Invasione non autorizzata di newrelic.com

Fabrizio Fiorita · 22 Gen 2014

Buon giorno (e buon anno)!
I miei computers - fisso e due portatili - sono stati "invasi" da newrelic.com che inserisce in tutte le pagine web che apro, dopo gli ultimi dati, un sostanzioso pacchetto di javascript destinato a far apparire dei popup pubblicitari.
In ogni pagina è possbile disattivare - temporaneamente o definitivamente e solo per quella pagina - la visualizzazione dei popup, ma il codice JS resta nel sorgente.
Non sono stato in grado, né esaminando i cookies né facendo fare da avast la bonifica dei browsers, ad eliminare il problema.
Ecco il codice incriminato:

Codice:

<script type="text/javascript">
if(!NREUMQ.f){NREUMQ.f=function(){NREUMQ.push(["load",new Date().getTime()]);var e=document.createElement("script");e.type="text/javascript";e.src=(("http:"===document.location.protocol)?"http:":"https:")+"//"+"js-agent.newrelic.com/nr-100.js";document.body.appendChild(e);if(NREUMQ.a)NREUMQ.a();};NREUMQ.a=window.onload;window.onload=NREUMQ.f;};NREUMQ.push(["nrfj","beacon-2.newrelic.com","2cf250c4fa","2411389","b1EAMktQWxBUUBdbWVYbNxRQHlwNUVYbHEZQRA==",0,3718,new Date().getTime(),"","","","",""]);
</script>
<script type="text/javascript" src="http://js-agent.newrelic.com/nr-100.js">
var NR_QUEUE=[];"undefined"!=typeof window.NREUMQ?NR_QUEUE=NREUMQ:"undefined"!=typeof window.EPISODES?NR_QUEUE=EPISODES.q:"undefined"!=typeof window.NREUM&&(NR_QUEUE=NREUM.q);var NREUM=NREUM||{};NREUM.q=NR_QUEUE,NREUM.targetOrigin=document.location.protocol+"//"+document.location.host,NREUM.version=42,NREUM.autorun="undefined"!=typeof NREUM.autorun?NREUM.autorun:!0,NREUM.init=function(){NREUM.dataSent=!1,NREUM.jsonp=!1,NREUM.beaconToken=null,NREUM.navCookie=!0,NREUM.bDone=!1,NREUM.cycle=0,NREUM.logging=!1,NREUM.contentLoadFired=!1,NREUM.marks={},NREUM.measures={},NREUM.starts={},NREUM.findStartTime(),NREUM.load=null,NREUM.extra=null,NREUM.addEventListener("beforeunload",NREUM.beforeUnload,!1),NREUM.addEventListener("pagehide",NREUM.beforeUnload,!1),NREUM.processQ(),NREUM.beacon=null,NREUM.licenseKey=null,NREUM.applicationID=null,NREUM.transactionName=null,NREUM.agentToken=null,NREUM.txnParam=null,NREUM.unloaded=!1,"complete"===document.readyState?NREUM.domContentLoaded():"undefined"!=typeof document.addEventListener?document.addEventListener("DOMContentLoaded",NREUM.domContentLoaded,!1):"undefined"!=typeof document.attachEvent&&document.attachEvent("onreadystatechange",NREUM.readyStateChange),NREUM.load||document.loaded?NREUM.onload():NREUM.addEventListener("load",NREUM.onload,!1)},NREUM.processQ=function(){var a,b,c,d=NREUM.q.length;for(c=0;d>c;c++){switch(a=NREUM.q[c],b=null,a[0]){case"mark":NREUM.mark(a[1],a[2]);break;case"measure":NREUM.measure(a[1],a[2],a[3]);break;case"done":NREUM.done(a[1]);break;case"nrf":case"nrfinish":b="t";break;case"nrf2":case"nrfinish2":b="to";break;case"nrfj":b="to",NREUM.jsonp=parent==self;break;case"nrfjx":NREUM.jsonp=parent==self;case"nrf2x":NREUM.nrfinish("to",a[1],a[2],a[3],a[4],a[5],a[6],a[7],a[8],a[9],null,null,null,a[10]);break;case"load":NREUM.load=a[1];break;default:NREUM.dprint("Unknown queue command "+a[0])}b&&NREUM.nrfinish(b,a[1],a[2],a[3],a[4],a[5],a[6],a[7],a[8],a[9],a[10],a[11],a[12],null)}},NREUM.nrfinish=function(a,b,c,d,e,f,g,h,i,j,k,l,m,n){NREUM.dprint("NREUM: finish data received"),NREUM.txnParam=a,NREUM.beacon=b,NREUM.licenseKey=c,NREUM.applicationID=d,NREUM.transactionName=e,NREUM.tt_guid=i,NREUM.user=k,NREUM.account=l,NREUM.product=m,NREUM.extra=n,NREUM.measures.qt=f,NREUM.measures.ap=g,NREUM.dom_end_time=h,NREUM.agentToken=j},NREUM.mark=function(a,b){return NREUM.dprint("NREUM.mark: "+a+", "+b),a?