全球主机交流论坛

 找回密码
 注册

QQ登录

只需一步,快速开始

IP归属甄别会员请立即修改密码
12
返回列表 发新帖
楼主: winday
打印 上一主题 下一主题

[Windows VPS] CNZZ被挂马了吗,总是弹出下载一个PHP文件?艹艹艹

[复制链接]
11#
发表于 2015-8-25 17:40:41 | 只看该作者
我也刚刚发现 **我还说啥情况呢

  1. <html>
  2.     <body>      
  3. <script type="text/javascript">
  4. !function(a,b){var j,k,l,m,n,o,p,q,r,s,t,u,c=["acookie","nickname","token","lastTime","tokenLastTime","request"],d={aid:"",aid_tanx:"http://a.tanx.com/tanx/img",aid_cnzz:"http://aid.cnzz.com/cnzz/img",reportToken:"http://jsonp.aid.alibaba.com/Umid/getDeviceInfo",umservice:"https://ynuf.alipay.com/service/um.json",umjs:"https://assets.alicdn.com/g/security/umscript/2.0.12/um.js"},e=36e5,f={aid:12*e,aidSecond:4e3,token:360*e,reportDelay:500,reportDelaySecond:3e3},g=["1688.com","alibaba.com","alimama.com","aliloan.com","alipay.com","aliyun.com","cnzz.com","etao.com","hichina.com","hitao.com","juhuasuan.com","net.cn","phpwind.com","tao123.com","taobao.com","tmall.com","tmall.hk","taohua.com"],h=function(c,d){return{guid:function(a){var d,b=[],c="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";for(d=(a||32)-1;d>-1;d--)b[d]=c.charAt(Math.random()*c.length);return b.join("")},getDelay:function(a){var b="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",c=b.indexOf(a),d=36e5;return 0>c&&(c=0),c*d+Math.floor(Math.random()*d)},requestImg:function(b,c){var f,d=[],e=a["img_"+this.guid(8)]=new Image;if(c&&"object"==typeof c)for(f in c)d[d.length]=f+"="+encodeURIComponent(c[f]);d.length&&(b+=(b.indexOf("?")>-1?"&":"?")+d.join("&")),e.src=b},jsonp:function(c,d,e){var g,h,i,j,f="fn_"+this.guid(8);a[f]=function(c){"function"==typeof e&&e(c);var d,g;delete a[f],(d=i||b.getElementById("id_"+f))&&(g=d.parentNode,g&&11!=g.nodeType&&g.removeChild(d)),d=i=null},g=["_cbFunction="+f],d=d||{};for(h in d)g[g.length]=h+"="+encodeURIComponent(d[h]);i=b.createElement("SCRIPT"),i.type="text/javascript",i.id="id_"+f,c+=-1===c.indexOf("?")?"?":"&",i.src=c+g.join("&"),j=b.getElementsByTagName("HEAD"),j&&j[0]&&j[0].appendChild(i)},stringify:function(a){var c,b=new Array(d.length);for(c=0;c<d.length;c++)b[c]=a[d[c]];return b.join(",")},parse:function(a){var e,b={},c=a.split(",");for(e=0;e<d.length;e++)b[d[e]]=c[e];return b},getHostFromURL:function(a){if(/https?:\/\/([^:\/]+)(:|\/)/.test(a)){a=RegExp.$1;var b=a.split(".");return b.length<=2?b.join("."):b.slice(1).join(".")}return""},reportUM:function(e,i){var j,k;b.getElementById("_umfp")||(j=b.createElement("DIV"),j.id="_umfp",j.style.width="1px",j.style.height="1px",j.style.overflow="hidden",b.body.appendChild(j),k=b.createElement("SCRIPT"),k.type="text/javascript",k.charset="utf-8",k.onload=k.onreadystatechange=function(){var l,m;if(!this.readyState||"loaded"==this.readyState||"complete"==this.readyState){if(!k)return;k.onload=k.onreadystatechange=null,l=b.getElementById("_umfp"),a.um&&um.init({appName:"aliyun_aid",enableMod:g.join("").indexOf(i)>-1,serviceUrl:c.umservice,token:e,timeout:1500,timestamp:(new Date).getTime(),containers:{flash:l,dcp:l}}),m=!0,a.setTimeout(function(){h.jsonp(c.reportToken,{tokenid:e,acookie:d.acookie,n:1},function(a){m=!(h.firstUM=!(!a||!a.result))})},f.reportDelay),a.setTimeout(function(){m&&h.jsonp(c.reportToken,{tokenid:e,acookie:d.acookie,n:2},function(a){h.secondUM=!(!a||!a.result)})},f.reportDelay+f.reportDelaySecond),j=null,k=null}},k.src=c.umjs,b.getElementsByTagName("HEAD")[0].appendChild(k))}}}(d,c),i=function(c){var d,f=a.navigator,g=f.cookieEnabled,h=/msie (\d+\.\d)/i.test(f.userAgent),i="localStorage"in a&&null!