New scan:

Malware Scanner report for jimsmitherwatercolors.com

Malicious/Suspicious/Total urls checked
1/0/19
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://jimsmitherwatercolors.com/
HTTP/1.1 404 Not Found
Cache-Control: private
Connection: close
Date: Sun, 31 Aug 2014 05:43:28 GMT
Location: http://fineartstudioonline.com
Server: Microsoft-IIS/6.0
Content-Length: 18
Content-Type: text/html
X-Powered-By: ASP.NET
clean
http://fineartstudioonline.com/
HTTP/1.1 301 Moved Permanently
Cache-Control: private
Date: Sun, 31 Aug 2014 05:43:28 GMT
Location: http://faso.com/
Server: Microsoft-IIS/6.0
Content-Length: 0
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQCAQQABB=OGOPPKFBCBDOBMCHHBBDHFLK; path=/
X-Powered-By: ASP.NET
clean
http://faso.com/
200 OK
Content-Length: 30649
Content-Type: text/html
clean
http://faso.com/static/js/showhide.js
200 OK
Content-Length: 3170
Content-Type: application/x-javascript
clean
http://jimsmitherwatercolors.com//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js/
404 Not Found
Content-Length: 1635
Content-Type: text/html
clean
http://jimsmitherwatercolors.com/test404page.js
HTTP/1.1 404 Not Found
Cache-Control: private
Connection: close
Date: Sun, 31 Aug 2014 05:43:31 GMT
Location: http://fineartstudioonline.com
Server: Microsoft-IIS/6.0
Content-Length: 18
Content-Type: text/html
X-Powered-By: ASP.NET
clean
http://fineartstudioonline.com/test404page.js
HTTP/1.1 301 Moved Permanently
Cache-Control: private
Connection: close
Date: Sun, 31 Aug 2014 05:43:29 GMT
Location: http://faso.com/test404page.js
Server: Microsoft-IIS/6.0
Content-Length: 0
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCADSRDBD=IKAJFAABGOLOAJGAGFBMNPHN; path=/
X-Powered-By: ASP.NET
clean
http://faso.com/test404page.js
404 Not Found
Content-Length: 12068
Content-Type: text/html
clean
http://faso.com//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js/
404 Not Found
Content-Length: 12068
Content-Type: text/html
clean
http://faso.com.edgesuite.net/static/js/jquery.cookie.js
200 OK
Content-Length: 4341
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/easySlider1.7.js
200 OK
Content-Length: 7060
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/signup.js
200 OK
Content-Length: 1739
Content-Type: application/x-javascript
clean
http://faso.com/static/js/tipsy.js
200 OK
Content-Length: 10043
Content-Type: application/x-javascript
clean
https://static.getclicky.com/js
200 OK
Content-Length: 17505
Content-Type: application/x-javascript
clean
http://data.fineartstudioonline.com/admin/analytics/analytics.js
200 OK
Content-Length: 1366
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

function qsrequest( name )
{
name = name.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");
var regexS = "[\\?&]"+name+"=([^&#]*)";
var regex = new RegExp( regexS );
var results = regex.exec( window.location.href );
if( results == null )
return "";
else
return results[1];
}

var promo=encodeURIComponent(qsrequest('promo'));
var url=encodeURIComponent(document.location.href);
var title=encodeURIComponent
... 379 bytes are skipped ...
r/>


if(window.location.hash) {
var hash = window.location.hash.substring(1); var str_fcid = hash;
var ary_fcid = str_fcid.split('fcid=');
fcid = ary_fcid[1];
}



document.write('<iframe src="http://data.fineartstudioonline.com/admin/analytics/?ref=' + refurl + '&url=' + url +'&promo=' + promo + '&gclid=' + gclid + '&fcid=' + fcid + '" width="0px" height="0px"></iframe>');

Antivirus reports:

nProtect
Trojan.Iframe.ACG
TrendMicro-HouseCall
Mal_Hifrm
Emsisoft
Trojan.Iframe.ACG (B)
TrendMicro
Mal_Hifrm
MicroWorld-eScan
Trojan.Iframe.ACG
F-Secure
Trojan.Iframe.ACG
VIPRE
Malware.JS.Generic (JS)
GData
Trojan.Iframe.ACG
BitDefender
Trojan.Iframe.ACG

http://data.fineartstudioonline.com/styles/default/fasostatsexternal.js
200 OK
Content-Length: 4733
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/bd.js
200 OK
Content-Length: 229
Content-Type: application/x-javascript
clean
http://faso.com/blog
200 OK
Content-Length: 32354
Content-Type: text/html
clean
http://faso.com/static/js/jquery.js
200 OK
Content-Length: 54267
Content-Type: application/x-javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: jimsmitherwatercolors.com

Result:
HTTP/1.1 404 Not Found
Cache-Control: private
Connection: close
Date: Sun, 31 Aug 2014 05:43:28 GMT
Location: http://fineartstudioonline.com
Server: Microsoft-IIS/6.0
Content-Length: 18
Content-Type: text/html
X-Powered-By: ASP.NET

...18 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: jimsmitherwatercolors.com
Referer: http://www.google.com/search?q=jimsmitherwatercolors.com

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=jimsmitherwatercolors.com

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://jimsmitherwatercolors.com/

Result: jimsmitherwatercolors.com is not infected or malware details are not published yet.