(NREUM.marks[a]=parseInt(b||(new Date).getTime(),10),"firstbyte"===a?(NREUM.measure("be","starttime","firstbyte"),NREUM.dom_start_time=NREUM.marks.firstbyte):"onload"===a?NREUM.measure("fe","firstbyte","onload"):"domContent"===a&&NREUM.measure("dc","firstbyte","domContent"),void 0):(NREUM.dprint("Error: markName is undefined in NREUM.mark."),void 0)},NREUM.measure=function(a,b,c){if(NREUM.dprint("NREUM.measure: "+a+", "+b+", "+c),!a)return NREUM.dprint("Error: episodeName is undefined in NREUM.measure."),void 0;var d;if("undefined"==typeof b)d="number"==typeof NREUM.marks[a]?NREUM.marks[a]:(new Date).getTime();else if("number"==typeof NREUM.marks[b])d=NREUM.marks[b];else{if("number"!=typeof b)return NREUM.dprint("Error: unexpected startNameOrTime in NREUM.measure: "+b),void 0;d=b}var e;if("undefined"==typeof c)e=(new Date).getTime();else if("number"==typeof NREUM.marks[c])e=NREUM.marks[c];else{if("number"!=typeof c)return NREUM.dprint("NREUM: Error: unexpected endNameOrTime in NREUM.measure: "+c),void 0;e=c}NREUM.starts[a]=parseInt(d,10),NREUM.measures[a]=parseInt(e-d,10)},NREUM.done=function(a){NREUM.bDone||(NREUM.bDone=!0,NREUM.mark("done"),NREUM.autorun&&NREUM.sendBeacon(),"function"==typeof a&&a())},NREUM.getMarks=function(){return NREUM.marks},NREUM.getMeasures=function(){return NREUM.measures},NREUM.getStarts=function(){return NREUM.starts},NREUM.sendBeacon=function(){if(!NREUM.dataSent){if(NREUM.dataSent=!0,NREUM.processQ(),NREUM.domContentLoaded(),null===NREUM.licenseKey||null===NREUM.applicationID)return NREUM.dprint("NREUM: licenseKey or applicationID has not been set"),void 0;NREUM.dom_end_time&&NREUM.dom_start_time&&(NREUM.dprint("NREUM: picking up DOM processing time from embedded JS"),NREUM.mark("domContent",NREUM.dom_end_time)),NREUM.load&&(NREUM.dprint("NREUM: picking up load event time from embedded JS"),NREUM.mark("onload",NREUM.load));var a,b=NREUM.getMeasures(),c="";for(a in b)c+="&"+a+"="+b[a];var d;if(c){var e="1";d=("http:"===document.location.protocol?"http:":"https:")+"//"+NREUM.beacon+"/"+e+"/"+NREUM.licenseKey,d+="?a="+NREUM.applicationID,d+=c,d+=NREUM.getParam(NREUM.txnParam,NREUM.transactionName),d+=NREUM.getParam("tt",NREUM.tt_guid),d+=NREUM.getParam("us",NREUM.user),d+=NREUM.getParam("ac",NREUM.account),d+=NREUM.getParam("pr",NREUM.product),d+=NREUM.getParam("tk",NREUM.agentToken),d+="&v="+NREUM.version,d+=NREUM.getParam("xx",NREUM.extra),NREUM.jsonp&&(d+="&jsonp=NREUM.setToken");var f=NREUM.getPerformance();if(f){var g={};g.timing=NREUM.addPT(f.timing,{}),g.navigation=NREUM.addPN(f.navigation,{}),d+=NREUM.getParam("perf",NREUM.stringify(g))}if(NREUM.jsonp){var h=document.createElement("script");h.type="text/javascript",h.src=d,document.body.appendChild(h)}else{var i=new Image;i.src=d}NREUM.dprint("NREUM: (new) data sent",d)}}},NREUM.getParam=function(a,b){return null!=b&&b.length>0?"