刚刚站点被挂马了，才清除了马，用了后台的杀毒没发现；然后用服务商的在线杀毒，就报了
然后看了一下文件修改时间，也没有异常
后台版本1.6.6
代码如下
{include file="public/layout"/}
<body style=" overflow-y: scroll;min-width:auto;">
<div id="toolTipLayer" style="position: absolute; z-index: 9999; display: none; visibility: visible; left: 95px; top: 573px;"></div>
<div id="append_parent"></div>
<div id="ajaxwaitid"></div>
<style type="text/css">
#layerid_1645756024 textarea
{
height: 220px;
}
</style>
<div style="min-width:auto; ">
<div>
<div>
<a href="{:url('Index/switch_map')}" title="返回"><i class="iconfont e-fanhui"></i></a>
<div>
<h3>安全中心</h3>
<h5></h5>
</div>
</div>
</div>
<!-- 操作说明 -->
<div id="" class="explanation mb15">
<ul>
<li>1、网站及时升级到最新版本，定时备份网站习惯。</li>
<li>2、不要使用系统破解版或盗版插件，大概率有预留后门，已有不少用户中招。</li>
<li>3、网站目录权限设置建议<a href="JavaScript:void(0);" data-href="https://www.eyoucms.com/plus/view.php?aid=28298&origin_eycms=1" on-click="openFullframe(this,'易优CMS目录权限设置教程，仅供参考');">【查看】</a></li>
</ul>
</div>
<div class="flexigrid htitx">
<form id="handlepost1" method="post" enctype="multipart/form-data" action="{:url('Security/handleSave1')}">
<div>
<div>
<table cellspacing="0" cellpadding="0" style="width: 100%">
<thead>
<tr>
<th class="sign w10" axis="col0">
<div></div>
</th>
<th abbr="article_title" axis="col3">
<div>后台安全中心</div>
</th>
<th abbr="ac_id" axis="col4">
<div class=""></div>
</th>
</tr>
</thead>
</table>
</div>
</div>
<div>
<dl>
<dt>
<label for="web_sqldatapath">数据备份路径</label>
</dt>
<dd>
__ROOT_DIR__<input id="web_sqldatapath" name="web_sqldatapath" value="{$global.web_sqldatapath|default=config('DATA_BACKUP_PATH')}" type="text" autocomplete="off" />
<p></p>
</dd>
</dl>
<dl>
<dt>
<label for="adminbasefile">后台登录路径</label>
</dt>
<dd>
__SITE_URL____ROOT_DIR__/<input type="hidden" name="adminbasefile_old" value="{$adminbasefile|default='login'}"><input id="adminbasefile" name="adminbasefile" value="{$adminbasefile|default='login'}" type="text" data-site_url="__SITE_URL__" on-keyup="this.value=this.value.replace(/[^\w\_\-]/g,'');" on-beforepaste="clipboardData.setData('text',clipboardData.getData('text').replace(/[^\w\_\-]/g,''));" style="width: 120px;" autocomplete="off" />.php
<p>为了提高后台的安全性，请及时更改后台入口文件。</p>
</dd>
</dl>
<dl>
<dt>
<label for="web_login_expiretime">后台登录超时</label>
</dt>
<dd>
<input id="web_login_expiretime" name="web_login_expiretime" value="{$global.web_login_expiretime|default=config('login_expire')}" autocomplete="off" type="text" /> 秒
<input type="hidden" name="login_expiretime_old" value="{$global.web_login_expiretime|default=0}">
<p>默认3600秒等于1小时，最多不超过1个月（2592000秒）</p>
<p class="notic2 none red" id="tips_web_login_expiretime"></p>
</dd>
</dl>
<dl>
<dt>
<label for="web_login_lockopen">登录失败锁定</label>
</dt>
<dd>
<label><input id="web_login_lockopen1" name="web_login_lockopen" on-click="login_lockopen(this);" value="1" type="radio" {if condition="!isset($global.web_login_lockopen) || $global.web_login_lockopen == 1"} checked="checked"{/if}>开启</label>
<label><input id="web_login_lockopen0" name="web_login_lockopen" on-click="login_lockopen(this);" value="0" type="radio" {if condition="isset($global.web_login_lockopen) && $global.web_login_lockopen == 0"} checked="checked"{/if}>关闭</label>
<span></span>
<p>登录多次失败后，账号将被锁定一定时长</p>
</dd>
</dl>
<div id="div_login_lock" class="{if condition='isset($global.web_login_lockopen) && $global.web_login_lockopen == 0'}none{/if}">
<dl>
<dt>
<label for="web_login_errtotal">登录错误次数</label>
</dt>
<dd>
<input id="web_login_errtotal" name="web_login_errtotal" value="{$global.web_login_errtotal|default=config('login_errtotal')}" type="text" placeholder="不启用默认留空" autocomplete="off" on-keyup="this.value=this.value.replace(/[^\d]/g,'');" on-paste="this.value=this.value.replace(/[^\d]/g,'')" /> 次
