Google hosting malware??

4 replies
Hi Guys,

Checked this out:

http://www.google.com/safebrowsing/diagnostic?site=google.com

That's google's Safe Browsing Diagnostic page.

It says:

"....Of the 40622 pages we tested on the site over the past 90 days, 23 page(s) resulted in malicious software being downloaded and installed without user consent.

The last time Google visited this site was on 2010-10-18, and the last time suspicious content was found on this site was on 2010-10-15.

Malicious software includes 94 exploit(s), 11 trojan(s), 4 scripting exploit(s)........ "


Strange?

The reason I brought this up is because one of my client's account got 'blacklisted' because of the same 'malware' warning.

But I've double,triple checked her site/files - they are clean. She even engaged a professional security consultant who did not find anything. The senior sys. admin also checked - and it's also clean.

My client would then request a 'review' from Google to verify the site is clean - then it was removed from the malware warning blacklist .... BUT, a few days later, the same thing warning came up.

And the same cycle goes over and over again - file checks, request review, removed from blacklist, etc.

Does anyone have any idea what is going on?

Or how to solve this?

Any tips/suggestions is much appreciated!

Thank you.

Adrian
#google #hosting #malware
  • Profile picture of the author seasoned
    There are a number of trojans and one thing they do is affect things like googles links. They do this to:

    1. Track you
    2. Install malicious software
    3. Possibly get passwords
    4. AND/OR direct you to bogus sites or secondary searches to get affiliate payments.

    I have had TWO computers affected by that garbage, and a friend of mine ALSO had that same problem. On one system I was infected, cleaned it up, and found out about the secondary infection ONLY because some sites triggered a firewall warning on the SAME site. BTW THIS one was a LOT of trouble, and recent, so I remember that ONE malicious site was pixelstats .com

    Steve
    {{ DiscussionBoard.errors[2740719].message }}
  • Profile picture of the author easybiztools
    Hi Steve,

    I'm referring to a website (on a linux host) - not a PC.

    But even if a PC is infected, how does that affect the site? Unless a hacker has uploaded some malware to the site? There are no binary executables or iframes - only html and some harmless javascript.

    btw, she did thoroughly checked her PC as well - scans by Avast, McAffee, SpyReveal, Adaware, Malwarebytes, and Spybot - nothing found.

    I've also tarball the entire website, download to my PC and run a full scan on all the files - nothing found as well.

    Thanks.
    Adrian
    {{ DiscussionBoard.errors[2740759].message }}
    • Profile picture of the author seasoned
      Originally Posted by easybiztools View Post

      Hi Steve,

      I'm referring to a website (on a linux host) - not a PC.

      But even if a PC is infected, how does that affect the site? Unless a hacker has uploaded some malware to the site? There are no binary executables or iframes - only html and some harmless javascript.

      btw, she did thoroughly checked her PC as well - scans by Avast, McAffee, SpyReveal, Adaware, Malwarebytes, and Spybot - nothing found.

      I've also tarball the entire website, download to my PC and run a full scan on all the files - nothing found as well.

      Thanks.
      Adrian
      The INFECTED CLIENT has a virus that intercepts browser or IP access and modifies it before you see it. With my friend, it setup a PROXY! IE looked like it was setup to go through a NORMAL proxy, but it really just caused this garbage. On MY computer, it actually hijacked the plugins interface! BTW I doubt google is using windows for its search engine. THEY appeared infected ALSO! They WEREN'T though. It was just an illusion created by the virus. Well, I had THREE virus/protection programs on my system and was STILL affected! My friend had NORTON. BTW HIS name is ROSS!

      BTW WHY would a virus on a client need JAVASCRIPT to change things on that client? I am talking about a VERY easy substitution. The ONLY hard parts are hiding it, and intercepting the vectors. Ross' system used a PROXY for THAT! So the client goes to google, THROUGH THE PROXY, and the PROXY returns the google page with some links CHANGED! It is as simple as that. NO javascript, NO need for dynamic pages.

      Steve
      {{ DiscussionBoard.errors[2741999].message }}
  • Profile picture of the author neoman
    its not malware
    its a diagnostic tool

    google would never host malware its impossible
    {{ DiscussionBoard.errors[2742006].message }}

Trending Topics