Hot answers tagged

73

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...


31

Source Recently started to delete downloads claiming 'virus or spyware'. "Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window." ... Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. ...


18

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.


11

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? <script type='text/javascript' ...


7

...compressed the app's EXE with UPX compressor... Back in the day (~10 years ago) UPX was commonly used by viruses to make them more difficult to reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue. You really only have two options: Use ...


5

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not ...


4

Figured it out. "Fetch as Googlebot" was reporting the site just fine too. I then used someone's tool to spoof crawler as Google and saw it happening. The portal plugin for phpBB had some base64 code inserted due to bad permissions (7xx) and I fixed it all. I'll probably wipe this server out though.


3

Once you've cleaned up the pages submit a reconsideration request to bing, for the pages that no longer exist I'd return a 410 (gone) status message so the search engines no longer look for them.


3

IMO, if you have to ask, then you need to find a webmaster/web developer with some security expertise to handle the situation. There are millions of ways a site could be compromised and infected with malware. There isn't a magical program you can just run on your server to remove the malware infection. So without knowing how the system was built, how it was ...


3

It's more than likely your WordPress install has been compromised. The permanent fix is to follow these steps to ensure it is fully cleaned and to prevent a recurrence. This is the best method to ensure it is 100% clean. Backup the database Make a note of the customizations, such as plugins or any other modifications you’ve made. Remove all files from the ...


3

The site, with the warning, seems to stay in the google rankings. However, if someone clicks on that listing, they would be taken to a google warning page telling them to go no further. To get to the site you actually have to copy and past the address into your browser's location bar. This would seriously reduce the amount of traffic you get from google.


3

The message I get in chrome says: melfordschoolofmotoring.co.uk contains content from 31.184.242.103, a site known to distribute malware. Your computer might catch a virus if you visit this site. If you look at your website's headers using livehttp headers (see note below about how I found this code) you'll see a request for ...


3

Check HackAlert SafeImpression from Armorize Malware. I've never used it, but if I understood well your problem, this may be worth a look.


3

There are two steps you need to take. First, you have to secure your website. Then you have to go into damage control and try to restore your website's ranking in the search engines. To secure your website you need to start by changing ALL passwords - particularly ftp but also change anything that requires a password in order to access. Then you should run ...


3

I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this: $ curl -D - http://ps3theme.net/ -s HTTP/1.0 200 OK Expires: Sat, 6 May 1995 12:00:00 GMT P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM Cache-Control: ...


3

You may not be hosting malware now but you have relatively recently: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=goodtherapy.org The script could be randomly injected or perhaps your ISP is cleaning things for you in the background. In any event, your site has been and probably still is compromised and you should be doing a ...


3

If that is their policy as spelled out in their hosting agreement, then you probably have little legal recourse. In the future, I would recommend creating regular backups of your websites. This isn't the only way to lose your data. There could be hardware failures. Hosts can go out of business. As the policy is draconian and not customer friendly, I ...


3

Okay. Where to begin. When you set up a Webmaster Tools account, essentially a new entry is made into a database and various bits of data needs to be collected such as site performance, and so on that simply will take time to populate. When you just create the account, that database is essentially empty. As most of us know from experience, the Webmaster ...


3

I run a 20 year old software enthusiast website, and I also run into your issues. This is a site that had its heyday at around year 2000 and now functions as an archive. Around 3 times every year, Google Safe Browsing identifies a new piece of "malware", usually written and uploaded around 1999 to 2002. Never mind that its always been there. Never mind that ...


2

You should investigate as to which ads are being blocked. Then the question might turn into: "Adblock blocks a lot of resources that aren't ads".


2

I was able to fix this by verifying the website using the google search tool. Google Search Tool - Verification I then had to add the HTML verification file to my website and click the link on the Google Search to verify. After about 12 hours the issue had been resolved.


2

I am pretty sure it's not a problem of my PC, but rather the website itself This is a strange report, as it appears your website in not infected according to Google Safe Browsing (and other online tests for infected websites). Please read How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?. Google Safe Browsing is ...


2

Online anti-virus options are not complete. You will want to make sure you use a anti-virus on your hard-drive or in the case of a shared web host, it is possible that one site effects another. You would need to talk to your host for a complete check if that is the case. Please understand that there are viruses that will effect a site from outside of the ...


2

There's a high chance someone messed up your server configuration so that users from certain IP addresses are redirected to something other than what is expected. If your webpage serving software is apache, check all .htaccess files and httpd.conf (or other apache configuration files) to find any unusual entries. Look for some that reference IP addresses ...


2

Here is Firefox's page about attack sites and malware. Malware is software designed to infect your computer without your knowledge. Malware is most often used to steal personal information, send junk e-mail (spam), or spread more malware. Attack Sites are Web sites that try to infect your computer with malware when you visit. These attacks can be ...


2

I'm not aware of any specific identified malware that can be attributed to for this attack, however this kind of behaviour is not uncommon from malicious code inserted into third-party plugins for popular CMS's such as WordPress. People download and install these plugins for the advertised features they offer to sometimes later find that the plugins had been ...



Only top voted, non community-wiki answers of a minimum length are eligible