&"+a+"="+encodeURIComponent(b):""},NREUM.addPT=function(a,b){var c=a.navigationStart;return b.of=c,NREUM.addRel(a.navigationStart,c,b,"n"),NREUM.addRel(a.unloadEventStart,c,b,"u"),NREUM.addRel(a.unloadEventEnd,c,b,"ue"),NREUM.addRel(a.domLoading,c,b,"dl"),NREUM.addRel(a.domInteractive,c,b,"di"),NREUM.addRel(a.domContentLoadedEventStart,c,b,"ds"),NREUM.addRel(a.domContentLoadedEventEnd,c,b,"de"),NREUM.addRel(a.domComplete,c,b,"dc"),NREUM.addRel(a.loadEventStart,c,b,"l"),NREUM.addRel(a.loadEventEnd,c,b,"le"),NREUM.addRT(a,b,c),b},NREUM.addPN=function(a,b){return NREUM.addRel(a.type,0,b,"ty"),NREUM.addRel(a.redirectCount,0,b,"rc"),b},NREUM.addRT=function(a,b,c){var d;return c?d=c:(d=a.startTime,b.of=d),NREUM.addRel(a.redirectStart,d,b,"r"),NREUM.addRel(a.redirectEnd,d,b,"re"),NREUM.addRel(a.fetchStart,d,b,"f"),NREUM.addRel(a.domainLookupStart,d,b,"dn"),NREUM.addRel(a.domainLookupEnd,d,b,"dne"),NREUM.addRel(a.connectStart,d,b,"c"),NREUM.addRel(a.connectEnd,d,b,"ce"),NREUM.addRel(a.secureConnectionStart,d,b,"s"),NREUM.addRel(a.requestStart,d,b,"rq"),NREUM.addRel(a.responseStart,d,b,"rp"),NREUM.addRel(a.responseEnd,d,b,"rpe"),c||(b.n=a.name,b.st=a.startTime-d,b.it=a.initiatorType,b.du=a.duration),b},NREUM.addRel=function(a,b,c,d){"number"==typeof a&&a>0&&(c[d]=a-b)},NREUM.setToken=function(a){NREUM.dprint("NREUM: trace "+a),NREUM.beaconToken=a},NREUM.inlineHit=function(a,b,c,d,e,f){if(NREUM.cycle+=1,null===NREUM.licenseKey||null===NREUM.applicationID)return NREUM.dprint("NREUM: licenseKey or applicationID has not been set"),void 0;var g=new Image,h=("http:"===document.location.protocol?"http:":"https:")+"//"+NREUM.beacon+"/1/"+NREUM.licenseKey;h+="?a="+NREUM.applicationID+"&",h+="t="+a+"&",h+="qt="+b+"&",h+="ap="+c+"&",h+="be="+d+"&",h+="dc="+e+"&",h+="fe="+f+"&",h+="c="+NREUM.cycle,g.src=h,NREUM.dprint("NREUM Inline: "+h)},NREUM.findStartTime=function(){var a=NREUM.findStartWebTiming()||NREUM.findStartGToolbar()||NREUM.findStartCookie();a?NREUM.mark("starttime",a):NREUM.dprint("NREUM: Error: couldn't find a start time")},NREUM.findStartWebTiming=function(){var a;if(/Firefox[\/\s](\d+\.\d+)/.test(navigator.userAgent)){var b=new Number(RegExp.$1);if(9>b)return a}var c=NREUM.getPerformance();return c&&"undefined"!=typeof c.timing.navigationStart&&(a=c.timing.navigationStart,NREUM.dprint("NREUM.findStartWebTiming: startTime = "+a)),a&&(NREUM.navCookie=!1),a},NREUM.getPerformance=function(){var a=window.performance||window.mozPerformance||window.msPerformance||window.webkitPerformance;return"undefined"!=typeof a&&"undefined"!=typeof a.timing?a:null},NREUM.findStartGToolbar=function(){var a,b;try{window.external&&window.external.pageT?a=window.external.pageT:window.gtbExternal&&window.gtbExternal.pageT?a=window.gtbExternal.pageT():window.chrome&&window.chrome.csi&&(a=window.chrome.csi().pageT),a&&6e4>a&&(b=(new Date).getTime()-a,NREUM.dprint("NREUM.findStartGToolbar: startTime = "+b))}catch(c){}return b&&(NREUM.navCookie=!1),b},NREUM.findStartCookie=function(){var a,b,c=document.cookie.split(" ");for(a=0;a<c.length;a++)if(0===c[a].indexOf("NREUM=")){var d,e,f,g,h=c[a].substring("NREUM=".length).split("&");for(b=0;b<h.length;b++)0===h[b].indexOf("s=")?f=h[b].substring(2):0===h[b].indexOf("h=")?(f=h[b].substring(2),NREUM.measure("ph",0,1)):0===h[b].indexOf("p=")?