My sites are reported as Attack sites...?

[adrianh]

Any idea what I can do about this and how I can stop it from happening. It seems to happen on both OsCommerce and Joomla sites

[Greig Whitton]

Which browser are you using? I remember a while back I had a similar sort of problem with my website, but only when using Internet Explorer (it appeared fine in Chrome and Firefox).

What is the domain? I can take a look at it and see whether I can spot anything that might be the cause (the source of my problem was secure hosting with embedded content from a non-secure domain).

[adrianh]

This is the URL: www.hillcraft.co.za

[Greig Whitton]

Yeah, it's getting flagged as malicious in both Chrome and Firefox. I can only think of two possibilities: Google isn't happy with the domain re-directing to a Facebook page, or your site uses plugins that have been flagged as malicious.

[Dave A]

I got the redirect too, which makes this part of the stated problem confusing

It seems to happen on both OsCommerce and Joomla sites

[adrianh]

The site started giving problems a while back. I then put a redirect in so as to bypass the site. I took the redirect off earlier this evening. I suppose that the removal of the redirect will come into effect tomorrow or so.

I had a redirect initially to force the site to jump from www.hillcraft.co.za to www.hillcraft.co.za/cms and this eventually became problematic. I just tried to go to the /cms site and that is ok. It looks to me that the redirect itself is what triggers the issue. it could be that whatever is evaluating the site for malicious software doesn't like an immediate redirect. I can't say that I know to make the site start up in the /cms directory in the first place (maybe that would resolve the issue)

[Upstairs]

Contact your hosting company. They should provide support.

[lewskannen]

Yes, firstly contact your hosting company and ask them to check your server for any possible malware. You can, after you have done that, contact Google and ask them for a malware review - https://support.google.com/webmasters/answer/168328

They take around 1-2 days, but if they re-scanned your server and found no malware, they will remove the alert from Chrome.

[league_of_ordinary_men]

The site started giving problems a while back. I then put a redirect in so as to bypass the site. I took the redirect off earlier this evening. I suppose that the removal of the redirect will come into effect tomorrow or so.

I had a redirect initially to force the site to jump from www.hillcraft.co.za to www.hillcraft.co.za/cms and this eventually became problematic. I just tried to go to the /cms site and that is ok. It looks to me that the redirect itself is what triggers the issue. it could be that whatever is evaluating the site for malicious software doesn't like an immediate redirect. I can't say that I know to make the site start up in the /cms directory in the first place (maybe that would resolve the issue)

Hi adrianh, here is something you can read that might help. I haven't seen your site yet so I can't tell, but do you use any iframes or javascript that pulls info from other sites?

[Dave S]

I don't get it, the site blocks up using everyone of my browsers (Chrome, Firefox, Explorer, etc.) but when I click the "Why am i getting this message" button, the following appears. Correct me if I'm wrong, but I don't see anything wrong in this report, at least not within the last 90-days?

"Safe Browsing

Diagnostic page for hillcraft.co.za

What is the current listing status for hillcraft.co.za?

Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?

Of the 6 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2014-07-19, and suspicious content was never found on this site within the past 90 days.This site was hosted on 1 network(s) including AS36351 (SOFTLAYER).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, hillcraft.co.za did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

• Return to the previous page.
• If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

Updated 22 hours ago
© Google - Google Home"

[adrianh]

Thanks for all the info... My kingdom for a thousand workers and a thousand hours to complete a quarter of the activities on my ever growing list of tasks to be done!

[league_of_ordinary_men]

Thanks for all the info... My kingdom for a thousand workers and a thousand hours to complete a quarter of the activities on my ever growing list of tasks to be done!

Oh yes, know all to well about needing a thousand workers and an ever growing list Good luck.

[Dave A]

Strangest damn thing happened. Greig is subscribed to this thread, and his email service rejected the update notification email with error message as follows:

host *xxx* said: 550 Message
contained unsafe content
(Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net) (in
reply to end of DATA command)

- based on the links in the update from posts 9 & 10 it seems.

[Mark Atkinson]

This is almost certainly a problem with a suspicious plugin. I highly doubt the redirect caused the problem.

While I'm not able to help you directly (I don't know enough about it all) Ryan from our office may be able to if you're really stuck.

[adrianh]

Mark, all I need is the following: I will can the entire site and do a fresh install of Joomla, OsCommerce or whatever OpenSource commerce app you recommend. Once I've got it up and running I need somebody to take a good look at permissions, security and all that sort of stuff. I also need somebody to clear up the warnings that the site generates on the browsers and mail servers. I'll give that person all the logins and access that they require to give the new site a look see.

I don't need somebody to spend hours pouring over the thing, it would even do if you guys could simply advise me as to what software to install and what steps to take to set the site up to minimize the possibility of this sort of thing happening again.

It's happened a couple of times now and I growing rather tired of rebuilding the site because I don't know how to protect the site from the outset.