Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when they try to enter the site.

Content that has not been developed by us include only jQuery, flags and the template (styles including icons and the very basic HTML layout - no content).

My questions

  1. What has it detected on the site?
  2. How do I get rid of the block?
  3. Why does it only happen to certain Chrome users (and not myself for example)?

Here is a virus scan of the site, which shows that Sophos detects the site as malware.

High Risk Website Blocked

Location: www.twisted-gamers.net/portal/dashboard/members
Access has been blocked as the threat Mal/HTMLGen-A has been found on this website.

Return to the page you were previously viewing.

EDIT

After checking the site with Google Webmaster Tools, I discovered that Google has not found any malware on the site.

share|improve this question
    
Is your website hosted on a shared server? community.sophos.com/t5/Sophos-EndUser-Protection/… –  George P Aug 21 '13 at 16:22
    
@GeorgeP No, it's on a dedicated server with no other sites on it. –  3ventic Aug 21 '13 at 16:23
    
Just a small update that this was only affecting Sophos clients and we dealt with the issue through their support. –  3ventic Apr 1 at 17:55
add comment

2 Answers

up vote 6 down vote accepted

Typically a site gets blocked because it either contains malicious code or, more often, links to another site that contains malicious code.

Google has several sources for this information; stopbadware.org is their primary partner in this, and of course they get most of their direct knowledge through their GoogleBot indexing.

Chrome has a built-in feature that checks Google's "is this site malicious" database for all new domains you visit and will display an alert if you access a site that is. You'll get a similar result from any browser if you click on a Google search link.

To find out more about what they found, go register your site with Google Webmaster Tools so that they know you're the owner, and they'll tell you there what they know about your site, including anything malicious they found.

To get removed from the list, the first thing you have to do is find and remove the malware. Of course that's not enough: you also have to find and fix the hole that the hacker used to get in, or he'll just come back. And that's not enough either, because in nearly 100% of cases, the hacker will install multiple backdoors to ensure he has access even if you patch the hole. So you have to identify, find and remove those as well. (Not a trivial task.)

In the end, it's a whole lot safer to just nuke the whole thing and restore from a known-good backup. And then install any necessary patches after that but before you go live.

And once your site is clean, THEN you notify Google through the webmaster tools panel, and they'll re-scan your site.

share|improve this answer
    
Your link is broken... You forgot an s in the end –  3ventic Aug 21 '13 at 17:54
1  
Google has not found any malware on the site. –  3ventic Aug 21 '13 at 18:02
    
@3ventic the other place Chrome checks is stopbadware.org -- they've got a "webmaster help" area on that site for website owners. –  tylerl Aug 22 '13 at 18:39
    
I'll check that when the site is up. –  3ventic Aug 22 '13 at 18:49
add comment

Different users can have different settings, which can cause non-uniform blocking. Check user's versions and settings to confirm.

As for the error, it is possible that if your site is uses TLS/SSL, but a link or connection in your code references "Http://", Chrome will flag it as potentially bad to protect users against injected code.

share|improve this answer
    
We're not using SSL. I'll have to check with the versions and settings. –  3ventic Aug 22 '13 at 16:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.