Website may harm your computer

portanure

Hi Guys

I hope someone can help, we have a website and if anyone goes to our site they get a message, accessing this site may harm your computer and something about malware. Anyone any ideas how to sort this out as we never had this problem until this week

thanks a million

regards

aidan_walsh

Sounds like your site got tagged by Google or the StopBadware campaign as being potentially harmful. You can see if it is linked here, and request a review by Google or by StopBadware.

oeb

aidan_walsh wrote: »

Sounds like your site got tagged by Google or the StopBadware campaign as being potentially harmful. You can see if it is linked here, and request a review by Google or by StopBadware.

It's more likely that he got caught by that virus that was running around recently (Cant remember what it was called, it was delivered through flash or acrobat IIRC). Basicially, what it does is steals your FTP passwords, and then connects and adds a few lines of PHP to the top of all your pages.

This PHP includes a remote JS file. Most of the sites that host these remote files ARE blacklisted by google, and as a result of you including a file from the site, google gives the warning for your site. To resolve this, remove the virus from your machine, change your FTP passwords, and manually sanatize the code (It is pretty clear from looking at the source what the infected lines are, it will be up the top.

tricky D

Sounds like Gumblar

These pages might help.

http://wheelersoftware.com/articles/sql-injection-kisswow.html

or less likely

http://blog.unmaskparasites.com/2009/04/15/malicious-income-iframes-from-cn-domains/

(Includes cleanup instructions)

Could be js, php or cgi being called.


Also worth reading

http://www.webologist.co.uk/2009/05/gumblar-virus-threat-to-the-internet-how-to-remove.html

gl