A recent post on the CIO blog got my attention:

Some website operators are complaining that Google is flagging their sites as containing malicious software when they believe their sites are harmless. ….

“We have no bad software or installs or anything that would indicate a need to ban people from viewing our site,” wrote Matt Blatchley, who works for the Greenbush Southeast Kansas Education Service Center, in a posting on Friday to Google Groups.

MattB, please double-check urls such as
http://sss.green bush.org/gbiss/Pricing.html
http://sss.green bush.org/gbiss/Time.html

(I split the urls to prevent accidental clicking. I wouldn’t go there unless you’re running Linux.) View the source and look at the bottom of the page. See the code that looks like

<script language=”javascript” type=”text/javascript”>var k=’(encoded gibberish)’,t=0,h='’;while(t<=k.length-1){
h=h+String.fromCharCode(k.charCodeAt(t++)-3);}document.write(h);</script>

I think that’s what is causing your problem. It looked like your site might be hosting a WMF exploit that could infect any visitor to your site.

I’ve checked out a quite a few “we don’t have any malware” reports at this point, and I’ve yet to see a false positive — the sites in question have each had some malware on them. But this change is also relatively new, and we’ll keep working on ways to help site owners diagnose if their site has been hacked and is distributing malware. Maybe we can show some of the urls that appear to have malware in our webmaster console, for example. In general, I’d check file-modification times for the pages on your site to see if someone has changed your pages recently.

In the mean time, here’s how to appeal if your site is flagged as hosting malware:
- Click on the “StopBadware.org” link on the interstitial that Google shows.
- On the resulting page is the phrase “If you are the administrator of the website that was reported to us and would like to speak with us, please see our contact page.” Click on that contact link to get to http://www.stopbadware.org/home/contact_general to read about how to email and lodge an appeal with StopBadware.

I think this process can still be improved, but at the same time, we’ve heard very positive reactions from users that don’t want to click on potential malware pages. Ultimately I think it helps to alert webmasters that they may be serving up malware to their visitors, because if a site has been hacked it’s good to know about that quickly.