Many of our members have noticed Malware warnings when visiting our site lately.
Something like this:
Clicking the link to the diagnostics page would give you this:
Quote:
What is the current listing status for www.snitchseeker.com/gallery/albums?
This site is not currently listed as suspicious.
Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.
What happened when Google visited this site?
Of the 3 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2011-11-12, and the last time suspicious content was found on this site was on 2011-11-10.Malicious software includes 2 trojan(s).
Malicious software is hosted on 1 domain(s), including q3s.ru/.
This site was hosted on 1 network(s) including AS46475 (LIMESTONENETWORKS).
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, www.snitchseeker.com/gallery/albums did not appear to function as an intermediary for the infection of any sites.
Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.
This warning showed up because Google added a new feature to protect people from malicious sites and to help make the web a safer place. They scan all files on websites around the web (including ours) and if they find any suspicious looking code, they put up that warning to anybody who attempts to view any page anywhere on the site, regardless of if the section was flagged or not. The entire site gets the warning once any file on any section is found to contain malicious code.
In our case, the malicious code was an invisible iframe which hackers had placed in unused index files in our gallery.
REPEAT: The files containing the malicious code were in UNUSED pages in our gallery - pages not linked to from anywhere and which nobody can visit. So nobody was at any time in danger of getting infected. But Google plays it safe and flagged our site anyway, just in case.
I have found and manually removed all the infected files, and resubmitted our site for Google to check. Yesterday we got confirmation from Google that the malicious files indeed are removed and our site has returned to good standing and is no longer flagged.
See screen from our Google webmaster tools confirmation (screen taken 13 Nov 2011):
The days leading up to November 13th, the message was this:
I hope this explains everything clearly for all of you. Bottom line:
Nobody was ever in any real danger of infection, and now ALL files on our server (even ones not accessed by site visitors) have been cleaned and
all malicious tags have been removed. Google has confirmed this and has removed the warning.
I apologize for any worries or inconvenience this might have caused you. Thank you for keeping us on our toes!
Love from your faithful headmaster,
Richard Harris aka Dumbledore
Resolved, clean and not an issue: Google Malware warning 
