my friends website been infected ??

punto123

hi there

when my friends website shows up on Google search it says " this site may harm your computer"

When i click the title , then click the safe browsing diagnostic page its comes up with this

What is the current listing status for website adders removed ?

Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 5 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 1859 pages we tested on the site over the past 90 days, 46 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-06-15, and the last time suspicious content was found on this site was on 2010-05-27.Malicious software includes 3 scripting exploit(s).
Malicious software is hosted on 5 domain(s), including adfreepics.in/, yahoo-statistic.com/, tallulahcurtis.info/.
This site was hosted on 1 network(s) including AS29671 (SERVAGE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, healingu.co.uk did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

• Return to the previous page.
• If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

my friends site is about natural healing , how and why could this get infected , it is certainly nothing that has been done from his end, how can can this be sorted, many thanks

phxweb

There are many ways the site could of been infected, most likely due to easy ftp passwords.

You need to get a professional web design company to have a look at the site and get them to look at the site.

Most likely there are some extra lines of code been added to the pages to download things the computers which visit the page.

tronator

What software does the website run on? Is it provided by the web hoster or did he install it by himself?

punto123

its provided by the web hoster

phxweb

you need to either contact the hosting provider or the person who designed the site ASAP to solve this issue.

Other wise you are tanking your google rating and infects possible visitors to your site.

InspectorCludo

Search google for healingu.co.uk

what's the second link all about!!!

#
Natural distance healing, natural absent healing, psychic ...
This site may harm your computer.
natural distance healing, natural absent healing, psychic spiritual healing, personal development days, life coaching uk, Life coaching days, online stress ...
healingu.co.uk/ - Similar
#
Times » Mature Milfs
This site may harm your computer.
3 Jun 2010 ... denied (13) in /mounted-storage/home61c/sub007/sc38095-MSLB/healingu.co.uk/times8263/fp-includes/core/core.session.php on line 11 ...
healingu.co.uk/times8263/?entry=entry100603-072957

InspectorCludo

even better search google for

healingu.co.uk/times8263/?

is there a forum hosted on the site that is being spammed?

batvink

You've had a nasty injection of PHP code. It looks like the folder the PHP pages reside in haven't been secured, if you look at the top of the source code you'll find a huge junk of garbage. That garbage is actually the code that makes your site look like it's hosting ads for !!!!!!, pills and pretty girls.

The best answer is to revert to backup. You'll spend forever trying to track it all down, it will have also created new PHP files that look "normal" until you look inside. Just when you think it's all clean, it will strike again. And secure the folders!!!

punto123

batvink wrote: »

You've had a nasty injection of PHP code. It looks like the folder the PHP pages reside in haven't been secured, if you look at the top of the source code you'll find a huge junk of garbage. That garbage is actually the code that makes your site look like it's hosting ads for !!!!!!, pills and pretty girls.

is there a simple way to delete all the above garbage?
or is it easier to start over , many thanks

phxweb

Ok here goes once more as you have ignored everything i hav said thus far.


Do you have access to the ftp accounts on your website?

Do you have knowlede of PHP and Web Design to replace/ diagnose or recover your friends site ?

If the answer to either of these is no then you need to get EXPERT help from either your ISP or the guy who made the site for you.
(If the answer is yes then look in to ftp and upload a backup version of the site assuming you have one)

You have spent all afternoon on this and so far got no where. If one of my sites was infected the problem would have been solved within minutes..... instead your friends site has been hijacked, and its search ratings destroyed and by the look of the google search listings the sites reputation is in the toilet

phxweb

punto123 wrote: »

is there a simple way to delete all the above garbage?
or is it easier to start over , many thanks

If you know what php injected code looks like it would take about 10 minutes.

However looking at your site its every where.

Email me the source to your homepage and ill see if i can find it