Hot answers tagged

76

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...


32

Source Recently started to delete downloads claiming 'virus or spyware'. "Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window." ... Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. Every ...


19

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.


12

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? <script type='text/javascript' src='http://www.andreszsogon.com/wp-content/themes/contango/lib/js/superfish/superfish-combine.min.js?ver=1.5.9'></script&...


8

...compressed the app's EXE with UPX compressor... ~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue. You really only have two options: Use VirusTotal ...


7

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not a Sophos ...


4

I run a 20 year old software enthusiast website, and I also run into your issues. This is a site that had its heyday at around year 2000 and now functions as an archive. Around 3 times every year, Google Safe Browsing identifies a new piece of "malware", usually written and uploaded around 1999 to 2002. Never mind that its always been there. Never mind that ...


4

Unfortunately there's not much you can do. You can't prevent these other (hacked) sites from linking to you. Besides, once Google has found these (now erroneous) URLs, it is likely to continue crawling them for sometime to come, even when the inbound link is (eventually) removed. You are already doing the correct thing, in returning a 404. A genuine 404 is ...


4

You do not say what the .sql file is for, however, a .sql file, in of itself, is just plain ol' text and therefore not a threat. Ignore it the notice. It is not uncommon that anti-virus software will hit on various files. They are looking for patterns. Known JavaScript files are often pinged as a virus. That said, if you do not know what the file is or if ...


4

As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working. As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways ...


3

You may not be hosting malware now but you have relatively recently: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=goodtherapy.org The script could be randomly injected or perhaps your ISP is cleaning things for you in the background. In any event, your site has been and probably still is compromised and you should be doing a ...


3

I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this: $ curl -D - http://ps3theme.net/ -s HTTP/1.0 200 OK Expires: Sat, 6 May 1995 12:00:00 GMT P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM Cache-Control: no-...


3

There are two steps you need to take. First, you have to secure your website. Then you have to go into damage control and try to restore your website's ranking in the search engines. To secure your website you need to start by changing ALL passwords - particularly ftp but also change anything that requires a password in order to access. Then you should run ...


3

Okay. Where to begin. When you set up a Webmaster Tools account, essentially a new entry is made into a database and various bits of data needs to be collected such as site performance, and so on that simply will take time to populate. When you just create the account, that database is essentially empty. As most of us know from experience, the Webmaster ...


3

If that is their policy as spelled out in their hosting agreement, then you probably have little legal recourse. In the future, I would recommend creating regular backups of your websites. This isn't the only way to lose your data. There could be hardware failures. Hosts can go out of business. As the policy is draconian and not customer friendly, I ...


3

I was able to fix this by verifying the website using the google search tool. Google Search Tool - Verification I then had to add the HTML verification file to my website and click the link on the Google Search to verify. After about 12 hours the issue had been resolved.


3

We were hit by the same problem as the OP - our site blacklisted so that all Chrome users were getting a big scary red message about "The site ahead contains malware. Attackers currently on [site name] might attempt to install dangerous programmes on your computer that steal or delete your information (for example, photos, passwords, messages and credit ...


3

Ah, WordPress malware. This can take many forms. Here are some things you can do: Research the script. Chances are, others have encountered it, and have posted to message boards looking for solutions. You might be able to glimpse info like where this script lives and how to deal with it. Contact your web hosting provider. A reputable host will be able to ...


3

In some cases the trademark holder may be able to take down the domain by submitting a UDRP claiming that the domain has been registered intentionally to trap users: Register your trademark While there are no laws against registering available domain names, there are laws against phishing and other malicious online activities. As a trademark holder, you can,...


3

I think 404 does make sense in some ways. If an undesirable walks up to your house, sure you could shout at them to leave, but it might make more sense just to not answer the door. This has the added bonus of them not knowing whether you're actually not home or just not answering. A 404 is the equivalent of not answering the door. Plus it's semantically ...


2

Google launched a very comprehensive guide to malware on websites. It includes: What is malware? How do I know if my site's been infected? If your site is infected: How to clean up a hacked site. Preventing malware infection: Best practices for avoiding infection in the future Requesting a malware review: Once you're sure that all spam and malicious code ...


2

End-user malware systems often use their own databases to identify issues on sites. Some systems use domain-wide blocks while others use page-specific blocks. Also, I have seen a lag between de-listing at these sites and end user updates. In some AV products, the malware signatures may be local. If the user has not updated their AV in some time, your ...


2

You must fully audit/cleanse any PC that has had the FTP password stored on it. Remove the password from your FTP clients and change from another PC. Be very wary of storing the FTP password in your clients - especially if you are not 100% sure the malware has been removed from the infected PC. This one seems to spread through a few different means, but ...


2

Speak direct to the shared hosting company - it's not impossible there is an issue on that server and other customers are experiencing the same (similar) issues.You already updated your password information which makes no difference. How long it takes from uploading a file to when it becomes 'hijacked'?


2

I've just taken a look at your site and the page seems to be rending my end without any obvious problems and naughty malwares. I've checked your source which looks clean, but you might be experiencing a HTACCESS injection which redirects people or least trys too. Take a look in the htaccess file. Furthermore... In your robots.txt you have User-agent: * ...


2

Mark your website as temporarily down. Rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't lose too much data. Upgrade to the latest WP (again). Upgrade any plugins, and remove unnecessary plugins. Go online again.


2

Are you running any Ad campaigns on your website? I have had similar experiences when I used non-adsense advertising platforms. Remove any advertisement code that you are using and it should disappear.


2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...


Only top voted, non community-wiki answers of a minimum length are eligible