Fix Compromised Websites How a site gets infected, what to do about it, and getting the Google warning removed.

Infected Websites

How my site gets infected

• If you use old PHP scripts, they ALL have security holes in them.
  (WordPress, Joomla etc - always use the latest stable version).
• 777 permissions on files leave the back door open to write to a file.
  (SmallPond Servers do not allow global 777 permissions.)
• A trojan can be uploaded by the website owner unknowingly
  (free skins may have Trojan code embedded).
• Password breach - use machine generated passwords.

What to do about the infection

• Change all access passwords to machine generated ones.
• If you are unfamiliar with your CMS, you will have to call in a developer.
• Scan the site on your computer using an effective antivirus program.
• Scan the website online using a virus scanner.
• Disable any SMTP mail sending facility that comes with a PHP program.
• Look for java script embedded in the code.
• Check last modified dates on files for recent malware activity.
• Look for obvious destinations that are not related to your website.
• Upgrade all PHP programs to the latest version.
• If your site is badly contaminated, then a complete rebuild may be necessary.

Why does this happen?

Mostly, your site is hacked so that it can send spam out for the spammers. Spammers are motivated by money and target the gullible.
Other hacking motives are identity theft, political or just malicious (revenge or any perceived injustice).
This is why keeping credit cards on your hosting space is a big NO NO.

Removing Google's warning message from the search results

• Once your site is clean and has been uploaded to your hosting space, log into Google. If you don’t have a Google account, now is the time to open one - it is free.
• Go to Google Search Console - click here
• Add your website URL and verify it
• On the Search Console home page, select the contamination-free site.
  In the "Parts of this site may be distributing malware" message, click More details, then click Request a review.
• Read more about malware and infected websites in Search Console

CERT Advice
Computer Emergency Response Team (Australia)

If you own a website (ie you are the registered domain owner), you may receive an email from info@cert.gov.au to notify that your website may be hosting or redirecting to malicious content.
As the owner of the website, it is your responsibility to keep it clean of malicious content.
We recommend you consider this plan of action:

• scan your website for common problems using a free website scanning tool
• take the affected website offline for remediation
• change the password for access to the website using a known clean computer
• restore the website from a clean backup
• update the website with the latest Content Management System version and security updates
• install security plugins and harden the website to prevent further security compromises
• put your website back online and re-scan it
• use the Google search engine to perform a security review of your website:
  https://search.google.com/search-console