Hi goblue1,
Does your site serve ads?
Main Topics
Browse All TopicsAt a web site I manage I am getting the famous Warning visiting this web site may harm your computer error. I have searched the database here and tried a few steps and am still unable to find it.
It has been added to the google web tools and verified but they still shows an error.
Google Info:
What happened when Google visited this site?
Of the 3 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-25, and the last time suspicious content was found on this site was on 2009-09-25.
Malicious software includes 1 exploit(s).
Malicious software is hosted on 1 domain(s), including specialgt.com/.
This site was hosted on 1 network(s) including AS21844 (THEPLANET).
It has been verified at norton as well, but they will not clear the site and it still has the grey ? on it.
After running a tool read about here at
http://wam.dasient.com/wam
I am getting the response below...no specific page but the entire site itself....i was expecting to get an actual page where the script was hiding but have not...only the main domain...checked the index.html and it is clean...i used to have flash on it and removed it all and put a simple redirect to the main page to test to see if the script was hiding in it.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Does the hosting company give you a static IP or does your IP change? It may be that if you have a dynamic IP the site that had it prior to yours was serving up something bad.
I've also seen a few false positives with Google so far. It may be worth the frustration of emailing their support to find out.
Yes, true. No, the IP is static...it has been the same way for about 5 years now without a problem. The site hasn't even been updated. Suddenly, about 10 days ago this all started for whatever reason. They notified me of the problem so I went to google web tools to look in to it. Also, I tried to verify it through Norton as well. Im at a loss on this one and am about finished building a brand new site mainly because I don't have an original back up to re upload the entire thing on the server. It is has been there for so long without needing updating that I never bothered with it.
The site does get a lot of junk email and I just enabled the spam assassin filter and spam junk box filter to help cut down on that. I didnt think the email could trigger something like this, and felt it had to be an actual web page causing it.
Is it to the point where i need to literally pull down the site off the server, recreate it and start over? I really don't want to do that because of the amount of email traffic they have and accounts.
I dont understand the myndomain.info script that comes up as the problem...or where that is being loaded...which is what I thought was causing it. can't find it anywhere and that is what comes up when running the tool at http://wam.dasient.com
No, email wouldn't cause Google to complain about the site. The only thing I could think of is MAYBE the site is hacked and they changed a .htaccess file to redirect certain requests to malware.
What does the hosting provider think is going on here? Do they have tech support you can get involved in the process?
Honestly, unless you have a component in this site that goes out to a third-party server or the site has been hacked in some way, I think you are looking at a false positive from Google.
I have not contacted them about it....to be honest I never get far with the host...not to mention all of you guys are just that good. Not blowing smoke up your ... but I have had better success posting here than doing anything else on the net. I gave up dealing with the dips everywhere else. :)
Thank you...i will contact them and see what happens. This one as usual has me baffled.
All answers were excellent.
It ended up being a .pdf file uploaded by a 3rd party hiding in the FTP public directory. The suggestion to speak with google and provider did very good and a further suggestion by shalomc finished it off by suggesting to look at any recent updated files.
In the future if any of you encounter this problem be certain to check that public ftp or ftp folder including all public html folders on the web server.
I thank both of you very much.
I have no clue on that jason...that is what I was told by one of the administrators who cleared up the issue at Google. Perhaps it was a file in the public ftp folder I was unaware of? Could it have been a script within the pdf file itself? (probably not or you wouldn't have mentioned it)
I guess the most important issue is the fact that whatever it was, it was hiding itself in the public ftp folder because after removing the folder and access to it, I received the notice that the site was now clear. Maybe you could elaborate your thoughts on this more to help out anyone in the future? Thank you. Also, the pdf file was the only one with a recent date, which may be the reason for the blame.
Business Accounts
Answer for Membership
by: goblue1Posted on 2009-09-25 at 10:29:56ID: 25425125
More info: (per google diagnostics)
davaotourism.com/, served content that resulted in malicious software being downloaded and installed without user consent.
ty.com/, regale.com.pk/, cifarykuuipan.fortunecity. com/.
Safe Browsing
Diagnostic page for specialgt.com
What is the current listing status for specialgt.com?
Site is listed as suspicious - visiting this web site may harm your computer.
What happened when Google visited this site?
Of the 6 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-25, and the last time suspicious content was found on this site was on 2009-09-25.
Malicious software includes 2190 exploit(s).
This site was hosted on 1 network(s) including AS44042 (ROOT).
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, specialgt.com did not appear to function as an intermediary for the infection of any sites.
Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 890 domain(s), including regale.com.pk/, sans-fric-a-velo.com/, yamoh.org/.
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Safe Browsing
Diagnostic page for AS44042 (ROOT)
What happened when Google visited sites hosted on this network?
Of the 1756 site(s) we tested on this network over the past 90 days, 81 site(s), including, for example, usabit.com/, hofgorei-resortdavao.com/,
The last time Google tested a site on this network was on 2009-09-25, and the last time suspicious content was found was on 2009-09-25.
Has this network hosted sites acting as intermediaries for further malware distribution?
Over the past 90 days, we found 56 site(s) on this network, including, for example, goodstuffreviews.com/, statsalizer.com/, livelnternet.net/, that appeared to function as intermediaries for the infection of 825 other site(s) including, for example, opp.go.th/, contact.com.az/, terminaissemfios.com/.
Has this network hosted sites that have distributed malware?
Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 71 site(s), including, for example, securescantools.com/, specialgt.com/, makekitchen.ru/, that infected 2123 other site(s), including, for example, landseerkcamrose.fortuneci