Google Email - Malware notification

Discussion in 'Security' started by all.host, Jan 27, 2010.

  1. #1
    I have a website and I recently received from google an email saying :
    "We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com." Plus the site got a weird look and some links were missing.

    I deleted the website and reupload it and now it seems ok.

    My question is how this happen and how to I prevent from happing again.

    Your help is appreciated.
     
    all.host, Jan 27, 2010 IP
  2. FavouritesBlog

    FavouritesBlog Peon

    Messages:
    846
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #2
    is your site running PHP?

    Google is telling you that your site was infected, possibly by a worm or via vulnerability with some php software you are using or an attacker cracked or gained your FTP passwords and has uploaded malicious code to your public web files.

    Ensure you have all updated scripts and ensure your directory permissions are correct. Also make sure that you have secure passwords.
     
    FavouritesBlog, Jan 28, 2010 IP
  3. ddmd

    ddmd Peon

    Messages:
    60
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    It means you got blacklisted by Google (so anyone visiting it through Firefox and other browsers) will see a warning before visiting it. Where are you hosting your site?
     
    ddmd, Feb 6, 2010 IP
  4. WeWatch

    WeWatch Active Member

    Messages:
    75
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    50
    #4
    This is usually the result of a virus on a PC that has FTP access to your site.

    The virus looks for the plain text file that stores the FTP credentials for such programs as FileZilla and CuteFTP and a few others. It finds the file, steals the credentials, sends them to a server which then infects the website(s).

    The virus is good at evading detection from the currently installed anti-virus program so you may have to use something different.

    Many have had good success with one of the following: Avast, F-Prot or Kasperksy. If you're already using one of these, then select a different one. It has to be different.

    Then change all FTP passwords and use a different FTP program. I use WS_FTP because they encrypt their passwords.

    Then login to Google's Webmaster Tools and you may have to verify your site. Then you can request a review. In the Google Webmaster Tools you'll see a dark banner across the top. Click on it and you'll be able to request a review - not a reconsideration.

    Then wait about 24 hours.

    Post back here if you have any further questions.
     
    WeWatch, Feb 18, 2010 IP
  5. allinone1

    allinone1 Peon

    Messages:
    25
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    I had a similar problem with my website. If I use the FileManager uploader from the hosting provider is it safer than a FTP?
     
    allinone1, Mar 2, 2010 IP
  6. WeWatch

    WeWatch Active Member

    Messages:
    75
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    50
    #6
    Not really.

    The virus that steals the FTP login credentials also acts as a keylogger which will record your login and password when you login to use FileManager.

    The only way is to keep viruses off your PC.
     
    WeWatch, Mar 3, 2010 IP
  7. allinone1

    allinone1 Peon

    Messages:
    25
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Thank you for your reply. I guess the only way to stay safe is to use a strong Antivirus.
     
    allinone1, Mar 5, 2010 IP