infected PC. This one seems to spread through a few different means, but ...


2

Speak direct to the shared hosting company - it's not impossible there is an issue on that server and other customers are experiencing the same (similar) issues.You already updated your password information which makes no difference. How long it takes from uploading a file to when it becomes 'hijacked'?


2

I've just taken a look at your site and the page seems to be rending my end without any obvious problems and naughty malwares. I've checked your source which looks clean, but you might be experiencing a HTACCESS injection which redirects people or least trys too. Take a look in the htaccess file. Furthermore... In your robots.txt you have User-agent: * ...


2

I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this: $ curl -D - http://ps3theme.net/ -s HTTP/1.0 200 OK Expires: Sat, 6 May 1995 12:00:00 GMT P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM Cache-Control: ...


2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...


2

Are you running any Ad campaigns on your website? I have had similar experiences when I used non-adsense advertising platforms. Remove any advertisement code that you are using and it should disappear.


2

Here is Firefox's page about attack sites and malware. Malware is software designed to infect your computer without your knowledge. Malware is most often used to steal personal information, send junk e-mail (spam), or spread more malware. Attack Sites are Web sites that try to infect your computer with malware when you visit. These attacks can be ...


1

The problem got solved. After doing some research, I found out that Apache itself can be used to deliver malware. Some more info on that http://www.symantec.com/connect/blogs/extending-apache-serve-malware-0 and http://www.stopthehacker.com/2011/05/23/apache-used-to-inject-malware/ Lot's of more info if you google it. Thanks for your comments.


1

Google launched a very comprehensive guide to malware on websites. It includes: What is malware? How do I know if my site's been infected? If your site is infected: How to clean up a hacked site. Preventing malware infection: Best practices for avoiding infection in the future Requesting a malware review: Once you're sure that all spam and malicious code ...


1

Just be aware that not all base64 encoded strings are malware. So you should always decode it to make sure you're not removing a real function in your script. You should download all the files and use Total Commander to search them on windows or on linux use grep


1

Ok, there is no easy way to "scan" via an FTP especially as you don't know exactly what you're looking for. You could download your entire site contents, then do a normal search in the files for things like base64 and eval which will often be obscured in some way. Sadly you have no definite way of telling wether you've got everything or not, hell, there ...



Only top voted, non community-wiki answers of a minimum length are eligible