malicious pages and -counter.yadro.ru detected?

Viruses and worms
1

-http://onfilmz.net/news/top_20_filmov/2012-12-10-16661
200 OK
Content-Length: 47193
Content-Type: text/html
suspicious

-http://onfilmz.net/rtr/2-13
200 OK
Content-Length: 235
Content-Type: text/javascript
suspicious

See: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fonfilmz.net%2Fnews%2Ftop_20_filmov%2F2012-12-10-16661

could be part of a XSS attack that is blocked by malware Script Detector. CSS code - id used for a specific element (e.g. header, footer, sidebar).

IP badness history: https://www.virustotal.com/nl/ip-address/193.109.246.54/information/

Low detection grade here for instance: https://www.virustotal.com/nl/file/918707d9b278103ea5d370daf6399d8592e580e52e65c157d841b2ea5d3c2c7c/analysis/

Zulu Zscaler missed: http://zulu.zscaler.com/submission/show/4d4023a338e36741b12053bd8a6e97e3-1443360713
UrlQuery flags malicious counter code: https://urlquery.net/report.php?id=1443360538165

polonus (volunteer website security analyst and website error-hunter)

2

Update: Malicious/Suspicious/Total urls scanned
2 suspicious pages found. → http://killmalware.com/onfilmz.net/
Javascript Check: Suspicious

().src = “-http://counter.yadro.ru/hit;noadsru?r"+escape(document.referrer)+((typeof(screen)==“undefined”)?“”:“;s”+screen.width+"“+screen.height+””+(screen.colordepth?screen.color…

Included scripts: Suspect - please check list for unknown includes

Suspicious Script:
-http://s54.ucoz.net/src/uwnd.js?2
.ru/i)){g=1;var a=/v=([^\s&;]+)/;var d=a.exec(b.url);if(d&&d[1]){n=“http://video.rutube.ru/”+d[1];l=640;f=360}}else{if(b.url.match(/dailym

Google browser difference:
Not identical

Google: 48049 bytes Firefox: 49063 bytes
Diff: 1014 bytes

See: http://toolbar.netcraft.com/site_report?url=onfilmz.net

See malware flagged: https://urlquery.net/report.php?id=1443706144176
See: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fs54.ucoz.net%2Fsrc%2Fulightbox%2Fulightbox.js

polonus

3

About the lightbox malware alert - error when it does not load properly or infested…
https://wordpress.org/support/topic/plugin-lightbox-plus-lightbox-causing-malware-alert
The tests Lightbox performed and results: http://lightbox.en.lo4d.com/virus-malware-tests
Also read my posting on this subject here: https://forum.avast.com/index.php?topic=145921.msg1059995#msg1059995

polonus (volunteer website security analyst and website error-hunter)

4

Hello

Only Blacklist

hxxp://ucounter.ucoz.net/

https://www.virustotal.com/en/url/018577b918fe9e46f70649ede416b823fc6ef3e7ddbd99437ba13bd4ae00065c/analysis/1444006606/

https://sitecheck.sucuri.net/results/ucounter.ucoz.net

https://sitecheck.sucuri.net/results/s54.ucoz.net

Our Virus lab analyzed the URLs and blocked " hxxp://onfilmz.net ". Other URLs will remain unblocked as they are not malicious.
5

Thanks for reporting that back to us all. The blocking by Avast Technical Staff will protect all the unaware that try to venture out there. I furthermore hope that you have a great holiday and G*d bless,

polonus