See: https://www.virustotal.com/nl/url/6871341170567f560a8a97b5dc333049909fca3e77bce4ce8952b7c67512a7fe/analysis/1391171680/
and http://urlquery.net/report.php?id=9143743 (detected malicious iFrame injection) - trojan downloader
→ http://jsunpack.jeek.org/?report=c52c4f98f6285dc9f895cfe0d8f0d6ea43f67320
htxp://simplechic.pl/translations/mfBgjs2J.php?id=58513181 blocked by Google-Safebrowsing.
Three malicious files detected:
/js/jquery-1.3.2.min.js
Severity: Malicious
Reason: Detected encoded JavaScript code commonly used to hide malicious behaviour.
Details: Malicious
Offset: 56115
Threat dump: View code → http://jsunpack.jeek.org/?report=610352f317b1418c42e2fc016f284ddedb9faacc
File size[byte]: 57402
File type: ASCII
MD5: CAAB8DDA66A15C652CE16C7450A6FE89
Scan duration[sec]: 2.754000
Similar for /js/jquery.easing.js & /js/script.js etc. → http://sitecheck.sucuri.net/results/germany5.com
INDEX[6].PHP Information and Removal:
The file INDEX[6].PHP is identified as the Trojan Program that is used for stealing bank information and users passwords,
when an attacker is getting in via the server there is only little the website owner can do.
See first results here: http://support.clean-mx.de/clean-mx/viruses.php?ns3=ns2.vkontakte.ru&sort=id%20DESC&response=alive
malcode up and alive and long OVERDUE!
polonus