(e=h[b].substring(2),";"===e.charAt(e.length-1)&&(e=e.substr(0,e.length-1))):0===h[b].indexOf("r=")&&(d=h[b].substring(2),";"===d.charAt(d.length-1)&&(d=d.substr(0,d.length-1)));if(d){var i=NREUM.sHash(document.referrer);g=i==d,g||(g=NREUM.sHash(document.location.href)==d&&i==e)}if(g&&f){var j=(new Date).getTime();return j-f>6e4?(NREUM.dprint("NREUM.findStartCookie: startTime > 60s old - ignored"),void 0):(NREUM.dprint("NREUM.findStartCookie: startTime = "+f),f)}}return void 0},NREUM.beforeUnload=function(a){if(!NREUM.unloaded){var b="s";"pagehide"===a.type&&(b="h"),NREUM.navCookie&&(document.cookie="NREUM="+b+"="+Number(new Date)+"&r="+NREUM.sHash(document.location.href)+"&p="+NREUM.sHash(document.referrer)+"; path=/"),NREUM.beaconToken&&(document.cookie="NRAGENT=tk="+NREUM.beaconToken+"; max-age=1; path=/"),NREUM.unloaded=!0}},NREUM.onload=function(){NREUM.mark("onload"),NREUM.autorun&&NREUM.done()},NREUM.domContentLoaded=function(){NREUM.contentLoadFired||(NREUM.mark("domContent",(new Date).getTime()),NREUM.contentLoadFired=!0)},NREUM.readyStateChange=function(){"complete"===document.readyState&&NREUM.domContentLoaded()},NREUM.addEventListener=function(a,b,c){return"undefined"!=typeof window.attachEvent?window.attachEvent("on"+a,b):window.addEventListener?window.addEventListener(a,b,c):void 0},NREUM.sHash=function(a){var b,c=0;for(b=0;b<a.length;b++)c+=(b+1)*a.charCodeAt(b);return Math.abs(c)},NREUM.stringify=function(a){var b=typeof a;switch(b){case"string":return'"'+a+'"';case"boolean":case"number":return String(a);case"object":if(null===a)return"null";var c=!1,d="";for(prop in a){var e=String(prop),f=NREUM.stringify(a[prop]);f.length>0&&(c?d+=", ":c=!0,d+=a instanceof Array?f:'"'+e+'":'+f)}return a instanceof Array?"["+d+"]":"{"+d+"}";default:return""}},NREUM.dprint="undefined"!=typeof console&&"undefined"!=typeof console.log?function(a){NREUM.logging&&console.log(a)}:function(){},NREUM.init();
</script>
<script type="text/javascript" src="http://beacon-2.newrelic.com/1/2cf250c4fa?a=2411389&be=4308&qt=0&ap=3718&dc=6447&fe=7217&to=b1EAMktQWxBUUBdbWVYbNxRQHlwNUVYbHEZQRA%3D%3D&v=42&jsonp=NREUM.setToken&perf=%7B%22timing%22%3A%7B%22of%22%3A1390389486058%2C%20%22n%22%3A0%2C%20%22u%22%3A4182%2C%20%22ue%22%3A4209%2C%20%22dl%22%3A4182%2C%20%22di%22%3A10754%2C%20%22ds%22%3A10837%2C%20%22de%22%3A10858%2C%20%22dc%22%3A11461%2C%20%22l%22%3A11461%2C%20%22le%22%3A11528%2C%20%22f%22%3A2%2C%20%22dn%22%3A3%2C%20%22dne%22%3A3%2C%20%22c%22%3A2%2C%20%22ce%22%3A2%2C%20%22rq%22%3A19%2C%20%22rp%22%3A4095%2C%20%22rpe%22%3A4199%7D%2C%20%22navigation%22%3A%7B%7D%7D">
NREUM.setToken("8a5d9e2eda00e24f")
</script>
<div id="SL_shadow_translator">
<div id="SL_shadow_balloon" style="display: none; top: -10000px; left: -10000px;">
<div id="SLplanshet">
<div id="SLarrowTOP"></div>
<div id="SLtopbar" align="left">
</div>
<div id="SL_result" class="SL_sesultLTRRTL" style="font-size: 13px;"></div>
<div id="SL_small_options_switch" class="SL_small_options_switch_off" title="Show options"></div>
<div id="SL_small_tooltips_switch" class="SL_small_tooltips_switch_on" title="Hide tooltips"></div>
<div id="SL_small_options" style="display:none;">
<div id="SL_small_tooltips">
Like our service? Make a small contribution
<div id="SLDONATE" title="Make a small contribution"></div>
</div>
<div id="SLarrowBOT"></div>
</div>
</div>

