New scan:

Malware Scanner report for afikei-orot.org.il

Malicious/Suspicious/Total urls checked
1/0/4
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
Found
Probably the website is defaced. The following signature was found:

HACKED BY THE KEY40 FROM ALGERIA  (53 websites defaced)

See details below

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://afikei-orot.org.il/
200 OK
Content-Length: 27978
Content-Type: text/html
suspicious
Malicious code - confirmed by antiviruses (see below)


REM -- Var to determine current nav1 to mark
nav1_to_mark = 1
sub ChangeBackgrounds(navCurr, nav1_id)
REM -- Change current nav1 to be marked
nav1_to_mark = nav1_id
rem -- Total number of nav1 on side/secondary bar
nav1Count = document.navfrm.nav1Count.value
REM -- Clear all selected backgrounds except current
for P = 0 to nav1Count-1
if P <> navCurr then
document.all("divy_" & P).style.background="url(images/nav2_bg1.gif)"
end if
next
end sub

sub MouseOutFunc(nav1_id, navCurr)
if CInt(nav1_id) <> CInt(nav1_to_mark) then
document.all("divy_" & navCurr).style.background="url(images/nav2_bg1.gif)"
end if
end sub

Antivirus reports:

Emsisoft
Win32.Virtob.Gen.12 (B)

Deface/Content modification. The following signature was found: HACKED BY THE KEY40 FROM ALGERIA

...[3778 bytes skipped]...
úä áèåç ëé áøöåðê ìîçå÷ àú äøùåîä"
Case else
iMsg = "? äàí àúä áèåç ëé áøöåðê ìîçå÷ àú äøùåîä"
End select

REM -- Actual deleting
if msgbox(iMsg, VbYesNo, "îçé÷ä")=6 then
document.delete.submit()
end if

end function


</script>






<title dir="rtl">HACKED BY THE KEY40 FROM ALGERIA</title>
</head>

<body OnLoad=>


<table width="916" border="0" align="left" cellpadding="0" cellspacing="0">
<tr>
<td width="200" rowspan="3" align="center" valign="top" bgcolor="#FFF3E6"><table width="100%" cellpadding="10" cellspacing="0" >
<tr>
<td width=100% colspan="2" valign="top" align="center" dir="rtl">
<marquee heig
...[29462 bytes skipped]...


http://afikei-orot.org.il/date-picker.js
404 Not Found
Content-Length: 1635
Content-Type: text/html
clean
http://afikei-orot.org.il/test404page.js
404 Not Found
Content-Length: 1635
Content-Type: text/html
clean
http://afikei-orot.org.il/inc/general/date-picker.js
200 OK
Content-Length: 16529
Content-Type: application/x-javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: afikei-orot.org.il

Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Tue, 25 Nov 2014 13:35:59 GMT
Server: Microsoft-IIS/6.0
Content-Length: 27978
Content-Type: text/html
Set-Cookie: ASPSESSIONIDSABRQASB=GBGNJCECHABHGHPJNAHNGPJA; path=/
X-Powered-By: ASP.NET

...27978 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: afikei-orot.org.il
Referer: http://www.google.com/search?q=afikei-orot.org.il

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=afikei-orot.org.il

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://afikei-orot.org.il/

Result: afikei-orot.org.il is not infected or malware details are not published yet.