The Website Ahead Contains Malware! - How to deal with this ?

[WayneRooney]

Hello,

I got in webmaster tools :

The Website Ahead Contains Malware!

When i go to the website i cant see the site and im getting a page that saying the same thing, a Malware! problem.
I search in Google information's about this and its look like someone hack to our website and install something in the code.

Is any one have experience with this ?
How can i fix this ? its a very big website....

Need help !!!!

Thank you

[customerparadigm.com]

Edmond -

I've had this happen in the past, and it can take a while to resolve.

First, go through the site and find out where all of the malware has been uploaded.  It's possible it's in new files, or added to existing files.  It could also be located in the database as well, if it's a database-driven site.  I'd recommend going through EVERY file tree via FTP and look for odd files.  Don't just rely on timestamps, though, as some malware can be uploaded without leaving a "recent" timestamp.

If you haven't changed anything recently, you may be able to just restore the site from an older backup.  That said, sometimes the malware has been sitting on the server, and it hasn't been discovered until recently.

Your hosting company may be able to help.

Once the site is cleaned up, use a third party scanner to make sure it's clean.  I've used this one in the past: http://sitecheck.sucuri.net/scanner/

Then, through Google Webmaster tools, request a new scan.  This can take several long, long days.

While the site is down / inaccessible, consider posting to social media accounts like Facebook, Twitter, LinkedIn, Google +, etc to let people know that you are working on the issue and it should be resolved quickly.

And then wait... until the restriction is lifted...

[FedeEinhorn]

Hi Edmond,

First, I'd suggest you to re-upload all your files.

Then you can do some damage assessment and find out where is the hack and how they went through.

Let's start with that, re-upaload.

If your site uses a CMS, you should update the CMS right away, if it is wordpress, I'd also suggest to use a service like CloudFlare with a PRO account and make use of the WAF (web application firewall) to help prevent another infection while you are still fixing things. WAF offers dozens of fixes to wordpress loopholes that an attacker may use to gain access.

If your site doesn't use a CMS, you need to find out how they accessed your site, usual causes are mysql injection or a brute force attack to get FTP/DB access.

A Plus - Google Webmaster Help on Hacked sites:

watch?v=mbJvL61DOZg

[WayneRooney]

I notice that : http://sitecheck.sucuri.net/scanner/ have a service that  can clean the site.

Did you use it ?

[customerparadigm.com]

Edmond - No, I didn't use their service, as it was quite expensive and I figured I'd be able to fix it myself in 2-3 hours of cleaning (which I was able to do).  Let us know how the process goes...

-- Jeff

[FedeEinhorn]

There's another service, provided by McAfee that scans your site for possible vulnerabilities and even provides with a bath ONLY if your site is proven to be safe and you fix any issue they can find. Can't remember the price though, but I used it in the past and they scan the entire site daily, totally recommended.

http://www.mcafee.com/us/mcafeesecure/

[maestrosonrisas]

Something like that happened to me and, i installed the OSE Firewall http://wordpress.org/plugins/ose-firewall/

It worked better than Sucuri wich is payed, although in Sucuri they give help to you.

Also try to speak with your server, they can help you find strange files and do a check up on server and database.