Recently Google has been blocking my website after detecting Malware on it. I have checked through the files and can't spot any Malware that might have been inserted anywhere and no additional files have been added from what I can see. In the diagnostics> Malware section og googles webmaster tools for the site it says "Malware Google has not detected any malware on this site." Also on stopbadware.org the website is not on their clearing house.

So why is google detecting malware?

2 Answers 2


The message I get in chrome says:

melfordschoolofmotoring.co.uk contains content from, a site known to distribute malware. Your computer might catch a virus if you visit this site.

If you look at your website's headers using livehttp headers (see note below about how I found this code) you'll see a request for which is probably what is inserting the code below into the head of your page before the dtd:- var _0x8ab7=

It's stealthy because I couldn't see this code in chrome or an agent that looks at the page as if it's the googlebot, only in a private browsing session in firefox.

I would check your include files, htaccess files and root directory very carefully to look for signs of a hack. I would also check your file and directory permissions are 755 for directories and 644 for files.

Beyond that consider some security software like website defender and signing up for webmaster tools. Once you've found and cleaned up the infection submit a reconsideration request to google via the webmaster tools account.

I could just be the hack, but your site's performance is pretty bad, it may be worth considering a new host as page load speed is a factor for google and I can't see why some simple php includes would take so long to load. Keep an eye on performance once you've cleaned up.

  • thanks, and yes ive noticed the issue of page load time being poor.
    – crmepham
    Commented Mar 31, 2012 at 23:10
  • I re-checked all the files and can't find where the script has been inserted. I used "Deny from all" in the "inc" directory and set the permissions as you suggested. How would someone have been able to insert the code? Through the forms I have on the site? Or was it because of the file permissions not being set correctly?
    – crmepham
    Commented Apr 1, 2012 at 11:58
  • Ah found it. very well hidden in one of the inc files.
    – crmepham
    Commented Apr 1, 2012 at 13:31
  • @crm it's really hard to know how they got in without looking at the server logs, even then it could be anything from an un patched server vuln to an injection attack in one of the forms. I'm glad you've found it at least. Commented Apr 1, 2012 at 15:19

Is also connecting to the following host andhttp://

just delete the whole folder from your host, and upload fresh files, look in google to secure website using the htaccess file.

Change ftp password as well, something similar happened to my website a while ago, all my php files where infected with a malicious script. My hosting provider was massively attacked and the attackers created a script to infect many websites in this host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.