<p></p>
</dd>
</dl>
<dl>
<dt>
<label for="web_login_errexpire">登录锁定时间</label>
</dt>
<dd>
<input id="web_login_errexpire" name="web_login_errexpire" value="{$global.web_login_errexpire|default=config('login_errexpire')}" type="text" autocomplete="off" on-keyup="this.value=this.value.replace(/[^\d]/g,'');" on-paste="this.value=this.value.replace(/[^\d]/g,'')" /> 秒
<p>默认600秒等于10分钟</p>
</dd>
</dl>
</div>
<dl>
<dt>
<label for="web_xss_filter">编辑器防注入</label>
</dt>
<dd>
<label><input id="web_xss_filter1" name="web_xss_filter" value="1" type="radio" {if condition="!empty($global.web_xss_filter)"} checked="checked"{/if}>开启</label>
<label><input id="web_xss_filter0" name="web_xss_filter" value="0" type="radio" {if condition="empty($global.web_xss_filter)"} checked="checked"{/if}>关闭</label>
<span></span>
<p>XSS过滤，防止黑客利用编辑器注入恶意代码（如：inserthtml等操作）</p>
</dd>
</dl>
<dl>
<dt>
<label for="web_anti_brushing">网站防止被刷</label>
</dt>
<dd>
<label><input id="web_anti_brushing1" name="web_anti_brushing" value="1" type="radio" {if condition="!empty($global.web_anti_brushing)"} checked="checked"{/if}>开启</label>
<label><input id="web_anti_brushing0" name="web_anti_brushing" value="0" type="radio" {if condition="empty($global.web_anti_brushing)"} checked="checked"{/if}>关闭</label>
<span></span>
<p>开启后可以防止域名后缀加?wb=违禁词也能访问并被收录等情况</p>
<p>注意：静态模式下，首页生成应该改为“动态预览”才有效果</p>
</dd>
</dl>
<dl>
<div style="padding-bottom:0px;">
<a href="JavaScript:void(0);" on-click="checkForm1();" class="ncap-btn-big ncap-btn-green">确认提交</a>
</div>
</dl>
</div>
</form>
<form id="handlepost2" method="post" action="{:url('Security/handleSave2')}">
<div>
<div>
<table cellspacing="0" cellpadding="0" style="width: 100%">
<thead>
<tr>
<th class="sign w10" axis="col0">
<div></div>
</th>
<th abbr="article_title" axis="col3">
<div>密保问题设置</div>
</th>
<th abbr="ac_id" axis="col4">
<div style=""></div>
</th>
</tr>
</thead>
</table>
</div>
</div>
<div>
{include file="security/second_ask_html" /}
<dl>
<div style="padding-bottom:0px;">
<a href="JavaScript:void(0);" on-click="checkForm2();" class="ncap-btn-big ncap-btn-green">确认提交</a>
</div>
</dl>
</div>
</form>
<div>
<div>
<table cellspacing="0" cellpadding="0" style="width: 100%">
<thead>
<tr>
<th class="sign w10" axis="col0">
<div></div>
</th>
<th abbr="article_title" axis="col3">
<div>病毒查杀中心</div>
</th>
<th abbr="ac_id" axis="col4">
<div style=""></div>
</th>
</tr>
</thead>
</table>
</div>
</div>
<div>
<dl>
<dt>
<label>病毒木马查杀</label>
</dt>
<dd>
<a href="javascript:void(0);" data-href="https://www.eyoucms.com/plus/view.php?aid=5946&origin_eycms=1" on-click="openFullframe(this, '快速彻底根治网站源码里的木马代码与多余可疑文件');" class="ncap-btn ncap-btn-green">查看教程</a>
<span></span>
<p></p>
</dd>
</dl>
<dl>
<dt>
<label>可疑恶意文件</label>
</dt>
<dd>
<a href="javascript:void(0);" data-href="{:url('Security/ddos_kill')}" on-click="openFullframe(this, '可疑恶意文件');" class="ncap-btn ncap-btn-green">在线扫描</a>
<span></span>
<p></p>
</dd>
</dl>
</div>
</div>
</div>
<script type="text/javascript">
$(document).ready(function(){
$('#web_login_expiretime').keyup(function(){
var web_login_expiretime = $(this).val();
if (web_login_expiretime > 2592000) {
$(this).val(2592000);
$('#tips_web_login_expiretime').html('最多不能设置超过一个月（2592000秒）').show();
} else if (web_login_expiretime < 60) {
$('#tips_web_login_expiretime').html('最少不能设置低于60秒').show();
} else {
$('#tips_web_login_expiretime').hide();
}
});
});
function login_lockopen(obj)
{
var is_open = $(obj).val();
if (1 == is_open) {
$('#div_login_lock').show();
} else {
$('#div_login_lock').hide();
}
}
function checkForm1(){
// 后台登录超时
var web_login_expiretime_obj = $('input[name=web_login_expiretime]');
if (web_login_expiretime_obj.val() < 60) {
showErrorMsg('后台登录超时不能少于60秒！');
