| Why is Google Labelling this website harmful?
"This site may harm your computer." |
asas111
msg:4172728 | 1:13 pm on Jul 19, 2010 (gmt 0) |
This is a website that a friend of mine works on: url deleted for safety concerns and in the last few weeks, Google is labelling it as being harmful with this warning:
This site may harm your computer
It is a small site with no much on it, and I am trying to help my friend find out why they would think the website is not safe? I don't have access to their FTP to know what files they have, but I do know they have some .JS files.
What else could give this warning?
thanks a lot [edited by: ergophobe at 5:06 pm (utc) on Jul 19, 2010]
[edit reason] potential malware issue [/edit]
|
londrum
msg:4172777 | 1:52 pm on Jul 19, 2010 (gmt 0) |
maybe its something that's affecting your whole server, rather than just your friends site. is he on shared hosting?
|
topr8
msg:4172789 | 2:09 pm on Jul 19, 2010 (gmt 0) |
one question:
does the website use any kind of form input, querystings or connect to a database without sanatizing the data first?
if the answer is yes then most likely your site has been compromised, if the answer is no then it is the whole shared host machine i expect.
it is easy to find out what the problem is, go to the website (turn javascript off in your browser and active x if using internet explorer) and view the source of the page, see if there is anything suspicious there - especially javascript calling other scripts from remote servers. ... please note this is dangerous and could compromise your own machine
|
jimbeetle
msg:4172831 | 2:58 pm on Jul 19, 2010 (gmt 0) |
There's a heck of a lot of this going around.
Have your friend contact the host and have them check the site and clean it if necessary.
Might not necessarily be the case here, but many attacks the past year or so have come from keyloggers on local machines, especially the iframe injections. Have your friend do a deep anti-virus scrub and also a deep cleaning with something like malwarebytes.
|
ergophobe
msg:4172913 | 5:15 pm on Jul 19, 2010 (gmt 0) |
If you look at a page that Google says is infected, does it have
- iframes
- any unexpected javascript
- src = attributes that reference anything outside your site
- hidden links to malware sites
|
|
|
