Monokai Slideshow manipulation - malware? SEO Spam infection Avast blocks!

Viruses and worms
1

:)See: https://urlquery.net/report.php?id=1441005093642
Fortinet flags as malware. 3 detect: https://www.virustotal.com/nl/url/7088b51da205c84e5c9dbcdef8ba928e1e43c8c9b841ae55481c8a7d5710f0d1/analysis/
Sucuri detects as SEO Spam: https://sitecheck.sucuri.net/results/roachbrown.binachron.com
Known Spam detected. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?sb

////////
.gjp2{position:absolute;clip:rect(408px,auto,auto,465px);} *Known javascript malware. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?g12 t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}');}xViewState();

WordPress version outdated: Upgrade required.
Outdated WordPress Found: WordPress Under 4.2
WordPress Version
3.7.10
Version does not appear to be latest 4.3 - update now.
The following plugins were detected by reading the HTML source of the WordPress sites front page.

nextgen-gallery latest release (2.1.9)
http://www.nextgen-gallery.com

WordPress Theme
The theme has been found by examining the path /wp-content/themes/ theme name /

Roach Brown 1.1http://wordpress.org/

Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.

User ID 1 : oskar
User ID 2 : Nonesed?

Missed or clean? → http://quttera.com/detailed_report/roachbrown.binachron.com
→ http://www.domxssscanner.com/scan?url=http%3A%2F%2Froachbrown.binachron.com%2F
→ -http://killmalware.com/roachbrown.binachron.com/profile/kdmccarthy/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/slideshow/monoslideshow.js

2

Avast detects JS.HideLink.A there, we are being protected, folks,

polonus

3

More PHISHing going on from that IP: https://urlquery.net/report.php?id=1440359402168
→ https://www.threatcrowd.org/ip.php?ip=97.74.141.1
http://www.scumware.org/report/97.74.141.1
http://www.nictasoft.com/ace/ip-search/?ip=97.74.141.1 (flagged by Avast as JS.HideLink.A as well :wink: )

pol