web_login_expiretime_obj.focus();
return false;
}
var adminbasefileObj = $('input[name=adminbasefile]');
var adminbasefile_oldObj = $('input[name=adminbasefile_old]');
if($.trim(adminbasefileObj.val()) == ''){
showErrorMsg('后台路径不能为空！');
adminbasefileObj.focus();
return false;
}
if (1 == $('input[name=web_login_lockopen]:checked').val()) {
var web_login_errtotal_obj = $('input[name=web_login_errtotal]');
if (web_login_errtotal_obj.val() < 2) {
showErrorMsg('登录错误次数不能少于2次！');
web_login_errtotal_obj.focus();
return false;
}
var web_login_errexpire_obj = $('input[name=web_login_errexpire]');
if (web_login_errexpire_obj.val() < 60) {
showErrorMsg('登录错误次数不能少于60秒！');
web_login_errexpire_obj.focus();
return false;
}
}
var adminbasefileObj = $('input[name=adminbasefile]');
var adminbasefile_oldObj = $('input[name=adminbasefile_old]');
if(adminbasefile_oldObj.val() != adminbasefileObj.val()){
var flag = false;
var site_url = adminbasefileObj.data('site_url');
layer.confirm('后台路径：<font color="red">'+site_url+'__ROOT_DIR__/'+adminbasefileObj.val()+'.php</font>，确认更改？', {
title: false,
btn: ['继续更改','取消'] //按钮
}, function(){
layer_loading('正在处理');
setTimeout(function (){
$.ajax({
type : 'post',
url : "{:url('Security/handleSave1', ['_ajax'=>1])}",
data : $('#handlepost1').serialize(),
dataType : 'json',
success : function(res){
layer.closeAll();
if(res.code == 1){
showSuccessMsg(res.msg, 500, function(){
top.window.location.href = res.url;
});
}else{
showErrorMsg(res.msg);
}
},
error: function(e){
layer.closeAll();
showErrorAlert(e.responseText);
}
});
}, 1);
}, function(index){
flag = false;
}
);
return flag;
}
layer_loading('正在处理');
setTimeout(function (){
$.ajax({
type : 'post',
url : "{:url('Security/handleSave1', ['_ajax'=>1])}",
data : $('#handlepost1').serialize(),
dataType : 'json',
success : function(res){
layer.closeAll();
if(res.code == 1){
showSuccessMsg(res.msg, 500, function(){
window.location.reload();
});
}else{
showErrorMsg(res.msg);
}
},
error: function(e){
layer.closeAll();
showErrorAlert(e.responseText);
}
});
}, 1);
}
</script>
<script type="text/javascript">
function checkForm2(){
var is_founder = {$admin_info['is_founder']|default=0};
if ($('input[name=security_ask_open]:checked').val() == 1) {
var security_ask = $('select[name=security_ask]').val();
var security_answer = $.trim($('input[name=security_answer]').val());
if ('add' == $('#is_ask_add_edit').val()) {
if (0 > security_ask) {
showErrorMsg('请选择密保问题！');
return false;
}
if (security_answer === '') {
showErrorMsg('请设置密保答案！');
$('input[name=security_answer]').focus();
return false;
}
} else {
if (security_answer !== '' || 0 <= security_ask) {
var security_answer_old = $.trim($('input[name=security_answer_old]').val());
if (security_answer_old === '') {
showErrorMsg('密保答案不能为空！');
$('input[name=security_answer_old]').focus();
return false;
} else {
if (0 <= security_ask) {
if (security_answer === '') {
showErrorMsg('请重置密保答案！');
$('input[name=security_answer]').focus();
return false;
} else if (security_answer === security_answer_old) {
showErrorMsg('重置密保答案不能与原来的一致！');
$('input[name=security_answer]').focus();
return false;
}
}
}
}
}
} else {
var security_ask_open = {$security['security_ask_open']|default=0};
if (0 == is_founder && 1 == security_ask_open) {
showErrorAlert('创始人才能关闭安全验证功能！');
return false;
}
if ('edit' == $('#is_ask_add_edit').val()) {
var security_answer_old = $.trim($('input[name=security_answer_old]').val());
if (security_answer_old === '') {
showErrorMsg('密保答案不能为空！');
$('input[name=security_answer_old]').focus();
return false;
}
}
}
var falg = security_answer_submit();
if (true !== falg) {
showErrorMsg(falg);
$('input[name=security_answer_old]').focus();
// autoload_security();