Familiar with the malware reinclusion process?
-
One of our sites was haXX0red and at the moment I'm thinking it was a non-updated paid for WP plugin using the old version of timthumb.
While not important to my question, the hack included .htaccess files in all the /uploads/ to redirect to a site (tonycar dot com) which I assume installed some sort of malware or spyware.
I changed all ftp and admin log ins, updated the timthumb files and deleted all the .htaccess files, for added measure I've currently made the upload folders read only.
I've requested a review through webmaster tools and the image that WMT claimed to be an issue has been removed as being an issue. That is to say if I clicked on the malware warning in WMT, it told me imagex.jpg was a problem and now it doesn't tell me anything is an issue, though the malware warning still persists.
As I no longer have any indication as to what (if anything) is wrong, I tried going through some contacts at adwords to no avail, though they have said there's a note saying there's no malware currently on the site (I'm hoping that's by them and not just my reinclusion request).
Assuming the all mighty G is now satisfied there's no malware on the site (or being processed by the site), does anyone have any idea how to get rid of the warning?
Alternatively if the warning is accurate, how can I find out what's being effected?
-
It's a waiting game at this point. If they don't find problems then ask for reinclusion again. Wait 24 hours between asking for reinclusion & seeing if Google reports new problems.
-
If Google's stopped telling me what the problem files are, any idea how to find out what they are seeing?
I think I've plugged the problem and removed the suspicious files, but I can't really be sure.
-
I ran into an issue with malware once and Google was very responsive during the process. Each time I asked for reinclusion the request was responded to within 24 hours.
I say "each time" because this particular piece of malware infected random files across an entire dedicated server hosting a great deal of websites. After I became aware that the problem was impossible to solve manually, I wrote a script to detect and remove all traces of the malware. At this point it was my 5th request I believe, and there was no problem with Google approving my request.
There are scanners you can use but during my look at them, I didn't find any reliable free ones. Hopefully you got it all and won't need to pay for anything.
Wonderful people, these malware creators. Best of luck.
-
It should go away on it's own once you removed all the offending malware code from your site.
Call your hosting company and they will scan your site and remove the malware for you. A lof of people don't know that their hosting company will be more than happy in assisting removing hacks or viruses present on your sites at no charge. It's probably still on your site if you're still getting the message days later.
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
My WP website got attack by malware & now my website site:www.example.ca shows about 43000 indexed page in google.
Hi All My wordpress website got attack by malware last week. It affected my index page in google badly. my typical site:example.ca shows about 130 indexed pages on google. Now it shows about 43000 indexed pages. I had my server company tech support scan my site and clean the malware yesterday. But it still shows the same number of indexed page on google. Does anybody had ever experience such situation and how did you fixed it. Looking for help. Thanks FILE HIT LIST:
Technical SEO | | Chophel
{YARA}Spam_PHP_WPVCD_ContentInjection : /home/example/public_html/wp-includes/wp-tmp.php
{YARA}Backdoor_PHP_WPVCD_Deployer : /home/example/public_html/wp-includes/wp-vcd.php
{YARA}Backdoor_PHP_WPVCD_Deployer : /home/example/public_html/wp-content/themes/oceanwp.zip
{YARA}webshell_webshell_cnseay02_1 : /home/example2/public_html/content.php
{YARA}eval_post : /home/example2/public_html/wp-includes/63292236.php
{YARA}webshell_webshell_cnseay02_1 : /home/example3/public_html/content.php
{YARA}eval_post : /home/example4/public_html/wp-admin/28855846.php
{HEX}php.generic.malware.442 : /home/example5/public_html/wp-22.php
{HEX}php.generic.cav7.421 : /home/example5/public_html/SEUN.php
{HEX}php.generic.malware.442 : /home/example5/public_html/Webhook.php0 -
GSC: Change of Domain Not Processed, Despite Saying "Approved"?
