Google Malware Message

[aaseo123]

*Update 9/19/2013

So I finally have more details the site is a joomla site and is hosted on godaddy. The weird thing is the malware message only appears when browsing the site in chrome it comes up fine in internet explorer any specific reason why that would be? Also we noticed that on the joomla template there were about 6 scripts after the tag that were adult site related and have nothing to do with our site, any ideas? I appreciate all/any suggestions and or advice. Thank You.

I had a client recently pay about $300 for a site design that she hosted on go daddy. This is the site www.shirianfabric.com can anyone tell me why this would happen its only been live for about three months and out of no where we get this message? My client is thinking maybe the designer inserted some kind of malicious code?as he is now charging a couple hundred to fix the issue. Is there any way to look further into this? Im not sure a webmasters account was ever set up for this site so any advice would be greatly appreciated. Thanks.

[SoleGraphics]

Set up WBT and Bing web tools. This will tell you whats happening from the malware side of things.

[Kara.Wallace]

Here is a step-by-step of what you could try doing from Cypress North: Hacked? Here's How to Remove the Dreaded Google Malware Warning.

Google also says, "If you're the administrator of a site we've identified with this warning message, learn how webmasters can fix this issue. Note that in some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

Good luck.

Mike

[stever999]

The dangers of shared servers! If someone else's website on the server has vulnerable script on their site hackers can inject code on other sites on the same server... Remove the malicious code and talk to GoDaddy, hopefully they've picked it up and removed the offending site?

Of course, it could be that GoDaddy don't have the latest security patches installed on their servers and they are the cause!?!

[Ron_McCabe]

My web development company (Everbearing Services) moved all of our clients off of Godaddy several years ago because of performance and security issues.  There are several other good web hosts out there.  The one that I feel is a true gem is one called Zippykid which only hosts word press web sites. They also provide security and malware scanning automatically.  They also do all the patches and updates you might need.

They use Rackspace as their back end infrastructure.   If your web site is not on Wordpress you might consider these guys.  I have read in other posts that a provider Firehost is really good.

I have not seen any good reports on Godaddy lately.

That is my two cents if this helps. If you do not get your questions answered here and need any further help on this feel free to call me tomorrow or Monday.

Ron

[Jonathan1979]

I checked the site, and saw something a bit odd.  This link kinda explains the problem, as you have the same code they have identified as a problem.

http://www.oxwall.org/forum/topic/11304

I would recommend in the first instance your client speak to their host.  I am not overly sure how good Godaddy is, but I haven't heard good things.  The common fix for this is reverting for a backup prior to this event happening.

In addition, once fixed install http://wordpress.org/plugins/better-wp-security/

If you do not have a backup, then try reinstalling wordpress files (keep the database).  Delete all plugins, and reinstall from fresh.  But for the love of god... take a backup first.

If you need a recommendation for a host try Siteground for specialist Wordpress hosting, or Hostnine for something cheaper, but very good.  We use both, but mainly Hostnine for client sites.

[aaseo123]

Thank you very much for the links you provided. After doing some research I found some shady scripts on the website templates after removing the scripts everything seemed to work fine. We have changed the login info because unfortunately it looks as if the designer himself inserted the malicious code. Again thanks for the links and the info they got me on the right track.

Below is the malicious script for anyone having similar issues

[aaseo123]

Thank You! The site in question had the same malicious scripts detailed here. After finding them and removing them the site is up and running as it should thanks again for the advice.