Google says my site has a virus?

[venrooy]

Ok - I haven't run into this one before. One of the sites I advertise for has had it's ads temporarily suspended because Google says it has a virus. I thought - Ok it could be possible I guess. So I contact my service provider to see if maybe they'd scan for me. They think I'm crazy because my server is a non-windows machine.

So - I email google back to see how they recieved the virus alert. I get an email back with no explanation, just a screen shot of their virus alert from syantec. So I decide to purchase the same software used in the screenshot. I install it, update it, and go to my website - and Nothing.

So - I decide to download all of the contents of my site to my computer and try a scan of all of the files, and again nothing.

I'm not sure where else to go from here. If anyone has any hints or suggestions they would be greatly appreciated.

[superpower]

Are you serving any 3rd party ads or dynamic content (originating offsite) on your website?

[humblebeginnings]

Venrooy,

Don't know if this is something, but do you have by any chance the N*dstat counter on one of your pages? I am told they can cause related problems. Or (like Superpower asks) perhaps you are serving any other 3d party counter, ad, script, feed, whatever on your pages? Some of them cause infected pop-up stuff and the like...

[Wlauzon]

I have seen this before on sites that run ads - especially banner and popups. There are some ads and banners out there that attempt to load spyware...

[toddb]

Any java script from a third party? Remove that first and see if it works.

[venrooy]

I don't have any type of advertising on the site - so no popups or banners.

The Scripts I have on the pager are:

One javascript to swap images (put there by Frontpage)

One Marquee

and two flash movies I made in SwishMax.

I've gone over the script several times and don't see what could be causing such a warning.

I've actually checked the webpage from several locations that have updated virus software, and none of them give me a warning - So now I'm not sure what to do. I may have to write this site off and start it up with a new domain.

[DamonHD]

Hi,

Look your site's IP address up manually in some of the DNS BLs such as the Spamhaus XBL that record "compromised" machines to see if you've gotten in there somehow.

Rgds

Damon

[venrooy]

No - not in there - but good suggestion.

[kaz]

you say you have emailed them, but have you contacted them thru the request form via your account to reach them directly via your account. What email are you sending to? I would submit thru my account a contact request documenting briefly but fully what you have done so far.

[vibgyor79]

>>> just a screen shot of their virus alert from syantec

What does Norton actually say? Any virus name?

[venrooy]

The screen shot shows -

Threat: W32.Feebs

[pageoneresults]

[webmasterworld.com...]

Read the last couple of replies in the above thread. Run a DNS Report, see if you fail on the Open DNS Server issue. If you do, there is a small chance that you've been hijacked through Cache Poisioning.

[venrooy]

That is a fascinating thread - Mine seems to check out ok.

I am however going to try and switch the website over to one of my other hosts if this isn't resolved in a few days.