I opened one of our webapps yesterday in Chrome and it threw up the big red "WARNING this site contains content from URL which is bad". I double checked the url I typed in and immediately viewed source and searched the file. Sure enough, at the bottom was a script tag with a encoded url that when decoded was the offending URL that Chrome had spotted.
I'm curious how this was done and how I can avoid it in the future. The steps I took are below, but not sure if they are the solution.
I looked in IIS and saw that the site allowed write access for IUSR_ComputerName and IIS_WPG users to the entire webroot, which was originally done to write upload and log files. I limited this to the specific areas that needed to be written to and only for IIS_WPG.
Thanks in advance.