With a Google Malware warning — My battle
The past 15 hours haven’t been fun for me.
It all started around 8 pm last night when I started getting emails like this:
“Hey, when I try to visit Reglike I get a warning that your site is infected with malware.”
If you tried to access the site last night via Chrome or Firefox, you probably saw such a message. You also saw a warning in Google search results.
The timing was pretty bad. Super Bowl Sunday is usually a high traffic day on Reglike thanks to people looking for Go Daddy’s commercials.
I’m writing this post to not only inform you of what I did to fix the “problem”, but also in case anyone has specific advice, as I haven’t been able to fully solve how the site was flagged…
As soon as I became aware of the problem I went to Google Webmaster Tools and found a warning regarding malware. Google identified 27 URLs on DNW that were suspicious.
Unfortunately, Google told me nothing else regarding it. It didn’t say what made them suspicious, what type of vulnerability was found etc.
I was in the dark.
But I’ve dealt with malware ahead of. Regarding five years ago an FTP password on one of my domains was compromised and some hackers inserted a redirect.
I sifted through the pages Google identified this time hoping to find something obvious. But there was nothing. I looked at every URL on the pages, every script…nothing looked out of the ordinary.
I went to a couple site scanners and tried them. They all showed up clean.
Exasperated, I went ahead and asked Google to rescan the site.
I went to bed, but all night I had the same feeling I’ve had whenever my (previous) web host went down: when will I be back up?
Fortunately, but 6 am my time Google was no longer warning regarding the site.
But I recalled that I had paid Verisign (now Symantec) $300 a year for a Trust Seal (now Site Safe). Included is a daily malware scan.
I went to Symantec’s site to see if it had flagged me for malware.
Actually finding out if it had flagged me was a nightmare. I had purchased the site seal through Moniker, which meant Symantec wouldn’t let me access an online account. “Sorry, you have to contact the reseller”.
But it turns out Symantec sent a warning to me around 1 am today. (Ironically, all of the emails from Symantec land in my spam folder). With a bunch of clicking and form filling, I was finally able to see what was identified as malware on my site.
Apparently two scripts were flagged, counting this one:
wp-includes/js/jquery/jquery.js?ver=1.8.3
Hmm. This is included by default in all instances of WordPress 3.5. Why was it being flagged?
Symantec’s support person wasn’t very helpful. He stated the file was similar to ones that have been problematic.
“But this is in every copy of WordPress 3.5!”
He didn’t seem bothered by that. I asked if it was something added to the file or the file name itself that was a problem. He didn’t know.
Following calling back later and talking to another Symantec rep, the firm forwarded my question to its malware team for investigation.
It’s at this point that I’ll note that, despite the devastating effect a malware warning has on a web site, it doesn’t seem like an urgent matter to many of the firms that operate in this space.
Perhaps a big malware warning issue happening today with some of the biggest web sites (thanks Mike) will change that. The Netseer issue is unrelated to my problem. (I do want to thank @stopbadware for assistance on Twitter today.)
So here I am, regarding 15 hours later. I still don’t know if I had a false positive or there’s some sort of problem that will creep back up. Following all, Google’s second scan of my site found no problems. Interestingly, Google has even removed any record of the malware problem — counting messages/alerts — from Webmaster Tools. Previous messages regarding Googlebot access problems are still listed.
Update: Symantec just rescanned my site and now states there are no problems, despite the site still having the same exact files it had yesterday.
DNW.com (the shortcut) will still give you a warning, but that ought to be fixed later today.
If anyone out there has additional help, I’d appreciate it.
