Chrome warning about malware on magicjacksupport.com site?

[why-him]

I notice that when I go to certain topics, I get a warning from Chrome as follows:

Warning: Visiting this site may harm your computer!
The website at www.phoneservicesupport.com contains elements from the site gnbi.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for gnbi.com.

For example, I get it at this URL:
http://www.phoneservicesupport.com/hp-t ... t1493.html

Anyone else getting it? Why is it appearing? Can we prevent it? Is there actually malware sneaking into the forums?

Thanks,
Yosh

[mberlant]

It is appearing because VaHam found a useful document that happens to be hosted at gnbi and decided to share the link with us, along with posting the text of the included .pdf file.

I opened the link and found nothing harmful in it. It appears that you got trapped by a nanny program that would rather throw the baby out with the bathwater than clean up the water. Now you get to decide what to do with this information.

[VaHam]

I notice that when I go to certain topics, I get a warning from Chrome as follows:

Warning: Visiting this site may harm your computer!
The website at www.phoneservicesupport.com contains elements from the site gnbi.com, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for gnbi.com.

For example, I get it at this URL:
http://www.phoneservicesupport.com/hp-t ... t1493.html

Anyone else getting it? Why is it appearing? Can we prevent it? Is there actually malware sneaking into the forums?

Thanks,
Yosh

GNBI.COM is one of my domains. My hosting company was hacked and some of my domains as well as others hosted there were infected. The infection inserted some code to bump up the hackers Yahoo count. Not really horribly harmful but still not something I was happy about.

I attempted to locate and remove the offending code from all 63 pages effected out of the thousands located there. It is a daunting challenge. I contacted my hosting company to ask that they run a shell script to remove the offending code but they would not do so initially since it would bog the servers down while it run. The hosting company apparently changed their minds and took initiative to cleanup sites hosted there as well as tighten their security and the problem should be solved now.

Google's nanny gives you further information on the nature of the warning. While they are kind enough to flag problems they are not kind enough to provide a list of infected pages they detected to the webmasters. Google also apparently keeps any site which has had a problem in the past 90 days on their list. From the more info provided by Google you will see the following:

"Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

What happened when Google visited this site?

Of the 127 pages we tested on the site over the past 90 days, 63 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-03-29, and the last time suspicious content was found on this site was on 2009-03-05."

So the suspicious code was removed 24 days before their last test but the sites still remains on their list.

[why-him]

Thanks to both of y'all for the clarifications.

-Yosh

[VaHam]

It is appearing because VaHam found a useful document that happens to be hosted at gnbi and decided to share the link with us, along with posting the text of the included .pdf file.

I opened the link and found nothing harmful in it. It appears that you got trapped by a nanny program that would rather throw the baby out with the bathwater than clean up the water. Now you get to decide what to do with this information.

Thanks for the help in explaining Google's nanny stuff. BTW I wrote that document initially as a post for this forum and just packaged it up and hosted it on one of my domains to make it easy for folks to download the pdf format and .bat files.

So all the information is here in the forum; folks can read it here if they are worried and create the .bat files themselves since my post has the contents of them shown. The same info is in the following post:
http://www.phoneservicesupport.com/post11862.html#12140

[mberlant]

I didn't know and didn't care that you happen to own that domain. I just didn't believe that you would post tainted material on a [presumably] shared host, so I decided to check out the file.

You are lucky that you are not on one of those megahosts where each client gets a microslice of the same host. You'd have no chance of getting clear of the nannies if that were your situation.

Cheers.