==a.localStorage;if(h)try{d=b.createElement("INPUT"),d.type="hidden",d.style.display="none",d.addBehavior("#default#userData"),b.body.appendChild(d)}catch(j){h=!1}return{get:function(a){var b=this.getStorage(a)||this.getCookie(a)||this.getUserData(a)||null;return b},set:function(a,b){var d,c=!1;return g&&(d=new Date,d.setTime(d.getTime()+8760*e),this.setCookie(a,b,{expires:d}),g=c=this.getCookie(a)==b),i&&(this.setStorage(a,b),i=c=this.getStorage(a)==b),!c&&h&&(this.setUserData(a,b),h=c=this.getUserData(a)==b),c},clear:function(b){b=b||"_lastvisited",g&&this.setCookie(b,"",{expires:new Date(1)}),i&&a.localStorage.removeItem(b)},getCookie:function(a){var c=new RegExp("(^| )"+a+"=([^;]*)(;|$)"),d=b.cookie.match(c);return d?decodeURIComponent(d[2])||null:null},setCookie:function(a,c,d){b.cookie=a+"="+encodeURIComponent(c)+("; path="+((d=d||{}).path||"/"))+(d.expires?"; expires="+d.expires.toGMTString():"")+(d.domain?"; domain="+d.domain:"")+(d.secure?"; secure":"")},getStorage:function(b){var c=null;return i&&(c=a.localStorage.getItem(b)),c},setStorage:function(b,c){i&&a.localStorage.setItem(b,c)},getUserData:function(a){return h?(d.load(c.host),d.getAttribute(a)||null):void 0},setUserData:function(a,b){if(h)try{d.load(c.host),d.setAttribute(a,b),d.save(c.host)}catch(e){h=!1}}}}(c);if("https:"!==a.location.protocol){switch(j=c,j.now=new Date,j.times=j.now.getTime(),j.request=0,j.host=h.getHostFromURL(a.location.href),j.domain=h.getHostFromURL(b.referrer||""),j.acookie=i.getCookie("cna"),j.nickname=i.getCookie("nickname"),j.host.toLowerCase()){case"tanx.com":d.aid=d.aid_tanx;break;case"cnzz.com":d.aid=d.aid_cnzz;break;default:d.aid=d.aid_tanx}(j.acookie||j.nickname)&&(k=j.nickname?"taobao_nick":j.acookie?"acookie_id":"",k&&(l=0,m=i.get("_lastvisited"),n=h.parse(m||""),m&&(m.indexOf("|+|")>-1||!n.token||!n.lastTime)&&(n={}),j.request|="nickname"==k?4:1,n.token&&n.lastTime&&n.tokenLastTime?(p=n.request||0,q=!1,r=!1,j.token=n.token,j.lastTime=n.lastTime,j.tokenLastTime=n.tokenLastTime,s=parseInt(n.tokenLastTime||0,36),j.times-s>=f.token&&(j.token=h.guid(),j.tokenLastTime=j.lastTime=j.times.toString(36),q=!0,h.reportUM(j.token,j.domain)),t=parseInt(n.lastTime||0,36),j.times-t>=f.aid&&(j.lastTime=j.times.toString(36),r=!0),j.times-t>=f.aidSecond&&(q||r||1&p&&n.acookie!=j.acookie||2&p&&n.token!=j.token||4&p&&n.nickname!=j.nickname||2!=(2&p))&&(j.request|=2,i.set("_lastvisited",h.stringify(j)),l|=1)):(j.token=h.guid(),new Date("2015-08-28").getTime()<j.times?(j.tokenLastTime=j.lastTime=j.times.toString(36),l|=3,h.reportUM(j.token,j.domain)):(o=h.getDelay(j.acookie.charAt(0)),j.tokenLastTime=(j.times-f.token+o).toString(36),j.lastTime=(j.times-f.aid+o).toString(36)),i.set("_lastvisited",h.stringify(j))),1&l&&(u={},u.type=k,u.id="taobao_nick"==k?j.nickname:j.acookie,2&l||(u.type_add="tokenid",u.id_add=j.token),u._ts="2"+h.guid(4),u.cad=i.getCookie("cad"),u.cap=i.getCookie("cap"),u.cna=i.getCookie("cna"),u._lastvisited=i.get("_lastvisited"),h.requestImg(d.aid,u))))}}(window,document);   
  5. </script>
  6.     </body>
  7. </html>
复制代码
12#
发表于 2015-8-25 17:46:48 来自手机 | 只看该作者
出问题了,严禁装逼,真的出问题了,我也遇到了
13#
 楼主| 发表于 2015-8-25 17:48:25 | 只看该作者
提示: 作者被禁止或删除 内容自动屏蔽
14#
发表于 2015-8-25 17:49:58 | 只看该作者
提示: 作者被禁止或删除 内容自动屏蔽
15#
 楼主| 发表于 2015-8-25 17:50:41 | 只看该作者
提示: 作者被禁止或删除 内容自动屏蔽
16#
发表于 2015-8-25 18:02:24 | 只看该作者
修好了吗?

现在测试了一下IE11 兼容模式打开我的网站没有提示下载什么的
17#
发表于 2015-8-25 18:09:36 | 只看该作者
所以 不用 CNZZ 好多年。  51la  +  百度  用百度统计 貌似IP会增加
18#
发表于 2015-8-25 19:58:27 | 只看该作者
欧阳逍遥 发表于 2015-8-25 18:09
所以 不用 CNZZ 好多年。  51la  +  百度  用百度统计 貌似IP会增加

51la的界面不是很好看
百度会有神秘加成
您需要登录后才可以回帖 登录 | 注册

本版积分规则

Archiver|手机版|小黑屋|全球主机交流论坛

GMT+8, 2025-9-24 06:45 , Processed in 0.164114 second(s), 8 queries , Gzip On, MemCache On.

Powered by Discuz! X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表