Hot answers tagged

76

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't ...


32

Source Recently started to delete downloads claiming 'virus or spyware'. "Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window." ... Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. Every ...


19

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.


12

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? <script type='text/javascript' src='http://www.andreszsogon.com/wp-content/themes/contango/lib/js/superfish/superfish-combine.min.js?ver=1.5.9'></script&...


9

...compressed the app's EXE with UPX compressor... ~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue. You really only have two options: Use VirusTotal ...


7

From the Sophos KB If you believe that the URL has been blocked on the basis of hosting malware, but you think this is a false positive, go to the reassessment request form: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx to submit a request to Sophos to reassess the site. Ensure that you complete all the fields. If you are not a Sophos ...


4

I run a 20 year old software enthusiast website, and I also run into your issues. This is a site that had its heyday at around year 2000 and now functions as an archive. Around 3 times every year, Google Safe Browsing identifies a new piece of "malware", usually written and uploaded around 1999 to 2002. Never mind that its always been there. Never mind that ...


4

Unfortunately there's not much you can do. You can't prevent these other (hacked) sites from linking to you. Besides, once Google has found these (now erroneous) URLs, it is likely to continue crawling them for sometime to come, even when the inbound link is (eventually) removed. You are already doing the correct thing, in returning a 404. A genuine 404 is ...


4

You do not say what the .sql file is for, however, a .sql file, in of itself, is just plain ol' text and therefore not a threat. Ignore it the notice. It is not uncommon that anti-virus software will hit on various files. They are looking for patterns. Known JavaScript files are often pinged as a virus. That said, if you do not know what the file is or if ...


4

As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working. As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways ...


4

Alright, I managed to solve it. I know that "one size fits all" is not the case with malware. I asked for extra thoughts as someone might have a hint how to approach it as I'm well informed and capable of dealing with these situations through the years. After numerous failed attempts to search various strings, trying to encode few words in hex and ...


3

If that is their policy as spelled out in their hosting agreement, then you probably have little legal recourse. In the future, I would recommend creating regular backups of your websites. This isn't the only way to lose your data. There could be hardware failures. Hosts can go out of business. As the policy is draconian and not customer friendly, I ...


3

Okay. Where to begin. When you set up a Webmaster Tools account, essentially a new entry is made into a database and various bits of data needs to be collected such as site performance, and so on that simply will take time to populate. When you just create the account, that database is essentially empty. As most of us know from experience, the Webmaster ...


3

You may not be hosting malware now but you have relatively recently: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=goodtherapy.org The script could be randomly injected or perhaps your ISP is cleaning things for you in the background. In any event, your site has been and probably still is compromised and you should be doing a ...


3

I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this: $ curl -D - http://ps3theme.net/ -s HTTP/1.0 200 OK Expires: Sat, 6 May 1995 12:00:00 GMT P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM Cache-Control: no-...


3

I was able to fix this by verifying the website using the google search tool. Google Search Tool - Verification I then had to add the HTML verification file to my website and click the link on the Google Search to verify. After about 12 hours the issue had been resolved.


3

We were hit by the same problem as the OP - our site blacklisted so that all Chrome users were getting a big scary red message about "The site ahead contains malware. Attackers currently on [site name] might attempt to install dangerous programmes on your computer that steal or delete your information (for example, photos, passwords, messages and credit ...


3

Ah, WordPress malware. This can take many forms. Here are some things you can do: Research the script. Chances are, others have encountered it, and have posted to message boards looking for solutions. You might be able to glimpse info like where this script lives and how to deal with it. Contact your web hosting provider. A reputable host will be able to ...


3

In some cases the trademark holder may be able to take down the domain by submitting a UDRP claiming that the domain has been registered intentionally to trap users: Register your trademark While there are no laws against registering available domain names, there are laws against phishing and other malicious online activities. As a trademark holder, you can,...


3

I think 404 does make sense in some ways. If an undesirable walks up to your house, sure you could shout at them to leave, but it might make more sense just to not answer the door. This has the added bonus of them not knowing whether you're actually not home or just not answering. A 404 is the equivalent of not answering the door. Plus it's semantically ...


2

Google launched a very comprehensive guide to malware on websites. It includes: What is malware? How do I know if my site's been infected? If your site is infected: How to clean up a hacked site. Preventing malware infection: Best practices for avoiding infection in the future Requesting a malware review: Once you're sure that all spam and malicious code ...


2

Are you running any Ad campaigns on your website? I have had similar experiences when I used non-adsense advertising platforms. Remove any advertisement code that you are using and it should disappear.


2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, ...


2

Here is Firefox's page about attack sites and malware. Malware is software designed to infect your computer without your knowledge. Malware is most often used to steal personal information, send junk e-mail (spam), or spread more malware. Attack Sites are Web sites that try to infect your computer with malware when you visit. These attacks can be ...


2

I'm not aware of any specific identified malware that can be attributed to for this attack, however this kind of behaviour is not uncommon from malicious code inserted into third-party plugins for popular CMS's such as WordPress. People download and install these plugins for the advertised features they offer to sometimes later find that the plugins had been ...


2

You should investigate as to which ads are being blocked. Then the question might turn into: "Adblock blocks a lot of resources that aren't ads".


2

Problem explained:- This hack is getting very common these days. This is surely a glitch on part of Google which is being implemented with the help of hacked websites. Duplicate websites which are being shown in Google are hacked websites. They are being used as an intermediary to redirect traffic on other websites(or amazon affiliate links in the same ...


Only top voted, non community-wiki answers of a minimum length are eligible