Ovvio che io non ho mai né chiesto né autorizzato l'intrusione.
Qualcuno può darmi un'idea sull'eliminazione di questo codice?
Grazie
Fabrizio

coolnetwork · 22 Gen 2014

lo fa con browser diversi?

Fabrizio Fiorita · 22 Gen 2014

coolnetwork ha scritto:
lo fa con browser diversi?

Con IE, Firefox e Chrome. Ho anche Opera, Maxthon3 e Safari, ma non li ho verificati, lo farò più tardi.

coolnetwork · 22 Gen 2014

ma lo fa con tutti i siti che apri oppure solo con i tuoi?

glm1986ITALY · 22 Gen 2014

Uhm... questa mi pare proprio strana... se si trova nel codice sorgente, imho, il problema è nel sito non nel pc

Puoi postare i link? (magari non rendendoli cliccabili)

Fabrizio Fiorita · 22 Gen 2014

coolnetwork ha scritto:
ma lo fa con tutti i siti che apri oppure solo con i tuoi?

Con tutti i siti.

Fabrizio Fiorita · 22 Gen 2014

glm2006ITALY ha scritto:
Uhm... questa mi pare proprio strana... se si trova nel codice sorgente, imho, il problema è nel sito non nel pc

Puoi postare i link? (magari non rendendoli cliccabili)

Si trova nel codice sorgente di destinazione, non in quello di origine. Poi riguarda qualsasi pagina io apra, non solo le mie.
Quindi inutile postare l'indirizzo, i codici sul server sono puliti: comunque http://www.sipbc.it

glm1986ITALY · 23 Gen 2014

Beh.... con un rescue CD di Avira o Kaspersky non risolvi?

Prima una "passata" con MBAM e Supera poi il rescue CD :fonzie:

Cerca

Cerca

Invasione non autorizzata di newrelic.com

Fabrizio Fiorita

Utente Attivo

coolnetwork

Utente Attivo

Fabrizio Fiorita

Utente Attivo

coolnetwork

Utente Attivo

glm1986ITALY

Moderatore

Fabrizio Fiorita

Utente Attivo

Fabrizio Fiorita

Utente Attivo

glm1986ITALY

Moderatore

Discussioni simili