New scan:

Malware Scanner report for ncsa.edu.pk

Malicious/Suspicious/Total urls checked
1/0/8
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
Found
Probably the website is defaced. The following signature was found:

Hacked by Mr. DellatioNx196 - Indonesian Cyber Freedom  (44 websites defaced)

See details below

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://www.ncsa.edu.pk/
200 OK
Content-Length: 15110
Content-Type: text/html
suspicious
Malicious code - confirmed by antiviruses (see below)




<!-- Cieee Mau Copas yah GOBLOK ! ! ! ! ANJENKK WKWK :))) -->
<!--
document.write(unescape('%3C%68%74%6D%6C%3E%3C%68%65%61%64%3E%0A%0A%0A%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%4A%61%76%61%53%63%72%69%70%74%22%3E%20%0A%76%61%72%20%6E%75%6D%72%61%69%6E%64%72%6F%70%73%3D%22%31%35%30%22%3B%0A%76%61%72%20%73%70%65%65%64%3D%22%35%22%3B%0A%76%61%72%20%72%61%69%6E%73%69%7A%65%3D%22%32%22%3B%0A%76%61%72%20%77%69%6E%64%3D%22%6C%65%66%74%22%3B%0A%76%61%7
... 3029 bytes are skipped ...
%65%6E%74%2E%74%69%74%6C%65%20%3D%20%74%62%35%5F%73%74%73%6D%73%67%3B%20%6E%2B%2B%3B%20%7D%20%74%62%35%5F%74%69%6D%65%72%49%44%20%3D%20%73%65%74%54%69%6D%65%6F%75%74%28%22%74%62%35%5F%69%6E%69%74%28%22%2B%6E%2B%22%29%22%2C%20%74%62%35%5F%73%70%29%3B%0A%7D%0A%66%75%6E%63%74%69%6F%6E%20%74%62%35%5F%72%61%6E%64%6F%6D%69%7A%65%74%69%74%6C%65%28%29%7B%20%74%62%35%5F%69%6E%69%74%28%30%29%3B%0A%7D%0A%74%62%35%5F%72%61%6E%64%6F%6D%69%7A%65%74%69%74%6C%65%28%29%3B%0A%0A%3C%2F%73%63%72%69%70%74%3E%20'));

Antivirus reports:

Jiangmin
Trojan/Script.Gen

Deface/Content modification. The following signature was found: Hacked by Mr. DellatioNx196 - Indonesian Cyber Freedom

...[5330 bytes skipped]...
9%7A%65%74%69%74%6C%65%28%29%7B%20%74%62%35%5F%69%6E%69%74%28%30%29%3B%0A%7D%0A%74%62%35%5F%72%61%6E%64%6F%6D%69%7A%65%74%69%74%6C%65%28%29%3B%0A%0A%3C%2F%73%63%72%69%70%74%3E%20'));
//-->
</Script>


<meta name="robots" content="index, follow">
<link rel="SHORTCUT ICON" href="http://i.imgur.com/QYUFm5u.png"/>
<meta name="description" content="Hacked by Mr. DellatioNx196 - Indonesian Cyber Freedom"/>
<meta name="googlebot" content="index,follow"/>
<meta name="robots" content="all"/>
<meta name="robots schedule" content="auto"/>
<meta name="distribution" content="global"/>
<base target='_blank'/>

</head>


<title>./Hacked by Mr. DellatioNx196 | Indonesian Cyber Freedom</title>






<meta name="description" con
...[9561 bytes skipped]...


http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
200 OK
Content-Length: 72174
Content-Type: text/javascript
clean
http://jqueryrotate.googlecode.com/svn/trunk/jQueryRotate.js
200 OK
Content-Length: 13892
Content-Type: text/plain
clean
http://jqueryrotate.googlecode.com/test404page.js
404 Not Found
Content-Length: 1439
Content-Type: text/html
clean
http://jqueryrotate.googlecode.com//www.google.com/
404 Not Found
Content-Length: 1425
Content-Type: text/html
clean
http://www.p0wersurge.com/js/jquery-css-transform.js
200 OK
Content-Length: 4109
Content-Type: text/javascript
clean
http://www.p0wersurge.com/js/rotate3Di.js
200 OK
Content-Length: 5389
Content-Type: text/javascript
clean
http://www.ncsa.edu.pk//www.google.com/
404 Not Found
Content-Length: 332
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: ncsa.edu.pk

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: ncsa.edu.pk
Referer: http://www.google.com/search?q=ncsa.edu.pk

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=ncsa.edu.pk

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://ncsa.edu.pk/

Result: ncsa.edu.pk is not infected or malware details are not published yet.