Has our site been hacked? Google says we are malware! HELP

Question

We receieved an email direct from google this morning, stating that our site is carrying malware. We are a respectful marketing company with no dodgy code or links to malware on our site.

We now have a warning next to our site in the SERP's!

Has this happened to anyone before, could it be a competitor trying to sabotage us?

Here is google diagnosis....

http://www.google.com/safebrowsing/diagnostic?site=http%3A//www.firstimpression.co.uk/&hl=en

What can be done about this?, please help :(

Answer 1

Did you even read the page linked in the results?

1. Google "firstimpression".
2. Notice that "This site may harm your computer" is a link.
3. Follow link.
4. Read the box that says "If you're the administrator of a site we've identified with this warning message, please visit the instructions found in our Webmaster Help Center to resolve the problem."
5. Follow instructions.
6. ???
7. Profit!

Answer 2

I would check your site for any iframes. I've had a client's site get hacked on their own hosting service and the hacker embeded an iframe. Even accessing their site in Safari warned me. Simply deleting the iframe or re-uploading their site fixed the issue.

Answer 3

Certainly you have managed to get on google's blacklist. I don't see anything dodgy - though I have only been to the front page. I also used this tool: Wepawet and it found nothing on your index page.

I suggest you have somebody competent look through your site - then go through the hoops to unblock yourself when done.

The chance it was a malicious competitor approaches 0 - it would be a hard thing to do, and in all honesty I don't think your competitors would have the resources to attempt such a thing. The main chance is that it was/is some kind of automated web worm liiking to use your site for distrbuting a malicious payload. I can name two companies off hand that I have seen this happen to (I warned them - and indeed nothing was done...).

Answer 4

Thank you all for your replies, I found a small JS on the index page which has been removed. I have followed the instructions on stopbadaware.org and requested a review so hopefully the site will be removed from the list.

I will also be scanning my mac's/pcs for any trojans and changing all ftp password.

Once again thanks.

Answer 5

this is worth a read