'*' Help - Malware Notification regarding from Google?

5 replies
Hey guys,

Not sure if any of you have received this message before, but this is my first.

--------------------------

Dear site owner or webmaster of syncdating.com,


We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com.
Below is an example URL on your site which can cause users to be infected (space inserted to prevent accidental clicking in case your mail client auto-links URLs):


http://syncdating .com/northen-cargo/


Here is a link to a sample warning page:
Malware Warning


We strongly encourage you to investigate this immediately to protect your visitors. Although some sites intentionally distribute malicious software, in many cases the webmaster is unaware because:


1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content
3) the site displays content from an ad network that has a malicious advertiser

If your site was compromised, it's important to not only remove the malicious (and usually hidden) content from your pages, but to also identify and fix the vulnerability. We suggest contacting your hosting provider if you are unsure of how to proceed. StopBadware also has a resource page for securing compromised sites:

StopBadware - Tips for Cleaning & Securing Your Website


Once you've secured your site, you can request that the warning be removed by visiting
About malware and hacked sites - Webmaster Tools Help
and requesting a review. If your site is no longer harmful to users, we will remove the warning.


Sincerely,

Google Search Quality Team
Note: if you have an account in Google's Webmaster Tools, you can verify the authenticity of this message by logging into https://www.google.com/webmasters/tools/siteoverview and going to the Message Center, where a warning will appear shortly.




--------------------------------------






My question is, how can I identify the malicious code? does anyone here have experience in regards to cleaning this up?

Thanks in advance!

Respect,

Andrew
#google #malware #notification
  • Profile picture of the author rednimer
    I have never received an email, but I have gotten the message when trying to view my site on firefox.

    To find the problem, I ftp'd to my site and looked for files that were recently modified.

    Then I went into those and looked at the top of the file. Most of them had some funky looking encoded javascript at, or toward the top of the page.

    If I remember right it looked like encode (DFKJD:FKLLKJLDKJSLKDJ6+:LKJF:.........

    It was like 1 long line, and I just deleted that, then added my site to google webmaster tools, and letting google know it was fixed.
    {{ DiscussionBoard.errors[3148088].message }}
  • Profile picture of the author Fraggler
    Andrew,

    I just went through the same issue. You will find that some javascript has been inserted into all of your index.php, index.html, main.php, and some *.js files.

    If that is the case then it is caused by the Gumblar virus.

    You will either need to overwrite all of these files with a clean backup or you have to download them all and remove them using search and replace with a program like Notepad+.

    Change your FTP passwords immediately as the virus uses these to access your sites.

    Once all the files are clean, reupload and get google to rescan the site. This is done through Webmaster Tools. It doesn't take too long for the warning to be removed after the site is found clean.
    {{ DiscussionBoard.errors[3148093].message }}
  • Profile picture of the author CyberSorcerer
    I just check the domain you listed above and it looks like you have a quite a few questionable porn links.

    I have special software that checks the site so I didn't get infected. Being a security research this is the kind of stuff I do.
    {{ DiscussionBoard.errors[3148100].message }}
  • Profile picture of the author ray777
    I got a notice like that couple years ago. It was real my website was infected with a iframe virus of some sort. It was a pain to get rid of. It was in a lot of my files and I did not have a backup.
    {{ DiscussionBoard.errors[3148252].message }}

Trending Topics