While a Google spokesperson contacted by Computerworld refused to comment on how often the company re-checks flagged Web sites, Google employee Phil Harton said in a [[xref:http://googlewebmastercentral.blogspot.com/2007/01/about-badware-warnings.html |blog|new]] that the process can take up to two weeks.

"We've begun sending email notifications to some of the Web masters of sites that we flag for badware. We don't have a perfect process for determining a Web master's e-mail address, so for now we're sending the notifications to likely Web master aliases for the domain in question," Harton said.

"We're planning to allow Web masters to provide a preferred email address for notifications through Web master tools."

IBRS security consultant James Turner said work still needs to be done to make it easier for Web masters to clear themselves off blacklists once they have removed malicious code.

"People have had to deal with attacks that use their domains to send spam to clients, and security vendors black-listing them because of it, so the concept is nothing new," Turner said.

"There are protocols in place to allow them to clear their Web site off the lists, but there really needs to be more [solid] procedures in place to streamline the process.

"It's a bit like the Wild West; everyone is scratching around trying to find the best solution for the problem."

The response times vary depending on the extent of infection and how quickly exploits are fixed, according to StopBadware.org, a security watchdog used by Google to identify and evaluate malicious Web sites.

"Google is the sole decider for initial decisions to post a warning page for a Web site [and it] does not rely on any testing or reports from StopBadware in making these initial decisions," the company stated on its Web site.

"If Google does not find that the site is clean, Google notifies StopBadware [which] then performs further detailed testing [and will] notify the site owner."