Hi folks, I've just completed a straightforward olddomain -> newdomain migration. All the redirects were done on 7th Feb. I submitted the change of domain request on 7th Feb. All seemed fine - as can be seen in the attached. It's now 19th March and our pals at GSC are still saying that the domain migration is ongoing. I've never had this take so long before; 2-3 days tops. Their results are tanking as I can't geo target and more features in GSC are out of action as it's 'locked' due to this migration (I just get a screen as per the attached). Thoughts? Shall I risk withdrawing the request and starting anew? The old "turn it off and on again"? Thanks! hJXKC
Technical SEO | | tonyatfat0 -
Redirect Process for Moving a Blog
Hi, I've read several articles about the correct process for moving a blog from a subdomain to the main root domain but am not quite 100% sure as to what to do in our scenario. They were hosting their blog on Hubspot which puts the blog on a sub-domain "blog.rootdomain.com". Realizing it isn't benefiting the main website for SEO they want to move it to the main website. I understand we have to redirect the Hubspot "blog." pages to the new "rootdomain.com/blog" pages but when transferred over (it's a WordPress site) it shows the dates. So, the URL is "rootdomain.com/blog/year/month/title". They want to remove the date. Does that mean the URL must be re-written then redirected so that there's no date showing? There's over 300 posts which will have to be redirected from the Hubspot URLs. Is there a way to avoid setting up the second redirect to remove the dates or make it easier so it isn't one page at a time?
Technical SEO | | Flock.Media0 -
Automate process for naming page titles?
Hi everyone, I'm new to the Moz community, but really loving it. I'm hoping some of you more experienced experts may be able to answer what is probably a pretty basic question. I'm working for a non-profit client and I used the SEOMOZ tool to run a report on their site errors. I learned that the website has 5,432 duplicate page titles. They had their website redesigned last year before I started working with them and it appears that the developers didn't take into a account the need to provide unique page title names to each page. While it may make sense to go in to add custom page titles to a handful of the pages for the site, the vast majority of the pages are allocated to products (e-commerce). Is there a script that the developers could add that would automatically add page unique page titles based on say, the title of the product? Here are a few URLs to help you get a sense of what we're dealing with. homepage: www.creativityexplored.org example level two page: http://www.creativityexplored.org/artists/douglas-sheran example product page: http://www.creativityexplored.org/shop/original-art/prints/2776/profile-of-a-lady Thank you so much for any advice you can offer. Best, Linda
Technical SEO | | LindaSchumacher0 -
Same day our sitemap finished processing in G WebTools, our SERP results Tank!
Need a little help troubleshooting an SEO issue. The day our sitemap finished processing in Google Webmaster Tools, almost all of our keyword serp results tanked. Our top 4 keywords routinely were placing from 11 - 33 rank in serp result and now they're not even on in the top 200? Would the sitemap processing have anything do do with this or should I look somewhere else. FYI: Site is build in DNN, sitemap is fine and robot.txt file is good. Open to all suggestions!!
Technical SEO | | Firecracker0 -
Malware ranking drops
Hi, One of our sites got hit with malware in November. We cleaned it up and sent a reconsideration request and no malware warnings are in WMT anymore. We still haven't seen an improvement in rankings even though people say it can take up to 90days? Organic traffic is down 40% and still dropping. Any advice? Thanks
Technical SEO | | Sayers0 -
How to automate the process of checking the operators
How to automate the process of checking the operators of search teams.
Technical SEO | | meteorr
such as:
inurl:? lang = ru site: tochka.net
inurl: print site: tochka.net
inurl: print site: tochka.net / *
inurl: nomobile = 1 site: tochka.net / *
inurl: comments site: tochka.net
inurl: comments site: tochka.net / *
inurl:? a_aid site: tochka.net ... with the conclusion of the number of pages in the search. There is a program to identify?0 -
Speed up the process of removing URLs from Google Index
Hi guys, We have done some work to try to remove pages from Google index. We have done the following: 1. Noindex tag 2. Make pages returning a 404 response. Is there anyway to notify Google about these changes so we can speed up the process of removing these pages from Google index? Also regarding the URL removal tool, Google says that it's used to remove URLs from search results, does it mean the URLs are removed from their index too? Many thanks guys David
Technical SEO | | sssrpm0