php 漏洞提問 急解決思路

php 漏洞提問 急....
我們網站不知道怎麼的多了個test.php

內容如下 ：



找了很多資料，也沒看出個大概..

1. 我想知道這個一般是怎麼注入到我們網站裡的？？

2. 它主要起什麼作用？？

我們網站其它原檔案應該不會也被注入了吧...

------解決方案--------------------
1.首先在php.ini設定禁用eval函數(需確認系統中未使用此函數――普通系統很少用此函數)
2.搜尋所有訪問test.php的IP地址

搜集完資料後整理出來，報案。

BatchFile code

inetnum: 222.32.0.0 - 222.63.255.255netname: CRTCdescr: CHINA RAILWAY TELECOMMUNICATIONS CENTERdescr: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinacountry: CNadmin-c: LQ112-APtech-c: LM273-APstatus: ALLOCATED PORTABLEmnt-by: MAINT-CNNIC-APchanged: hm-changed@apnic.net 20030902source: APNICroute: 222.32.0.0/11descr: CHINA RAILWAY TELECOMMUNICATIONS CENTERcountry: CNorigin: AS9394mnt-by: MAINT-CN-CRTCchanged: ipas@cnnic.cn 20040402source: APNICperson: LV QIANGnic-hdl: LQ112-APe-mail: crnet_mgr@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51892111fax-no: +86-10-51847845country: CNchanged: ipas@cnnic.net.cn 20060911mnt-by: MAINT-CNNIC-APsource: APNICperson: liu minnic-hdl: LM273-APe-mail: crnet_tec@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51848796fax-no: +86-10-51842426country: CNchanged: ipas@cnnic.net.cn 20041208mnt-by: MAINT-CNNIC-APsource: APNICinetnum: 222.32.0.0 - 222.63.255.255netname: CRTCdescr: CHINA RAILWAY TELECOMMUNICATIONS CENTERdescr: 22F Yuetan Mansion,Xicheng District,Beijing,Chinacountry: CNadmin-c: LQ112-CNtech-c: LM273-CNstatus: ALLOCATED PORTABLEchanged: hm-changed@apnic.net 20030902mnt-by: MAINT-CNNIC-APsource: CNNICperson: LV QIANGnic-hdl: LQ112-CNe-mail: crnet_mgr@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijingphone: +86-10-51892111fax-no: +86-10-51847845country: CNchanged: ipas@cnnic.cn 20060419mnt-by: MAINT-CNNIC-APsource: CNNICperson: liu minnic-hdl: LM273-CNe-mail: crnet_tec@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51848796fax-no: +86-10-51842426country: CNchanged: ipas@cnnic.net.cn 20041208mnt-by: MAINT-CNNIC-APsource: CNNIC 
