Removing Malware and the Warning by Google

As I said, if Google has flagged your site, it's a virtual certainty that your site has been hacked. But many webmasters have little experience dealing with this level of security issues, so I thought I'd offer a guide to dealing with malware. These are the steps I recommend:

• Start by doing a virus scan of the computer that you use to create your website and upload the files to your site's server. This is to insure that you have removed any virus on your local computer that can be used to alter the files for your site or to steal your FTP account information. Most people use anti-virus software as a matter of course, so it's a good idea to do this scan with software that you do not use on a regular basis. There are several good free anti-virus or malware scanning programs available online. I recommend Spybot: Search & Destroy, or Malwarebytes' Anti-Malware. Either one will do a thorough scan of your computer and will remove any suspicious files.

• Change the passwords on all of the FTP Accounts for the website. Hackers are increasingly targeting FTP account access information - user name and password - to spread their infections. Changing your password on a regular basis is also a good security practice in any case.

• Delete all of the files from the server. The best way to remove an infection is to wipe the server clean, because hackers often add files to a site that either re-infects the webpages or opens a backdoor to the site for manual access. The only files you can leave behind with relative safety are your mySQL database files, since they're almost always on a separate server and are rarely a source of malware. But if you have back-ups of your mySQL data files, you should strongly consider restoring the files on the server from those back-ups.

• Restore the files for your website from your local back-ups. Of course, you need to make sure that your back-ups haven't been infected before you do this or you'll just be restoring the infection as well. Check the malware warning from Google to see which pages they marked as suspicious, and see if your local copies of those files are clean. It's also a good idea to check the last modification date on the local files to see if they appear to match the dates when you last updated them. If all is well, you can go ahead and restore the site.

• Update all blog, forum, gallery, CMS, and other popular scripts to the latest version. Most hackers gain access to websites by exploiting known vulnerabilities in older versions. The people who make these scripts are usually very good at keeping up with hackers, but you need to watch for these updates and install them as soon as possible. Once you've updated the scripts on your website, be sure to update your local copy as well.

• File a Malware Review Request through Google's Webmaster Tools console. Google will periodically re-scan a site to see if the problem has been repaired, but that can take quite some time. Filing a Review Request gets your site examined much sooner and will usually get the malware warning removed within a few days (often sooner, but...).

In summary, the key steps are: (1) Removing the malware from your site, (2) Closing any holes in your site's security, and (3) Filing a Review Request. If you follow these steps and still have trouble, you can get more help by visiting Google's Webmaster Help Forum where there are people who will examine your site and make recommendations.