2

(Note: I have not linked to my site, but you can see the address below)

Visiting my site gives that typical

zeno.biyg.org contains malware. Your computer might catch a virus if you visit this site.

I have the webpage listed under my Google Webmaster account, and it says:

Unfortunately, Google has discovered harmful code on your site. Google users will see a warning page when they attempt to visit pages within this site.

Some of the URLs on this site redirect browsers to web pages that install malware. This indicates that the server(s) that host pages for this site may contain altered configuration files (such as Apache's .htaccess file).

Problematic URLs on http://zeno.biyg.org/   Last checked
/ - Details                                 1/2/12
/viewtopic.php?f=3&t=45 - Details           1/4/12

When Google last tested this page, no content was returned from your server. Instead, the browser was redirected to a malicious web page. It is likely that your server configuration has been modified.

I have checked both those pages and they come up just fine for me. Google is saying something is redirecting (thus my site doesn't actual contain the malware) visitors to another website (which contains the malware) and I can't reproduce that or find that redirect.

I've triple checked everything and cannot find what Google is saying. I've even requested a review, and Google came back saying something is still there.

Basically Google seems to say that visiting my site will redirect the user to another site that is not mine. I cannot find that happening anywhere on my site.

There's nothing wrong in the .htaccess file, the HTML source has nothing suspicious; I cannot reproduce this what Google is saying.

I have full access to this site/server. Any thoughts as to why Google is saying something is detected?

[EDIT] I ran the site under http://sitecheck.sucuri.net/scanner/ and something was detected (or it's just listing malware detected based on the Google blacklist). I personally spoke to someone from Sucuri and we could not find it either. I even listed every single .htaccess content and sent it to the Security Analyst there and everything was fine.

Improve this question
3
  • Looks like it may be a false positive.
    – John Conde ♦
    Jan 5, 2012 at 21:45
  • Indeed, pretty sure it is. But Google refuses to clear out the warning, I put in a review request and they came back saying it's still bad.
    – Zeno
    Jan 5, 2012 at 21:48
  • Sounds like the sucuri security analysts are pretty worthless if they didn't tell you to look at the actual PHP code rather than just the HTML output. It's pretty common for website malware to only display their payload to search engine spiders. This is probably the case for 90% of compromised websites so the owners remain ignorant about the problem.
    – Lèse majesté
    Jan 6, 2012 at 23:36

2 Answers 2

Reset to default
4

Figured it out. "Fetch as Googlebot" was reporting the site just fine too. I then used someone's tool to spoof crawler as Google and saw it happening.

The portal plugin for phpBB had some base64 code inserted due to bad permissions (7xx) and I fixed it all.

I'll probably wipe this server out though.

Improve this answer
2
  • Can you share which tool you used?
    – FatalError
    Dec 21, 2012 at 18:05
  • 1
    @FatalError sed command in Linux
    – Zeno
    Dec 22, 2012 at 17:25
1

I had this issue a couple of years before when I had the worst code to host my site. There was a javascript injection attack and I never knew this. But google promptly found it and reported it to me. Initially I tried cleaning up the pages manually but it kept on coming back. So for starters, I just disabled write permissions on all folders and removed write access to all my database tables.

Finally I moved my entire site to a proper content management system and all problems went away. So suggest you look at a professional CMS related and appropriate to your site.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.