Avast does not detect JS/Clicker.ACK here...

Viruses and worms
1

See: http://zulu.zscaler.com/submission/show/4449235974740da428a28e5c93c4eb60-1349090716
See: https://www.virustotal.com/file/75868c3c0a395b9abdb9cf53e3f8f006905c916aead23692334e0841f3cf1e2b/analysis/
See: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt redirects to hxtp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt/

Flagged by DrWeb’s URL checker:
Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.corner.js/JSWrite_5[b6] - Ok

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
hxtp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.hoverIntent.minified.js/JSWrite_5[b6] - Ok

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-ui-1.8.22.custom.min.js/JSWrite_5[b6] - Ok

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery.easing.1.3.js/JSWrite_5[b6] - O

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js - archive JS-HTML

ht\xp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/top.nav.js/JSWrite_5[b6] - Ok

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js/JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js/JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js/JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js/JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//js/jquery-1.7.2.min.js/JSWrite_5[b6] - Ok

Checking: htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt/
Engine version: 7.0.3.7130
Total virus-finding records: 3190993
File size: 23.37 KB
File MD5: cbad4a10e8d54a19bc6251f2678b7b8a

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt/ - archive JS-HTML

htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//JSTAG_1[746][15d3] infected with VBS.Psyme.377
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//JSTAG_2[53c4][1a6] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//JSTAG_3[5595][133] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//JSTAG_4[5d06][5e] - Ok
htxp://logopedplus.by/programms/category/logopedik/vv/oo/ff/tt//JSWrite_5[b6] - Ok

reported to virus AT avast dot com,

polonus

2

urlQuery
http://urlquery.net/report.php?id=207940
http://urlquery.net/report.php?id=207954

Sucuri
http://sitecheck.sucuri.net/results/logopedplus.by/programms/category/logopedik/vv/oo/ff/tt
http://sitecheck.sucuri.net/results/logopedplus.by/

wepawet
http://wepawet.iseclab.org/view.php?hash=edfc916fe2a120b4c5359173702826be&t=1349104061&type=js

3

The page was hacked through WP via wp header.php. Malware is hidden at the header.php inside the themes directory,
links are activated within IFrames while viewing Web content on maliciously modified pages. Alert notifications from installed antivirus software may be the only symptoms. About the obfuscated code: http://stackoverflow.com/questions/3391623/decode-some-injected-javascript
using http://coderstoolbox.net/string/

polonus