我是管理 Web 服务器的新手,我维护服务器并确保服务器适用于其他 Web 程序员,我发现了一个可能是恶意的 js 文件,我检查了 Web 服务器日志,该 JS 文件包含在我没有的站点中不知道,网络日志的部分:
[23/Dec/2012:04:03:59 +0800] "GET /l/zj.js HTTP/1.0" 200 52591 "http://www.observechina.net/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; KB974488)"
[23/Dec/2012:04:10:37 +0800] "GET /l/zj.js HTTP/1.0" 304 - "http://www.observechina.net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
[23/Dec/2012:04:10:39 +0800] "GET /l/zj.js HTTP/1.0" 304 - "http://www.observechina.net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
[23/Dec/2012:04:12:03 +0800] "GET /l/zj.js HTTP/1.1" 200 52591 "http://www.observechina.net/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; @h%Ag|1%|x/O{ZqBsQ_R{=q?TnQk+&rpJrB-+_; msn OptimizedIE8;ZHCN; .NET CLR 2.0.50727) AppEngine-Google; (+http://code.google.com/appengine; appid: zqbah3)"
JS文件是:
https://docs.google.com/document/d/1IGLK5OlrgsSregEo8AahlyhcjgUJgftQ6Imm8NIZjWM/edit
JS文件真的是恶意的吗?我删了吗??