BEWARE - www.freedivers.co.uk - Google reports malicous code

[harbour seal]

BEWARE - [a freediving website in the UK] - Google reports malicous code

_________________________________________________________________________________________
*****************************************************************************************
*** UPDATE: December 4th *****

THIS SITE WAS CLEARED OF MALICIOUS CODE and GOOGLE NO LONGER REPORTS ANY ISSUES

The problems were caused by an outside source, which created much aggravation for the site owner. I removed the link to the site in question from the title of the thread and the text below, as the website no longer poses a threat. Cheers Sean
_________________________________________________________________________________________
*****************************************************************************************



[* = link to the uk freediving website in question was removed]


Hello DB collective,

A word of warning regarding a freediving website often linked-to from these forums.

Google reports that *[a freediving site in the uk] is an "attack site". :rcard
[Note: click on link at your own peril :crutch]

---
Here are links to jpgs of the "Reported Attack Site!" warning screen and Google's report when clicking "Why was this website blocked? " Also, the text of the report appears at the bottom of this post.

http://i51.photobucket.com/albums/f394/theRealMacoy/attacksitemessage.jpg
http://i51.photobucket.com/albums/f394/theRealMacoy/Info-Google-safebrowsing-whysiteblo.jpg

---
It is not uncommon for websites to get hacked and malicious code inserted without the owner's knowledge or consent. Once the site is fixed it is a straightforward matter of requesting that Google review the site again; thus, until the warning is lifted I suggest avoiding the offending website. Even trusted websites you frequented in the past can have malicious code inserted.

Any computer experts with input regarding these security-related issues would be most welcome. In addition, updates from the owner of the website would be helpful.

Luckily, I ran into Google's warning after I unknowingly clicked the link *[to a freediving site in the uk] advertised in the signature of a DB member. A few days ago I pm'ed this user and suggested the link be removed until the website is cleared, but nonetheless it continues to appear in his more recent posts.

My feeling is that having this link appear in multiple pages all over DB will only serve to spread the malicious code. Regardless, I expect the wise old DB mods to know how best to handle this issue. Let's think "safety" people!

Cheers,

Sean
Vancouver, Canada

Ps. Mods feel free to move this post if I have posted in the wrong area.


---
This is the text of the report:

"Safe Browsing

Diagnostic page for freedivers.co.uk

What is the current listing status for freedivers.co.uk?

Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.
​

What happened when Google visited this site?

Of the 13 pages we tested on the site over the past 90 days, 6 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-11-19, and the last time suspicious content was found on this site was on 2009-11-19.Malicious software includes 6 scripting exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
Malicious software is hosted on 1 domain(s), including villadepinto.com/.
This site was hosted on 1 network(s) including AS8851 (EDGE).
​

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, freedivers.co.uk did not appear to function as an intermediary for the infection of any sites.
​

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.
​

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
​

Next steps:

• Return to the previous page.
• If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center."

 

[harbour seal]

....another version of the warning....

I tried searching for [the uk freediving site in question] on Google, then clicked the link from the results list.

The text of the Google "Malware Warning" I received is below.

Link to jpg of this screen:
http://i51.photobucket.com/albums/f394/theRealMacoy/Malwarewarning-fromGooglesearchl-1.jpg




Warning - visiting this web site may harm your computer!



Suggestions:

• [ame="http://www.google.ca/search?q=freediving+uk+co&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-USfficial&client=firefox-a"]Return to the previous page[/ame] and pick another result.
• Try another search to find what you're looking for.

Or you can continue to Freedivers learn to freedive with professional instructors at your own risk. For detailed information about the problems we found, visit Google's Safe Browsing diagnostic page for this site.

For more information about how to protect yourself from harmful software online, you can visit StopBadware.org.

If you are the owner of this web site, you can request a review of your site using Google's Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
Advisory provided by

 

[JennyWren]

Hey Sean. I recently solved a similar problem on my own site. Not sure who to contact to help with this one - basically the site owner needs to clean ALL the files of malicious code, it's usually in the javascript files, added at the bottom.

The site owner should search their JS files for rogue document.write calls, and any PHP files for base_64 encoded stuff that doesn't belong.

 

[harbour seal]

Hey Sean. I recently solved a similar problem on my own site. Not sure who to contact to help with this one - basically the site owner needs to clean ALL the files of malicious code, it's usually in the javascript files, added at the bottom.

The site owner should search their JS files for rogue document.write calls, and any PHP files for base_64 encoded stuff that doesn't belong.

Hello Jenny,

Thanks for the technical update. Over the last 3 months it seems website all over the web are being hit with these kinds of attacks. Moreover, a good friend's work-site (a fairly large internet commerce site) recently went down and eventually the RCMP were called in given the extent of the damage .

The owner of the freedivers.co.uk site contacted me and said he was in the process of cleaning off the site and that the problems were caused by an outside source. Hopefully, cleaning it has be a straightforward process but perhaps your info might yet prove useful to him. Damn frustrating though, no matter how you cut it. Glad to hear you got your site sorted out though.

Always nice hearing from a fellow Vangrooverite.

Cheers,

Sean
Vancouver, BC