My MODx site got flagged by Google as a Malware / "Reported Attack Site!"

What?! I don’t think anything got hacked... nothing obvious if it did. Is Google full of it? What should I be checking?

By the way, when this happens, it’s virtually impossible to use the MODx manager because every frame gets blocked, and EACH TIME YOU REFRESH, new warnings have to be cleared.... basically, I can no longer manage my site, which makes it REALLY difficult to change things.

I’m so pissed off about this right now it’s unreal. This in the same week that my ATM card and close to $2000 were stolen (I hope the two aren’t related). Anyone else had this experience?

The site, by the way is www.pocopico.com

Thanks for any help.

sorry to hear you’ve got to deal with so much sh**!

my wordpress blog got hacked right after christmas, so i know what it feels like...

By the way, when this happens, it’s virtually impossible to use the MODx manager because every frame gets blocked, and EACH TIME YOU REFRESH, new warnings have to be cleared.... basically, I can no longer manage my site, which makes it REALLY difficult to change things.

...what kind of warnings? who’s/what’s blocking your site from accessing it?

heads up!

Yeah, it’s been a crazy week.

It’s my browser that’s against me... Safari 3.2.1 and Firefox 3.0.3 both seem to automatically pick up on Google’s site classification, so for EACH page on my site, there’s a warning that pops up that has to be cleared.

In Safari, I can disable the errors by changing Preferences --> Security and unchecking the "Fraudulent Sites" warning.
In Firefox, I can disable the errors by changing Preferences --> Security and unchecking the "Tell me if the site is a suspected attack site".

After reading http://www.stopbadware.org/home/security, I think what may be triggering this is the Javascript encoding I’m using to hide my email address from spammers: http://hivelogic.com/enkoder (which is a great tool from hiding email addresses... and apparently it can be used to hide malicious code I guess).

I’m not convinced that anything is going on with my site... I’ve looked over my database and source code etc. and found nothing suspicious. It seems much more likely to me that Google misclassified by site just because it came across that encoded email address. My business name is "Fireproof Socks" and I post a few articles about web development on my fireproofsocks.com site, and Google is still to stupid to figure out that my site isn’t selling Fireproof Safes and Pyrotechnics.

there also have been some recent articles & reports about the gumblar exploit, which uses a vulnerability in Adobe Reader, Acrobat & Flash to get your FTP-Details, maybe also check your logfiles, scan your computer for trojans, change your passwords and update your Reader/Acrobat or disable js-functionality for them (that’s the tinfoil-hat in me speaking)...but probably you’re right, and it’s just google being stupid

-> http://modxcms.com/forums/index.php/topic,36412.0.html

This is both interesting and scary.

There is an uber warning against even entering this site. Even if its nonsense how many viewers are NOT going to hit the back button? Also, how long will it take for search engine results to include the warnings in the descriptions etc?

Hope you solve this soon...

Max

Yeah, it totally sucks. My site is completely blocked, basically, and this ALREADY shows in search results... I might get a link in a Google search result, but Google says right there in the search result that "this site may harm your computer."

I use SFTP to access my site. SSH uses keyed logins. I don’t have Acrobat, so I don’t think I have that vulnerability (I use Preview on OS X).

I’m not seeing any hacks to my javascript like the one described in that other thread. My whole site uses a single template, so it’s pretty easy to read through the code it’s generating.

To say this "totally sucks" is an understatement...

I feel your pain. Hopefully you can resolve this soon. Hopefully the search results will latch onto something more appealing once the issue is resolved.

I know you must be longing to put all this behind you but I am hoping will you keep us up to date with the details of all the issues involved here: it may help others avoid stepping in this pile of dog mess...

Maybe a cold beer will help? Two???...

Max

PS: there is this long explanation: http://www.google.com/support/websearch/bin/answer.py?answer=45449&topic=360&hl=en&ei=65U9StPOHZTosQPeze26Dw&sa=X&oi=malwarewarninglink&resnum=1&ct=help

Does this really say anything useful?

I checked searching for the URL with different search engines and then trying different browsers...

Some search results will not show the warning and some do. Some browsers will also take you to the site without the message. But we are talking about Google here...

Max

Heheh... yeah, maybe a couple beers would help.

I emailed the guy who makes the Hiveware Enkoder and I requested that Google review the site. In the meantime, I removed the Javascript encoding of my email address, which I suspect is what tripped off the malware sniffer.

Yeah, if Google blacklists you, you’re pretty much dead to the internet. It sucks, but that’s really the truth of it.

The only thing fishy (?) about my site is that all my watermarked images are broken. I have a script that processes images and overlays a watermark PNG through use of an .htaccess file. Basically, any request to a file in the /images directory gets appended to my watermark.php?src=$1 script. But I’ve noticed that this is broken... and I haven’t changed anything. A test version of the script IS working... the .htaccess file is unchanged (nothing funny in there).

Maybe my site DID get hacked, but I sure don’t see anything unusual, and I’ve been looking through things for a couple days now.

No word from Google yet on re-evaluating the site.

Thanks for continued input!

I’m trying to debug my problem with my watermarking script... and what I’m seeing is odd.

I’m SSH’d into my host... I can create a file x.html in my root directory, and then when I navigate to mydomain.com/x.html I see the contents of my new page. But when I put that file in the /assets directory and try to navigate to it... I end up with a 404.

So this is why my watermark script is failing. If I can’t actually navigate to my /assets/snippet/watermark/watermark.php script, then there’s no way that it can kick back a watermarked image... hell, it can’t even kick back a "hello world" because everything is being 404’d.

Any idea of what might cause this? 777 permissions don’t seem to help. In the meantime, I’ve moved my script into the root of my site, and poof... my images are back up and the script works. It’s just funny that I can’t hit any pages inside the snippets folder.