Suspected malware on site

Viruses and worms
1

See: https://www.virustotal.com/nl/url/da6f5452531fef2f5b81ca38c643fd61639af0f0acb618d9d6b00a684b2a40d1/analysis/1383061426/
Detected see: http://scanurl.net/?u=http%3A%2F%2Faskdrlindsey.com%2F&uesb=Check+This+URL#results
Quttera flags as suspicious
index
Severity: Suspicious
Reason: Detected suspicious redirection to external web resources at HTTP level.
Details: Detected HTTP redirection to htxp://drlindsey.com.
File size[byte]: 4294967295
File type: Unknown
MD5: 00000000000000000000000000000000
Scan duration[sec]: 0.001000

As potentially suspicious:
code.jquery.com/jquery-1.8.2.min.js
Severity: Potentially Suspicious
Reason: Detected procedure that is commonly used in suspicious activity.
Details: Too low entropy detected in string [[‘=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26async=%26=%26=%26=%26=%26=%260=%26=%26=%26=%26=%26=%260=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%26=%260=%26’]] of length 568 which may point to obfuscation or shellcode.
Threat dump: View code
File size[byte]: 93435
File type: ASCII
MD5: 0B6ECF17E30037994D3FFEE51B525914
Scan duration[sec]: 78.310000

polonus

2

there are some reports on same IP http://urlquery.net/report.php?id=7283410

like these
http://urlquery.net/report.php?id=5896993 / http://urlquery.net/report.php?id=4935354 / http://urlquery.net/report.php?id=4935353 / http://urlquery.net/report.php?id=4559064

VirusTotal
https://www.virustotal.com/en/file/612b165632ee67ea679ab5f05d7d8040d183be35f19883147705d31c38063e11/analysis/1383071131/

3

Hi Pondus,

avast! Web Shield blocks one of your urlquery dot net scan result with |{gzip} as infested with JS:Iframe-CSU[Trj]
This is particular WordPress malware - see> http://pastebin.com/7KZeW9jB
(Disallow WP/Admin/Disallow - WP includes - some attack code to identify what specific code is doing)
avast! Webshield also detects this malcode here: htxp://maldb.com/alevaz.com/ (server redirect flagged)

pol